The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 109 to 168 of 658 briefings

Sunday 18 October

A dark desk in cool blue light. A black contact-centre headset with a boom microphone lies in front of an open laptop whose screen shows only blank rounded pill shapes and a smooth abstract waveform, with an unmarked desk telephone behind. The left half is empty dark space with the headline and a stat drawn over it: 3.7 points.

AI Security18 Oct 2026

Grok Voice 3.0: 3.7 points ahead on one index, 0.2 on task success, 2.9 behind one rival on the agent test

What xAI's Grok Voice 3.0 post establishes against Artificial Analysis's and ServiceNow's pages: the margins drawn to scale, latency and cost on their own clocks, the alias that switched agents, and what UK ICO, Ofcom and DSIT pages say about a voice agent on a customer line.

A dark data-centre aisle with an open black GPU server on a steel bench, a row of eight finned graphite heatsinks inside it, a fan wall and two blank recessed plates on its front panel. The left half is empty dark navy, with the headline and a stat drawn over it: 293.6 GB, the smallest official copy.

AI Security18 Oct 2026

Reflection's Beam is Apache 2.0 and needs 293.6 GB at 4-bit; its maker says fine-tuning can remove the safety training

The memory a Beam deployer needs by format and hardware, the cache that 1M tokens cost, what the Apache 2.0 licence and the vendor's safety report do and do not say, independent numbers, UK controls and a ranked checklist.

A dark data-centre aisle in blue and amber light. A wide server chassis with its lid removed sits on a steel bench, six unmarked graphite accelerator modules in a row under a bank of fans, three blank rounded plates on its perforated front. A grey network cable lies coiled on a black mat. The left half is empty dark blue, with the headline and a stat drawn over it: 533 GB.

Market and Supply Chain18 Oct 2026

Muse Spark Open: 533 GB at 4-bit, about 50 GB read per token, and what Meta's launch leaves unstated

Memory, bandwidth ceilings and cache arithmetic for Meta's Muse Spark Open from the public file listing and config, what the licence says, independent scores with cost beside them, what was not found, UK guidance and an ordered checklist.

A dim hospital ward office at dusk. A single desktop monitor on a pale grey desk glows blue-white, its screen showing only blank rounded shapes where a patient record would be, with a plain keyboard and mouse in front, an empty office chair behind and a window with a deep blue sky to the left. No people appear. The left half is dark, with the headline drawn over it: 15 dismissed over access to victims' records, and the words still in testing.

Breaches and Incidents18 Oct 2026

NUH has dismissed 15 staff over Nottingham victims' records; its monitoring system is still in testing

What the Trust's 16 October statement establishes (34 hearing outcomes, 15 dismissals) and omits, how its own evidence says the access was found, what the ICO, NMC, GMC and NHS England pages say, and a ranked checklist for holders of health records.

A dark desk in cool window light. An unbranded slim grey laptop shows a job-listings page made only of blank rounded bars and pills, one bar outlined in indigo. A stack of plain white sheets holds one yellow highlighter stripe, and a plain white mug stands beside the laptop. The left half is empty dark blue, with the headline and a stat drawn over it: 654 to 2,409.

Market and Supply Chain18 Oct 2026

US security postings fell 26.4%, and the 268.3% AI Security Engineer rise starts from 654 postings

What CyberSN's report and SecurityWeek's headline establish about US security postings, the 654 behind the 268.3%, the base year behind the 26.4% fall, what is not stated, what the UK government's own series says, and a ranked checklist for reading postings data.

A dark IT desk lit by a flat monitor. The screen shows a long client list made only of blank rounded bars, one row highlighted in pale cyan. Beside it an open cardboard archive box of plain unmarked folders and a coiled stethoscope rest on the desk. The left half is empty dark blue, with the headline and a stat drawn over it: 4 days.

Breaches and Incidents18 Oct 2026

XTIUM warned BCHP 4 days before BCHP saw activity; NY says XTIUM cannot definitively confirm its entry route

What New York's agreement with BCHP and XTIUM states and leaves out: 4 days from warning to detection, 18 client systems reached and one breached, $2.7 million announced against $4 million on paper, 825,000 or 820,000 New Yorkers, and what UK suppliers should check.

Saturday 17 October

A dark school classroom desk lit by a flat monitor. The screen shows a generic file list made only of blank rounded bars, one selected in pale cyan. A stack of unmarked cream test booklets and a soft out-of-focus answer sheet with a pencil lie in front. The left half is empty dark blue, with the headline and a stat drawn over it: 126 days.

