The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 133 to 168 of 658 briefings

Friday 16 October

Illustration of a laptop login screen beside an office network access point; no actual Windows configuration is shown.

Threat Intel16 Oct 2026

Windows October update changes NTLMv1-derived SSO default: check MS-CHAPv2 Wi-Fi and VPN before users lose access

A precise before-and-after comparison, affected versions, NTLM event IDs 4024 and 4025, a scoped temporary exception and the migration path for Wi-Fi, Ethernet and VPN.

Illustrative photograph of network edge devices in a home office; no victim device is shown.

Threat Intel16 Oct 2026

GreyNoise finds 143 proxyjacked edge devices; a separate intrusion shows why residential IPs complicate detection

The skynox7 proxyjacking campaign, affected device classes and CVEs, the separate Entra ID investigation, observed TTPs and defender checks.

Conceptual dark server rack and gateway representing a remote support appliance; no real BeyondTrust system is shown.

Threat Intel16 Oct 2026

BeyondTrust Remote Support zero-day: the patch is urgent, but the appliance may not tell the whole story

What happened, which Remote Support versions need BT26-05-RS, the observed SAWFLY and BARECLAW tradecraft, and where defenders should look when on-device logs have been erased.

White Tesla Roadster prototype airborne above the demonstration site, with cold-gas plumes beneath it at night.

Market and Supply Chain16 Oct 2026

Tesla Roadster goes airborne and flips: what the launch actually proves

Tesla’s new Roadster flew and flipped in a controlled demonstration. We examine the three versions, Tesla’s performance claims, and the UK reservation terms.

Thursday 15 October

Infoblox-published example of a fraudulent Microsoft-themed support warning over a browser, with a fake support number. This is a scam example, not a real Microsoft alert.

Threat Intel15 Oct 2026

Infoblox links 20,000 Cloudflare Pages domains to Help TDS; a browser scare becomes a remote-access lure

Help TDS and Hotejka: what Infoblox observed, what 20,000 domains cannot count, and practical controls against fake support and remote-access scams.

AI-generated editorial illustration of a green NGINX gateway in a server room with a metal protective panel being fitted.

Threat Intel15 Oct 2026

NGINX fixes five flaws in 1.30.6 and 1.31.7; configuration determines exposure

NGINX 1.30.6 and 1.31.7 patch five issues. A CVE-by-CVE table, version ranges and practical checks for HTTP/3, TLS tickets, rewrites and AIO.

AI-generated editorial illustration of violet workflow modules and a central gear module in a transparent enclosure, labelled Langflow MCP security.

AI Security15 Oct 2026

Langflow: one sensor reports attacks, while two MCP advisories name different fixes

Langflow MCP security: distinguish two CVEs, one-sensor attempt counts, development auto-login and the separate 1.9.0 and 1.10.3 fixes.

AI-generated editorial illustration of layered black-and-white web panels with blue light, labelled Next.js security update.

Market and Supply Chain15 Oct 2026

Next.js fixes two critical RCE flaws; the sharp workaround covers only one

Next.js patch briefing: three exposure checks, fixes in 16.4.1 and 15.5.28, the sharp 0.35.5 workaround and a practical deployment checklist.

NVIDIA promotional illustration showing a globe behind icons for documents, code, data charts, video and an AI model.

Market and Supply Chain15 Oct 2026

NVIDIA launches Nemotron 3.5 Super VL and 24GB Bolt. What can you run locally?

Full Nemotron 3.5 analysis: interactive comparisons, independent scores, local speed, quantisation regressions, memory, training, software and costs.

A dark desk with a closed plain silver laptop at the back right, a ring of brass keys with blank round bows in front of it, and a fan of blank white hotel-style key cards, one card stood up on the key ring. The left half is empty dark blue, with the headline and a stat drawn over it: 9 PRODUCTS.

Threat Intel15 Oct 2026

Symantec names 9 AI products in Aoki infostealer's targets; victims, sample dates and delivery are not stated

What Symantec's report establishes about Aoki and AI assistant credentials, what it leaves out, the dated record, vendor statements on storage, lifetime and revocation, what UK guidance covers, and ordered checklists. Defender level only.

A matte graphite laptop and a plain black smartphone on a dark desk in a night office, each showing a page of empty grey bars with one bright rectangular advertising slot holding a blank panel and an amber empty button. Behind them a row of identical dark monitors recedes. The left half is empty dark blue, with the headline and a stat drawn over it: at least 45.