Breaches and Incidents17 Oct 2026

ETS says a login copied California student files from 22 May; found 126 days later, no student count stated

What the ETS notice filed with the California Attorney General states and leaves out: 119 days between its two dates, 126 to discovery, who says 7 million, what CDE's own pages could not be read for, other regulators' lists, and what UK suppliers should check. Defender level.

A dark hospital records room at night. On the right, a tall metal shelving bay of identical grey-blue folders, three of them pulled slightly forward, and a dark computer monitor on a desk showing only rows of empty rounded bars, one with a faint amber tint. The left half is empty dark blue, with the headline and a stat drawn over it: 16 OF 25+.

Market and Supply Chain17 Oct 2026

16 NHS non-users of Palantir's platform in 25-plus FOI replies; NHS England lists at least one of them as live

The Guardian's 16 NHS non-users set against NHS England's counts of 170 signed up, 142 live and 137 reporting benefits: who picked the replies, what live means, whether use is required, what the contract says about the end of its term, UK data governance and where it stops, and checklists.

A dark steel corridor in low blue light. A long wall of identical closed steel mailbox doors, each with a plain lock and a blank recessed label well, recedes along the right. A single brass key on a plain steel ring lies on the ledge in front. The left half is empty dark blue, with the headline and a stat drawn over it: 3 counts, Huntress's 162, over 300 and almost 1,000 tenants.

Breaches and Incidents17 Oct 2026

ConnectWise Cloud Backup's app credential, not a person's: Huntress gives 162, over 300 and almost 1,000 tenants

What Huntress, Todyl and ConnectWise state about a stolen Cloud Backup application credential: 162, over 300 or almost 1,000 tenants, a 141-minute window, 35 h 34 min to the first advisory, and no confirmed data access. Where UK guidance and the Bill stop. Defender level.

A dark server hall in cool blue light. A row of identical black rack servers with perforated mesh fronts and small round status lights fills the right of the frame. On the middle server a strip of plain pale tape lies across the handle, blank. A slim console tray below it holds a small lit screen showing only an empty rounded pill and one block cursor. The left half is empty dark blue, with the headline and a stat drawn over it: 168+ days.

Threat Intel17 Oct 2026

Unit 42 says AI-generated code hit government Linux servers, but gives no count of victims, countries or scripts

What Unit 42's report on CL-UNK-1211 states and does not, the AI claim rung by rung, the labels that carry it, the planted red-team markers, what NCSC guidance and Cyber Essentials cover and where they stop, and a ranked checklist. Defender level only.

A dark clerk's counter in low blue light. A tidy stack of plain cream envelopes, all blank, lies on a walnut counter beside an empty black wire tray. Behind them a flat computer monitor stands switched off, its screen dead black, and a blank brass plate sits on the counter edge. The left half is empty dark blue, with the headline and a date drawn over it: US bankruptcy notices halted since 9 October.

Breaches and Incidents17 Oct 2026

US bankruptcy notices halted since 9 October: BAE says 'isolated'; cause, data and end date are not stated

What the Judiciary, nine courts, the bankruptcy rules, BAE's newsrooms and the UK texts establish about the BNC outage, what they leave out, the arithmetic against 14, 21 and 28 day windows, what UK buyers of outsourced systems can rely on, and three ranked checklists.

A dark pathology laboratory bench in cool light. A pale grey rack of identical sealed sample tubes with blank white labels stands in front of a compact grey and white benchtop analyser whose black glass panel is switched off. The left half is empty dark blue, with the headline and a stat drawn over it: 865 days.

Breaches and Incidents17 Oct 2026

Alleged Qilin member held over a 2024 logistics attack; Synnovis 'included' on one BBC report, no charge reported

What German, Japanese and UK authorities have stated about the Qilin arrest and the Synnovis attack, what no record states, whose numbers the 4,000 and 140 million are, how the death link was established, which UK laws could apply and where each stops, and a checklist for suppliers and CISOs.

Page 11

Saturday 17 October

A dark laboratory bench in dim blue light. A clear glass test chamber with a slim aluminium frame holds a small white robotic arm reaching towards the single steel latch on its closed glass door. A blank black panel with two empty recessed slots stands beside it. The left half is empty dark blue, with the headline and a stat drawn over it: 50 numbered items, 0 deadlines, 87 days.

AI Security17 Oct 2026

US guidance for AI agent testing: 50 numbered items, 0 deadlines, 87 days after OpenAI's first escape report

What the 16 October guidance states and leaves out on shutdown, independent evaluation and reporting, the 28 incident records before it, why no one has a verified count of escapes, what UK guidance covers and where it stops, and three ordered checklists. Defender level only.

A dim server room in dark blue. A slim monitor on a dark desk shows a pale blank session window made of empty rounded slots, with no text or icons. Behind it, a dark equipment rack holds slim unmarked metal appliance panels and loose black cables. The left half is empty dark blue, with the headline and a stat drawn over it: 47 days from first known exploit to advisory.

Threat Intel17 Oct 2026

BeyondTrust Remote Support: first known exploit 29 August, advisory 47 days later, two victims stated

The dates behind the BeyondTrust Remote Support zero-day, what the record does not establish (victims, Privileged Remote Access, the patch), nine labels read against the primaries, four UK clocks, and ordered checklists for a service desk, an MSP and a CISO. Defender level only.

A dark lab desk at night seen from low down. On the right, a thin monitor shows only rows of empty rounded bars, two of them with a faint amber tint. In front of it lie three identical grey-blue folders in an overlapping row, each with an empty rounded label well. The left half is empty dark blue, with the headline and a stat drawn over it: 57 DAYS.

AI Security17 Oct 2026

OpenAI model pulled 24 years of data for a 1-year request; found 57 days later, owner notice not stated

Three OpenAI reports of 15 October read in full: what each says a model did, the 57 to 91 days before discovery, what is stated and not stated, UK law and where it stops, and ordered checklists for labs, enterprises and public bodies. Defender level only.

A dark open-plan office. Six identical pale grey desks recede in a row, each with one blank white visitor badge on a grey lanyard and an empty charcoal chair. A tall grey steel cabinet stands shut and locked beside the end of the row. The left half is empty dark blue, with the headline and a stat drawn over it: 27 HOURS.

Compliance and Regulation17 Oct 2026

Anthropic's METR arrangement: six staff, no veto, and a redaction clause rewritten 27 hours after publication

What Anthropic's 15 October post on METR and other evaluators establishes, what changed on 16 October, who pays whom, what the White House Accord requires, how the bank analogy maps onto UK law, and what a UK buyer can ask.

Friday 16 October

Editorial illustration of halted envelopes on a notice conveyor in front of a generic courthouse, representing the Bankruptcy Noticing Center outage

Breaches and Incidents16 Oct 2026

BAE Systems cyber incident stops US bankruptcy notices; courts diverge on deadlines

A source-led timeline, the operational split between filing and service, district-by-district orders, and the facts still missing about the BAE Systems incident.

Conceptual microphone between two abstract sound waves

AI Security16 Oct 2026

GPT-Live-1.1 brings new ChatGPT voices and accents; safety card shows mixed results

The 15 October GPT-Live-1.1 rollout, model tiers, multilingual voices, full-duplex behaviour and the system card's contrasting safety findings.

Conceptual law-enforcement evidence desk with closed laptop and folders

Threat Intel16 Oct 2026

INTERPOL reports 95 arrests across 17 countries in child-abuse material operations

The scope, investigative methods, safeguarding result and evidence limits behind INTERPOL's 15 October announcement.

Conceptual smartphone showing a generic call warning shield

AI Security16 Oct 2026

Google expands Android scam defences across Messages, calls and screen sharing

What each new Android scam defence does, when it arrives, who can use it and what Google's headline figures do not prove.

Conceptual server-room illustration with a document icon on a rack display and a red line reaching it

Threat Intel16 Oct 2026

Nextcloud built-in CODE Server attacks: what CVE-2026-110447 exposed and who needs to act

A source-led breakdown of CVE-2026-110447, observed webshell activity, the affected built-in CODE Server mode and practical incident-response checks.

Illustrative desktop contrasting a verified source archive with a warned install script; all on-screen file names are fictional.

Threat Intel16 Oct 2026

Fake Arch AUR helper hid a root-level install script behind genuine yay source code

How the fake yyay package used a valid source archive as cover, what the .install script changed, what is confirmed about removal, and practical checks for Arch users.

Illustrative isolated computing chamber with separate control console, representing an AI agent sandbox.

AI Security16 Oct 2026

Perplexity open-sources SPACE agent sandbox; its own tests show why VM and network isolation need separate checks

What SPACE actually provides, how its control and command paths differ, the reported red-team results, local deployment requirements and security questions for adopters.