Threat Intel15 Oct 2026

AdFection: Citizen Lab says ads helped Candiru target at least 45 Al Jazeera devices, no infection count

What Citizen Lab's AdFection report and Confiant's post establish, what they leave out, why the 45 devices and the 441,954,291 impressions cannot be divided, what the ad platforms said, what UK guidance covers and where it stops, and three ordered checklists. Defender level only.

A dark equipment room with a black server rack on the right and its mesh door swung open. Six identical grey servers carry blank pill-shaped nameplate wells, and a pull-out console shows a dim admin screen made only of empty rows and one indigo button. The left half is empty dark blue, with the headline: a critical Drupal flaw, its team said exploits might come in hours or days, and the figure 28.5%, of reporting sites, affected branch, no fix.

Threat Intel15 Oct 2026

Drupal's critical Field UI flaw has no fix for 28.5% of reporting sites; its team said exploits may take hours or days

What the Drupal Security Team's advisory and release notes state and do not state about CVE-2026-108097, the arithmetic behind 28.5 per cent, the May exploitation precedent, UK controls and where they stop, and a ranked checklist for three kinds of owner. Defender level only.

Page 13

Thursday 15 October

A dark wall with a grey switchboard patch panel on the right. Eighteen black cords, each plugged into its own jack above a blank label slot, gather into one bundle that runs down into a single brass junction box with a blank plate. The left half is empty dark blue, with the headline: the fix was public before Check Point published its findings, and the number 179 days.

AI Security15 Oct 2026

Check Point's LiteLLM flaws were fixed 179 days before its post; 1.83.9 is inside seven later advisories

What Check Point, LiteLLM, CVE.org, PyPI, CISA and independent researchers say about two LiteLLM gateway flaws: the dates, the versions, who needs what access, what exploitation is reported, UK controls and a ranked checklist. Defender level only.

Four plain brass padlocks of different ages stand in a row on a dark bench, from an old tarnished lock to a slim modern one with a faint cyan glow at the shackle. Each has a blank oval plate and a keyhole. The left half is empty dark blue with the headline Post-quantum TLS profiles are in. Still no date. and the figure 2031.

Compliance and Regulation15 Oct 2026

NCSC's new TLS guidance adds post-quantum profiles but prints no year; the blog beside it prints one, 2031

What changed between versions 1.1 and 1.2 of the NCSC's TLS guidance, how many recommendations carry a date or a test, how far the 2028, 2031 and 2035 milestones are, which groups are on by default, what the UK instruments say, and a ranked checklist.

A dark committee room. A thick printed Bill lies open on a polished walnut table, its pages showing rows of blank grey bars where text would be, with a pale cyan paper slip between them. Beside it stands an empty clear name-card holder on a steel foot. A row of empty teal leather chairs recedes into shadow. The left half is empty dark blue, with the headline and a stat drawn over it: 0 of 47.

Compliance and Regulation15 Oct 2026

UK Cyber Bill: AI appears 0 times in the text; 0 of 47 amendments on the 13 October list are the Government's

What the Bill, its amendment list, Hansard and the Government's three 12 October texts establish about AI in the Cyber Security and Resilience Bill, what they leave out, the calendar in days, which department owns it, what binds UK organisations now, and a ranked checklist.

A dark records archive. One long bank of pale grey steel shelving runs away on the right, filled with identical grey ring binders whose spines carry empty label slots, with a blank grey microfilm viewer in the foreground. At the far end of the aisle one desktop terminal glows with an empty pale screen. The left half is empty dark blue, with the headline and a stat drawn over it: legal aid breach data now goes back to 1978, 2010 to 1978.

Breaches and Incidents15 Oct 2026

Legal Aid Agency's stated data start moved from 2010 to 1978: about 250,000 pre-2007 records, no count of people

What the Legal Aid Agency's 14 October 2026 update states about records back to 1978, what it leaves out, the arithmetic behind the moving start date, why old records were online, what UK law and policy say, and a ranked checklist. Defender level only.

A pale grey-white polling booth with two tall side screens stands in a dark room on the right of the frame. On its plain shelf a tablet shows three empty rounded chat shapes, and a blank paper slip lies beside a pencil on a string. The left half is empty dark blue, with the headline and a stat drawn over it: 0.002%.