Illustrative code review screen with a security finding and proposed fix; no real GitHub alert is shown.

AI Security16 Oct 2026

GitHub ships AI Scan and agentic autofix: one flags pull-request risks, the other proposes reviewed repairs

An evidence-led comparison of GitHub AI Scan and agentic autofix: coverage, branch limits, merge blocking, prerequisites, billing and a practical rollout plan.

Page 12

Friday 16 October

Illustration of a laptop login screen beside an office network access point; no actual Windows configuration is shown.

Threat Intel16 Oct 2026

Windows October update changes NTLMv1-derived SSO default: check MS-CHAPv2 Wi-Fi and VPN before users lose access

A precise before-and-after comparison, affected versions, NTLM event IDs 4024 and 4025, a scoped temporary exception and the migration path for Wi-Fi, Ethernet and VPN.

Illustrative photograph of network edge devices in a home office; no victim device is shown.

Threat Intel16 Oct 2026

GreyNoise finds 143 proxyjacked edge devices; a separate intrusion shows why residential IPs complicate detection

The skynox7 proxyjacking campaign, affected device classes and CVEs, the separate Entra ID investigation, observed TTPs and defender checks.

Conceptual dark server rack and gateway representing a remote support appliance; no real BeyondTrust system is shown.

Threat Intel16 Oct 2026

BeyondTrust Remote Support zero-day: the patch is urgent, but the appliance may not tell the whole story

What happened, which Remote Support versions need BT26-05-RS, the observed SAWFLY and BARECLAW tradecraft, and where defenders should look when on-device logs have been erased.

White Tesla Roadster prototype airborne above the demonstration site, with cold-gas plumes beneath it at night.

Market and Supply Chain16 Oct 2026

Tesla Roadster goes airborne and flips: what the launch actually proves

Tesla’s new Roadster flew and flipped in a controlled demonstration. We examine the three versions, Tesla’s performance claims, and the UK reservation terms.

Thursday 15 October

Infoblox-published example of a fraudulent Microsoft-themed support warning over a browser, with a fake support number. This is a scam example, not a real Microsoft alert.

Threat Intel15 Oct 2026

Infoblox links 20,000 Cloudflare Pages domains to Help TDS; a browser scare becomes a remote-access lure

Help TDS and Hotejka: what Infoblox observed, what 20,000 domains cannot count, and practical controls against fake support and remote-access scams.

AI-generated editorial illustration of a green NGINX gateway in a server room with a metal protective panel being fitted.

Threat Intel15 Oct 2026

NGINX fixes five flaws in 1.30.6 and 1.31.7; configuration determines exposure

NGINX 1.30.6 and 1.31.7 patch five issues. A CVE-by-CVE table, version ranges and practical checks for HTTP/3, TLS tickets, rewrites and AIO.

AI-generated editorial illustration of violet workflow modules and a central gear module in a transparent enclosure, labelled Langflow MCP security.

AI Security15 Oct 2026

Langflow: one sensor reports attacks, while two MCP advisories name different fixes

Langflow MCP security: distinguish two CVEs, one-sensor attempt counts, development auto-login and the separate 1.9.0 and 1.10.3 fixes.

AI-generated editorial illustration of layered black-and-white web panels with blue light, labelled Next.js security update.

Market and Supply Chain15 Oct 2026

Next.js fixes two critical RCE flaws; the sharp workaround covers only one

Next.js patch briefing: three exposure checks, fixes in 16.4.1 and 15.5.28, the sharp 0.35.5 workaround and a practical deployment checklist.

NVIDIA promotional illustration showing a globe behind icons for documents, code, data charts, video and an AI model.

Market and Supply Chain15 Oct 2026

NVIDIA launches Nemotron 3.5 Super VL and 24GB Bolt. What can you run locally?

Full Nemotron 3.5 analysis: interactive comparisons, independent scores, local speed, quantisation regressions, memory, training, software and costs.

A dark desk with a closed plain silver laptop at the back right, a ring of brass keys with blank round bows in front of it, and a fan of blank white hotel-style key cards, one card stood up on the key ring. The left half is empty dark blue, with the headline and a stat drawn over it: 9 PRODUCTS.

Threat Intel15 Oct 2026

Symantec names 9 AI products in Aoki infostealer's targets; victims, sample dates and delivery are not stated

What Symantec's report establishes about Aoki and AI assistant credentials, what it leaves out, the dated record, vendor statements on storage, lifetime and revocation, what UK guidance covers, and ordered checklists. Defender level only.

A matte graphite laptop and a plain black smartphone on a dark desk in a night office, each showing a page of empty grey bars with one bright rectangular advertising slot holding a blank panel and an amber empty button. Behind them a row of identical dark monitors recedes. The left half is empty dark blue, with the headline and a stat drawn over it: at least 45.

Threat Intel15 Oct 2026

AdFection: Citizen Lab says ads helped Candiru target at least 45 Al Jazeera devices, no infection count

What Citizen Lab's AdFection report and Confiant's post establish, what they leave out, why the 45 devices and the 441,954,291 impressions cannot be divided, what the ad platforms said, what UK guidance covers and where it stops, and three ordered checklists. Defender level only.

A dark equipment room with a black server rack on the right and its mesh door swung open. Six identical grey servers carry blank pill-shaped nameplate wells, and a pull-out console shows a dim admin screen made only of empty rows and one indigo button. The left half is empty dark blue, with the headline: a critical Drupal flaw, its team said exploits might come in hours or days, and the figure 28.5%, of reporting sites, affected branch, no fix.

Threat Intel15 Oct 2026

Drupal's critical Field UI flaw has no fix for 28.5% of reporting sites; its team said exploits may take hours or days

What the Drupal Security Team's advisory and release notes state and do not state about CVE-2026-108097, the arithmetic behind 28.5 per cent, the May exploitation precedent, UK controls and where they stop, and a ranked checklist for three kinds of owner. Defender level only.

Page 13

Thursday 15 October

A dark wall with a grey switchboard patch panel on the right. Eighteen black cords, each plugged into its own jack above a blank label slot, gather into one bundle that runs down into a single brass junction box with a blank plate. The left half is empty dark blue, with the headline: the fix was public before Check Point published its findings, and the number 179 days.

AI Security15 Oct 2026

Check Point's LiteLLM flaws were fixed 179 days before its post; 1.83.9 is inside seven later advisories

What Check Point, LiteLLM, CVE.org, PyPI, CISA and independent researchers say about two LiteLLM gateway flaws: the dates, the versions, who needs what access, what exploitation is reported, UK controls and a ranked checklist. Defender level only.

Four plain brass padlocks of different ages stand in a row on a dark bench, from an old tarnished lock to a slim modern one with a faint cyan glow at the shackle. Each has a blank oval plate and a keyhole. The left half is empty dark blue with the headline Post-quantum TLS profiles are in. Still no date. and the figure 2031.

Compliance and Regulation15 Oct 2026

NCSC's new TLS guidance adds post-quantum profiles but prints no year; the blog beside it prints one, 2031

What changed between versions 1.1 and 1.2 of the NCSC's TLS guidance, how many recommendations carry a date or a test, how far the 2028, 2031 and 2035 milestones are, which groups are on by default, what the UK instruments say, and a ranked checklist.

A dark committee room. A thick printed Bill lies open on a polished walnut table, its pages showing rows of blank grey bars where text would be, with a pale cyan paper slip between them. Beside it stands an empty clear name-card holder on a steel foot. A row of empty teal leather chairs recedes into shadow. The left half is empty dark blue, with the headline and a stat drawn over it: 0 of 47.

Compliance and Regulation15 Oct 2026

UK Cyber Bill: AI appears 0 times in the text; 0 of 47 amendments on the 13 October list are the Government's

What the Bill, its amendment list, Hansard and the Government's three 12 October texts establish about AI in the Cyber Security and Resilience Bill, what they leave out, the calendar in days, which department owns it, what binds UK organisations now, and a ranked checklist.

A dark records archive. One long bank of pale grey steel shelving runs away on the right, filled with identical grey ring binders whose spines carry empty label slots, with a blank grey microfilm viewer in the foreground. At the far end of the aisle one desktop terminal glows with an empty pale screen. The left half is empty dark blue, with the headline and a stat drawn over it: legal aid breach data now goes back to 1978, 2010 to 1978.

Breaches and Incidents15 Oct 2026

Legal Aid Agency's stated data start moved from 2010 to 1978: about 250,000 pre-2007 records, no count of people

What the Legal Aid Agency's 14 October 2026 update states about records back to 1978, what it leaves out, the arithmetic behind the moving start date, why old records were online, what UK law and policy say, and a ranked checklist. Defender level only.

A pale grey-white polling booth with two tall side screens stands in a dark room on the right of the frame. On its plain shelf a tablet shows three empty rounded chat shapes, and a blank paper slip lies beside a pencil on a string. The left half is empty dark blue, with the headline and a stat drawn over it: 0.002%.