AI Security15 Oct 2026

Anthropic's 0.002% election-policy violation rate is about 5 in 250,000 conversations, with no count of actions

What Anthropic's 14 October 2026 post establishes about election use of Claude and what it leaves out: the arithmetic behind 0.002%, the 99% beside 85% on the same cards, where UK rules stop for chatbots, and checklists for election teams, communications leads and companies.

Eight identical blank slate-blue bound court files stand in a row on a pale oak records-office counter, with a tablet computer leaning against them showing blank grey chat bubbles. The left of the picture is dark navy with the headline: Eight states. Eight courts. Allegations, not findings. 27 counts.

Compliance and Regulation15 Oct 2026

Eight states filed eight separate suits against OpenAI: of 27 counts in six read, 6 concern AI agents

What the eight state filings plead about children, what they do not establish, where OpenAI's own pages agree and differ, what UK rules cover a chatbot children use, and a checklist for a school, a parent-facing organisation and a company.

A dark police station front counter in cool blue light. A rugged black tablet on a stand shows an empty grid of six blank dark frames beside a column of blank pills. A stack of clear evidence bags and blank white tags lies in front, a plain black shop basket holding two unmarked boxes stands to the right, and a small blue lantern glows behind. The left half is empty dark blue, with the headline and a stat drawn over it: 179 people.

Compliance and Regulation15 Oct 2026

ICO: about 500 Met accounts on Auror, 179 people uploaded, no DPIA, and a control gap it dates to May 2018

What the ICO's reprimand and enforcement notice to the Met establish about the Auror platform, what they leave out, the dates and deadlines worked out, which UK regime governs police and retailer flows, and ordered checklists for a force DPO, a retailer and a vendor.

A dark equipment room. In a black rack, a flat unmarked network appliance with a row of empty sockets has one grey cable plugged into its left socket, and a small blank paper tag tied to the cable. The left half is empty dark blue, with the headline and a stat drawn over it: 561 to 590 days.

Threat Intel15 Oct 2026

Unit 42 dates its FortiGate implant case to September 2024; the flaw behind the implant was published in April 2026

What Unit 42's PEERSTITCH report states and leaves out, the fix dates for four Fortinet flaws, why patching the FortiManager does not return stolen keys, what the NCSC, Cyber Essentials and the ICO say, and a ranked checklist. Defender level only.

A dark shop counter with a checkout touchscreen on the right showing a blank page of empty rounded shapes: an empty amber button inside an outlined banner, two empty grey bars and an empty cyan button below. A pale robotic hand in a grey glove reaches in from the upper right with one finger over the amber button. The left half is empty dark blue, with the headline and a stat drawn over it: 91%.

AI Security15 Oct 2026

HiddenLayer's Jev checkout test prints one query, 91% on the ad button, and states no trial count

What HiddenLayer's two pages print for Jev, what they leave out, the arithmetic on the one count they give, an independent preprint on the same version, TypeSafe's claims against its own documentation, what UK guidance says, and a ranked checklist. Defender level only.

A dark desk at night. An open graphite laptop shows a plain split window: a narrow left pane with five blank grey bars and a wide pale right pane with one blank bar across the top. In front of it lie a ring of old brass keys, one lifted from the others, and a blank white key-card. The left of the frame is empty dark blue, with the headline and a stat drawn over it: 44 days.

AI Security15 Oct 2026

Noma's SneakPeek report on Claude Code Desktop: 44 days to a final fix, and no Anthropic advisory found

Noma's SneakPeek dates computed from its blog and press release, which disagree on the first fix; what Anthropic's changelog and advisories say, which versions are fixed, whether auto-update applies, UK controls and an ordered checklist.

A dark server room, the left half empty dark blue with the headline and a stat drawn over it: 3 DAYS. On the right a flat grey rack-mount firewall appliance in a black rack, its faceplate unmarked, with a small separate two-jack panel at one end lit by a single cyan light. A plain blank off-white access card lies on the shelf below it.

Threat Intel15 Oct 2026

PAN-OS CVE-2026-0322: CISA gave 3 days, and Palo Alto gives no count for 'very limited' exploitation

What Palo Alto's advisory, CISA's entry and the NCSC's pages establish about CVE-2026-0322: a 3-day window against Cyber Essentials' 14, which PAN-OS builds are fixed, ten open questions, UK controls and an ordered checklist. Defender level only.

Wednesday 14 October

A dark spare room. On a plain steel wall shelf stand eight identical closed silver laptops, each with a tiny cyan status light on the shelf's front edge, above a bare desk with a black power strip and an empty black office chair. The left half is empty dark blue, with the headline and a stat drawn over it: 40+ Texas residences searched, 14 charged in Ohio, overlap not stated, and $3M.

Threat Intel14 Oct 2026

Over 40 Texas residences searched, 14 charged in Ohio, and no stated overlap between the two DOJ actions

What the DOJ releases and the 58-page indictment state about the 40-plus Texas residences, the 14 charged, the $3 million and the 70-plus companies, where five news stories count differently, what UK law asks of an employer hiring remote developers, and an ordered checklist.

Page 14

Wednesday 14 October

A dark desk at night with an open graphite laptop on the right. Its screen shows a generic empty browser window made of blank rounded shapes. In front of it a heavy brass chain joins three padlocks, each with its shackle open. The left half is empty dark navy with the headline and a stat drawn over it: 6 days.

AI Security14 Oct 2026

XBOW says a six-day Chrome chain cost about $40,000 and won $250,000, but not which access tier of GPT-5.6 Sol

What XBOW's pages, Google's release notes, rules page and public tracker, and OpenAI's model pages establish about a six-day Chrome chain, what they leave out, the arithmetic, UK patch clocks and the Computer Misuse Act as read, and a ranked checklist.

A brass balance scale on a dark slate table in blue light. In the left pan, a glass dish holds a neat stack of plain, unmarked square silicon processor packages. In the right pan sits a smaller stack of blank pale grey-blue research folders. The beam is level. The left half is empty dark blue, with the headline and a stat drawn over it: $50M a year.

AI Security14 Oct 2026

Nvidia's $250m UK AI safety pledge is $50m a year of compute, with commercial terms still to be agreed

What Nvidia's release and the Guardian's report establish about the $250 million pledge, the arithmetic against AISI's budget and Nvidia's own results, what is not stated, what UK guidance says about accepting vendor money, and an ordered checklist.

A dark server rack in cold blue light. A glass-fronted rack stands open on the right with plain grey servers, and one server tray is slid forward. In it sits a smaller matte black box with a hairline crack across its lid that runs out over the grey floor of the tray, with a thin cyan light along the line. The left half is empty dark blue, with the headline and a stat drawn over it: 2 OF 5.

Threat Intel14 Oct 2026

Vghost: kernel fix dated 3 August, demos 12 October, and 2 of 5 tested distributions still without a fix

What the kernel commit, the CVE record and the vendor trackers establish about Vghost, what found by AI does and does not say, how seven raters score it from 6.4 to 8.8, which of 26 releases have a fix, the UK clocks and a ranked checklist. Defender level only.

A dark equipment cabinet in cool light. A large brass screw-threaded coupling with a visible thread and a backed-off nut hangs in a dense sweep of cables in cyan, blue, white, grey, red and amber that all run into it. Blank recessed plates sit on unmarked rack units behind. The left half is empty dark blue, with the headline and a stat drawn over it: 616 days.

Threat Intel14 Oct 2026

curl's first High flaw in 1,099 days was in 13 releases; curl lists eight conditions for code execution

The arithmetic behind curl's High flaw, what its advisory states and leaves out, where libcurl hides, what the distributions had fixed on 14 October, the UK patch clocks as read, and a ranked checklist. Defender level only.

A plain black rack-mounted network appliance with two blank pill-shaped recesses on its bezel takes in a line of five blank cream envelopes on a steel roller conveyor. The envelope nearest the viewer carries one blank red wax seal. The left half is empty dark blue, with the headline and a stat drawn over it: 30 days.

Threat Intel14 Oct 2026

Cisco's second exploited email gateway flaw in 30 days: its two fixed builds were named on 14 September

What Cisco's 14 October advisory for CVE-2026-76519 states and leaves out, the two conditions and the scanner update that fixes it, the 16.0 gap, what Shadowserver's count can and cannot say, what NCSC, Cyber Essentials and the ICO say as read, and an ordered checklist. Defender level only.

A dark strongroom in cool steel light. A closed round vault door with a five-spoke wheel stands at the back right. In front of it a stack of six slate-blue ledger books is bound in a steel chain and held by one padlock, with three blank grey tags hanging from it. The left half is empty dark blue, with the headline and a stat drawn over it: 4 names, 1 entry.