AI Security15 Oct 2026

Anthropic's 0.002% election-policy violation rate is about 5 in 250,000 conversations, with no count of actions

What Anthropic's 14 October 2026 post establishes about election use of Claude and what it leaves out: the arithmetic behind 0.002%, the 99% beside 85% on the same cards, where UK rules stop for chatbots, and checklists for election teams, communications leads and companies.

Eight identical blank slate-blue bound court files stand in a row on a pale oak records-office counter, with a tablet computer leaning against them showing blank grey chat bubbles. The left of the picture is dark navy with the headline: Eight states. Eight courts. Allegations, not findings. 27 counts.

Compliance and Regulation15 Oct 2026

Eight states filed eight separate suits against OpenAI: of 27 counts in six read, 6 concern AI agents

What the eight state filings plead about children, what they do not establish, where OpenAI's own pages agree and differ, what UK rules cover a chatbot children use, and a checklist for a school, a parent-facing organisation and a company.

A dark police station front counter in cool blue light. A rugged black tablet on a stand shows an empty grid of six blank dark frames beside a column of blank pills. A stack of clear evidence bags and blank white tags lies in front, a plain black shop basket holding two unmarked boxes stands to the right, and a small blue lantern glows behind. The left half is empty dark blue, with the headline and a stat drawn over it: 179 people.

Compliance and Regulation15 Oct 2026

ICO: about 500 Met accounts on Auror, 179 people uploaded, no DPIA, and a control gap it dates to May 2018

What the ICO's reprimand and enforcement notice to the Met establish about the Auror platform, what they leave out, the dates and deadlines worked out, which UK regime governs police and retailer flows, and ordered checklists for a force DPO, a retailer and a vendor.

A dark equipment room. In a black rack, a flat unmarked network appliance with a row of empty sockets has one grey cable plugged into its left socket, and a small blank paper tag tied to the cable. The left half is empty dark blue, with the headline and a stat drawn over it: 561 to 590 days.

Threat Intel15 Oct 2026

Unit 42 dates its FortiGate implant case to September 2024; the flaw behind the implant was published in April 2026

What Unit 42's PEERSTITCH report states and leaves out, the fix dates for four Fortinet flaws, why patching the FortiManager does not return stolen keys, what the NCSC, Cyber Essentials and the ICO say, and a ranked checklist. Defender level only.

A dark shop counter with a checkout touchscreen on the right showing a blank page of empty rounded shapes: an empty amber button inside an outlined banner, two empty grey bars and an empty cyan button below. A pale robotic hand in a grey glove reaches in from the upper right with one finger over the amber button. The left half is empty dark blue, with the headline and a stat drawn over it: 91%.

AI Security15 Oct 2026

HiddenLayer's Jev checkout test prints one query, 91% on the ad button, and states no trial count

What HiddenLayer's two pages print for Jev, what they leave out, the arithmetic on the one count they give, an independent preprint on the same version, TypeSafe's claims against its own documentation, what UK guidance says, and a ranked checklist. Defender level only.

A dark desk at night. An open graphite laptop shows a plain split window: a narrow left pane with five blank grey bars and a wide pale right pane with one blank bar across the top. In front of it lie a ring of old brass keys, one lifted from the others, and a blank white key-card. The left of the frame is empty dark blue, with the headline and a stat drawn over it: 44 days.

AI Security15 Oct 2026

Noma's SneakPeek report on Claude Code Desktop: 44 days to a final fix, and no Anthropic advisory found

Noma's SneakPeek dates computed from its blog and press release, which disagree on the first fix; what Anthropic's changelog and advisories say, which versions are fixed, whether auto-update applies, UK controls and an ordered checklist.

A dark server room, the left half empty dark blue with the headline and a stat drawn over it: 3 DAYS. On the right a flat grey rack-mount firewall appliance in a black rack, its faceplate unmarked, with a small separate two-jack panel at one end lit by a single cyan light. A plain blank off-white access card lies on the shelf below it.

Threat Intel15 Oct 2026

PAN-OS CVE-2026-0322: CISA gave 3 days, and Palo Alto gives no count for 'very limited' exploitation

What Palo Alto's advisory, CISA's entry and the NCSC's pages establish about CVE-2026-0322: a 3-day window against Cyber Essentials' 14, which PAN-OS builds are fixed, ten open questions, UK controls and an ordered checklist. Defender level only.