Compliance and Regulation14 Oct 2026

UK lists Cryptomus and Heleket as one entity on a Russia ground, and the notice never mentions ransomware

What the UK notice states and does not, the arithmetic behind the Canadian fine and the 900 illicit counterparties a month, why a rebrand is not a control, what OFSI, the FCA, the NCSC and the ICO say as read, where the ransomware payment proposals stand, and an ordered checklist.

A dark print shop. On the right, four taut cords hold rows of identical pale paper sheets, each printed with the same blank page layout of empty rounded bars and boxes and no writing. One sheet in the front row has been ripped away, leaving a ragged strip in two wooden pegs and a crumpled scrap on the floor. The left half is empty dark blue, with the headline and a stat drawn over it: 34 names.

Threat Intel14 Oct 2026

Microsoft's temporary order moves 34 names under five domains; its billion messages are not a victim count

What Microsoft's announcement, its sworn declarations and the court order actually count: 34 names moved, a billion messages with no stated method, 1.1 million dollars traced against tens of millions claimed, and what UK organisations should do.

A dark small-shop back room. A row of plain white and grey boxes with blank label wells sits on a shelf above a counter holding a switched-off terminal screen on a stand and a pale grey card reader, with a dark server tower at the far right. The left of the frame is empty dark blue, with the headline and a stat drawn over it: 177 listed.

Threat Intel14 Oct 2026

Adobe's October bulletins list 177 flaws; every one rated critical sits in AEM, ColdFusion or Commerce

What Adobe's 11 bulletin pages establish and do not, why 176 is 177 entries and 175 ids, how priority 2 and 3 compare with the Cyber Essentials and NCSC clocks, the Commerce hotfix beside a no exploits line, and a ranked checklist. Defender level only.

A dark navy desk seen from high above. A very tall stack of blank white paper stands on the right, a small blank cream card lies in front of it, and a straight row of identical blank cream cards runs across the foreground with a small black-stand magnifying loupe over one of them. The left third is empty dark space carrying the headline and a stat drawn over it: 45 of 203.

Compliance and Regulation14 Oct 2026

Home Office asylum summaries: 45 of 203 failed first review, and omissions are not a stated failure test

What the Home Office's FOI counts, DPIA, ministerial letters and ATRS hub show about two AI tools in asylum casework: the arithmetic behind 45 of 203, what a checked sample cannot say about the rest, UK controls as read, and two ordered checklists.

A dark room. A small vintage glass-domed ticker machine stands on a wooden table beside a smartphone with its screen switched off. A pale paper ribbon rises from the machine and splits into many thin strands that reach a tall wall of several hundred identical small pigeonholes, a few holding curls of blank paper. The left half is empty dark blue, with the headline and a stat drawn over it: 627 days.

Compliance and Regulation14 Oct 2026

Norway fines Xandr NOK 92 million over Grindr data: assumed consent rejected, user count not established

What the Xandr decision establishes and redacts, the arithmetic behind the fine, how it differs from the Grindr case, what the ICO, UK GDPR Article 26, PECR and the 2025 Act say, and an ordered checklist for UK app publishers and ad buyers.

A dark frame with a traditional brass balance scale on a dark wooden counter, the whole scale on the right half. On the left pan hangs a small glowing pale blue plaque shaped like a blank browser window, with three empty dots, an empty address pill and an empty panel. On the right pan sits a short stack of plain blank coins. The left half carries the headline and the stat $2,000.

Market and Supply Chain14 Oct 2026

Chrome's bounty base is up 4x to $2,000, and Google's blog and rules page disagree on renderer rewards

Google's three Chrome rate cards side by side, cell by cell, the ratios between them, where the blog and rules page disagree, a Stated and Not stated table, what UK guidance says, and ordered checklists for Chrome patching and for running a bounty.

A dark desk after hours. On the right, three tall stacks of grey bound ledgers with blank label plates stand beside a closed silver laptop, and a cream folder with one red paper clip lies on the laptop. The left is empty dark navy with the headline and stat drawn over it: seven totals for one release, one exploited CVE, 7 TOTALS.

Threat Intel14 Oct 2026

Microsoft's October Patch Tuesday has seven totals, 1,407 to 1,417, and one exploited CVE, not three zero-days

Which rule produces each outlet's total and Critical count, what zero-day did and did not mean, what Microsoft states about the exploited Windows Shell bug, why its risk cohorts omit it, and the UK clocks and an ordered checklist, and September's release set beside it.

Show 12 more