Wednesday 14 October

A dark spare room. On a plain steel wall shelf stand eight identical closed silver laptops, each with a tiny cyan status light on the shelf's front edge, above a bare desk with a black power strip and an empty black office chair. The left half is empty dark blue, with the headline and a stat drawn over it: 40+ Texas residences searched, 14 charged in Ohio, overlap not stated, and $3M.

Threat Intel14 Oct 2026

Over 40 Texas residences searched, 14 charged in Ohio, and no stated overlap between the two DOJ actions

What the DOJ releases and the 58-page indictment state about the 40-plus Texas residences, the 14 charged, the $3 million and the 70-plus companies, where five news stories count differently, what UK law asks of an employer hiring remote developers, and an ordered checklist.

Page 14

Wednesday 14 October

A dark desk at night with an open graphite laptop on the right. Its screen shows a generic empty browser window made of blank rounded shapes. In front of it a heavy brass chain joins three padlocks, each with its shackle open. The left half is empty dark navy with the headline and a stat drawn over it: 6 days.

AI Security14 Oct 2026

XBOW says a six-day Chrome chain cost about $40,000 and won $250,000, but not which access tier of GPT-5.6 Sol

What XBOW's pages, Google's release notes, rules page and public tracker, and OpenAI's model pages establish about a six-day Chrome chain, what they leave out, the arithmetic, UK patch clocks and the Computer Misuse Act as read, and a ranked checklist.

A brass balance scale on a dark slate table in blue light. In the left pan, a glass dish holds a neat stack of plain, unmarked square silicon processor packages. In the right pan sits a smaller stack of blank pale grey-blue research folders. The beam is level. The left half is empty dark blue, with the headline and a stat drawn over it: $50M a year.

AI Security14 Oct 2026

Nvidia's $250m UK AI safety pledge is $50m a year of compute, with commercial terms still to be agreed

What Nvidia's release and the Guardian's report establish about the $250 million pledge, the arithmetic against AISI's budget and Nvidia's own results, what is not stated, what UK guidance says about accepting vendor money, and an ordered checklist.

A dark server rack in cold blue light. A glass-fronted rack stands open on the right with plain grey servers, and one server tray is slid forward. In it sits a smaller matte black box with a hairline crack across its lid that runs out over the grey floor of the tray, with a thin cyan light along the line. The left half is empty dark blue, with the headline and a stat drawn over it: 2 OF 5.

Threat Intel14 Oct 2026

Vghost: kernel fix dated 3 August, demos 12 October, and 2 of 5 tested distributions still without a fix

What the kernel commit, the CVE record and the vendor trackers establish about Vghost, what found by AI does and does not say, how seven raters score it from 6.4 to 8.8, which of 26 releases have a fix, the UK clocks and a ranked checklist. Defender level only.

A dark equipment cabinet in cool light. A large brass screw-threaded coupling with a visible thread and a backed-off nut hangs in a dense sweep of cables in cyan, blue, white, grey, red and amber that all run into it. Blank recessed plates sit on unmarked rack units behind. The left half is empty dark blue, with the headline and a stat drawn over it: 616 days.

Threat Intel14 Oct 2026

curl's first High flaw in 1,099 days was in 13 releases; curl lists eight conditions for code execution

The arithmetic behind curl's High flaw, what its advisory states and leaves out, where libcurl hides, what the distributions had fixed on 14 October, the UK patch clocks as read, and a ranked checklist. Defender level only.

A plain black rack-mounted network appliance with two blank pill-shaped recesses on its bezel takes in a line of five blank cream envelopes on a steel roller conveyor. The envelope nearest the viewer carries one blank red wax seal. The left half is empty dark blue, with the headline and a stat drawn over it: 30 days.

Threat Intel14 Oct 2026

Cisco's second exploited email gateway flaw in 30 days: its two fixed builds were named on 14 September

What Cisco's 14 October advisory for CVE-2026-76519 states and leaves out, the two conditions and the scanner update that fixes it, the 16.0 gap, what Shadowserver's count can and cannot say, what NCSC, Cyber Essentials and the ICO say as read, and an ordered checklist. Defender level only.

A dark strongroom in cool steel light. A closed round vault door with a five-spoke wheel stands at the back right. In front of it a stack of six slate-blue ledger books is bound in a steel chain and held by one padlock, with three blank grey tags hanging from it. The left half is empty dark blue, with the headline and a stat drawn over it: 4 names, 1 entry.

Compliance and Regulation14 Oct 2026

UK lists Cryptomus and Heleket as one entity on a Russia ground, and the notice never mentions ransomware

What the UK notice states and does not, the arithmetic behind the Canadian fine and the 900 illicit counterparties a month, why a rebrand is not a control, what OFSI, the FCA, the NCSC and the ICO say as read, where the ransomware payment proposals stand, and an ordered checklist.

A dark print shop. On the right, four taut cords hold rows of identical pale paper sheets, each printed with the same blank page layout of empty rounded bars and boxes and no writing. One sheet in the front row has been ripped away, leaving a ragged strip in two wooden pegs and a crumpled scrap on the floor. The left half is empty dark blue, with the headline and a stat drawn over it: 34 names.

Threat Intel14 Oct 2026

Microsoft's temporary order moves 34 names under five domains; its billion messages are not a victim count

What Microsoft's announcement, its sworn declarations and the court order actually count: 34 names moved, a billion messages with no stated method, 1.1 million dollars traced against tens of millions claimed, and what UK organisations should do.

A dark small-shop back room. A row of plain white and grey boxes with blank label wells sits on a shelf above a counter holding a switched-off terminal screen on a stand and a pale grey card reader, with a dark server tower at the far right. The left of the frame is empty dark blue, with the headline and a stat drawn over it: 177 listed.

Threat Intel14 Oct 2026

Adobe's October bulletins list 177 flaws; every one rated critical sits in AEM, ColdFusion or Commerce

What Adobe's 11 bulletin pages establish and do not, why 176 is 177 entries and 175 ids, how priority 2 and 3 compare with the Cyber Essentials and NCSC clocks, the Commerce hotfix beside a no exploits line, and a ranked checklist. Defender level only.

A dark navy desk seen from high above. A very tall stack of blank white paper stands on the right, a small blank cream card lies in front of it, and a straight row of identical blank cream cards runs across the foreground with a small black-stand magnifying loupe over one of them. The left third is empty dark space carrying the headline and a stat drawn over it: 45 of 203.

Compliance and Regulation14 Oct 2026

Home Office asylum summaries: 45 of 203 failed first review, and omissions are not a stated failure test

What the Home Office's FOI counts, DPIA, ministerial letters and ATRS hub show about two AI tools in asylum casework: the arithmetic behind 45 of 203, what a checked sample cannot say about the rest, UK controls as read, and two ordered checklists.

A dark room. A small vintage glass-domed ticker machine stands on a wooden table beside a smartphone with its screen switched off. A pale paper ribbon rises from the machine and splits into many thin strands that reach a tall wall of several hundred identical small pigeonholes, a few holding curls of blank paper. The left half is empty dark blue, with the headline and a stat drawn over it: 627 days.

Compliance and Regulation14 Oct 2026

Norway fines Xandr NOK 92 million over Grindr data: assumed consent rejected, user count not established

What the Xandr decision establishes and redacts, the arithmetic behind the fine, how it differs from the Grindr case, what the ICO, UK GDPR Article 26, PECR and the 2025 Act say, and an ordered checklist for UK app publishers and ad buyers.

A dark frame with a traditional brass balance scale on a dark wooden counter, the whole scale on the right half. On the left pan hangs a small glowing pale blue plaque shaped like a blank browser window, with three empty dots, an empty address pill and an empty panel. On the right pan sits a short stack of plain blank coins. The left half carries the headline and the stat $2,000.

Market and Supply Chain14 Oct 2026

Chrome's bounty base is up 4x to $2,000, and Google's blog and rules page disagree on renderer rewards

Google's three Chrome rate cards side by side, cell by cell, the ratios between them, where the blog and rules page disagree, a Stated and Not stated table, what UK guidance says, and ordered checklists for Chrome patching and for running a bounty.

A dark desk after hours. On the right, three tall stacks of grey bound ledgers with blank label plates stand beside a closed silver laptop, and a cream folder with one red paper clip lies on the laptop. The left is empty dark navy with the headline and stat drawn over it: seven totals for one release, one exploited CVE, 7 TOTALS.

Threat Intel14 Oct 2026

Microsoft's October Patch Tuesday has seven totals, 1,407 to 1,417, and one exploited CVE, not three zero-days

Which rule produces each outlet's total and Critical count, what zero-day did and did not mean, what Microsoft states about the exploited Windows Shell bug, why its risk cohorts omit it, and the UK clocks and an ordered checklist, and September's release set beside it.

Show 12 more