The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 169 to 252 of 658 briefings

Wednesday 14 October

A dark glass-walled meeting room at night. A wall-mounted television is swung out on a black arm so that its plain back panel and an empty recessed socket bay are visible, and a handheld detector wand lies on the table at the lower right. The left half is empty dark blue with the headline drawn over it: An alleged recorder in an OpenAI meeting room, and the figure 9 days.

Breaches and Incidents14 Oct 2026

Alleged OpenAI room recorder: 9 days from discovery to arrest, and no motive, recipient or captured audio stated

What the complaint, the Justice Department and OpenAI each say about the alleged recorder in an OpenAI meeting room, where the press accounts differ, what the record does not establish, what UK guidance covers, and an ordered checklist for AI and R&D labs.

A dark meeting room in blue black light. A long bare dark table runs towards the upper right with one empty office chair at each end, a closed grey laptop in the middle and a plain cream envelope in front, with no writing anywhere and no people. The left half is empty dark blue, with the headline and a stat drawn over it: five docket lines, none describing an act.

Breaches and Incidents14 Oct 2026

Ransomware-response executive reportedly arrested in ShinyHunters case: five docket lines, none describing an act

What the court record, the FBI Director's post and the RCMP statement establish about a reported arrest, the 23 days since the Dutch arrest, what is not stated, what the NCSC, ICO, OFSI and Home Office pages say about choosing a response supplier, and an ordered checklist.

A dark desk in cold blue light. An unmarked pale grey desktop document scanner holds a stack of blank white sheets in its input tray and feeds one blank sheet out of the front. Behind it a flat monitor shows a grid of twelve blank page thumbnails, one outlined in cyan. The left half is empty dark blue, with the headline and a stat drawn over it: 0 of 10,240.

Threat Intel14 Oct 2026

Ghostscript CVE-2026-39919: two exploits failed 10,240 times on other builds and worked on the matching one

What Wordfence's post establishes about a Ghostscript PDF flaw, where BleepingComputer's wording departs from it, what 0 of 10,240 does and does not say, which distributions have a fix, the UK patching clocks, and a ranked checklist. Defender level only.

A shut service counter in a dim housing office. A silver roller shutter is pulled fully down behind a pale grey counter. On the counter lie a stack of buff cardboard case files with blank label panels and a cream rotary desk telephone. The left half is empty dark blue, with the headline and a stat drawn over it: 8,783.

Breaches and Incidents14 Oct 2026

Housing Ombudsman case-system incident: 8,783 determinations in 2025-26, and no count, supplier or date stated

What the Ombudsman's statement and its own published figures establish about a third-party incident in its case management system, what they leave out, the 72 hour clock, UK GDPR, NCSC and sponsor guidance, and ordered checklists for residents, landlords and small public bodies.

A dark desk lit by cool light. An open silver laptop on the right shows an abstract folder tree of blank rounded bars beside a panel of plain horizontal bars. In front of it lie a stack of plain white identity cards with a blank photo square and blank bars, and a loose ring of brass keys with a black fob. The left is empty dark blue, with the headline and a figure drawn over it: about 1,500.

Breaches and Incidents14 Oct 2026

Meta says 1% of the data taken from GitHub was personal, notifies about 1,500 people, and names no data types

What SecurityWeek's report of Meta's statements establishes, why the 1% cannot be turned into a count of people, the 14 to 42 day gap, what GitHub's controls document, the UK GDPR, NCSC and Cyber Essentials reading, and an ordered checklist. Defender level only.

Tuesday 13 October

A dark workbench in cool blue light. A grey steel shelf holds fifteen identical plain black set-top boxes in three rows, tangled with black cables that gather into a power strip. A blank, switched-off monitor stands in front on the right. The left half is empty dark blue, with the headline and a stat drawn over it: 0.39 tokens per second.

AI Security13 Oct 2026

Anthropic's self-replication test: 0.39 tokens per second on real TV boxes, 4 of 5 runs on emulated ones

What Anthropic's page shows and does not show on small-model self-replication: the speed on real TV boxes, 4 of 5 runs on emulated devices, SecurityWeek checked against it, The Register's critique beside Anthropic's case, UK controls and a ranked checklist. Defender level only.

A dark equipment rack holding one plain grey rack-mounted network appliance, with a row of empty network jacks and a blank rounded plate on its faceplate, black blanking panels above and below, and a pale blue network cable hanging in a coil from a hook on the rack post. The left half is empty dark blue, with the headline and a stat drawn over it: Fully patched, still exploited, 2 of 3.

Threat Intel13 Oct 2026

A fully patched Ivanti VPN gave an attacker root through a three-flaw chain; two flaws are fixed, one is not

What Ivanti, Volexity, NVD and CISA each state about the Connect Secure chain, the fixed builds and their dates, what the record does not establish, the UK clocks and duties, and an ordered checklist. Defender level only.

A dark quay at night. A stack of plain blue-grey steel shipping containers fills the right of the frame, all doors unmarked. A blank white luggage tag with two empty rounded slots hangs on a loop of wire from the nearest door, with a second blank tag behind it. The left of the frame is empty dark blue, with the headline and a stat drawn over it: 765 days.

Market and Supply Chain13 Oct 2026

Docker Hub's flaw let a token act as another user for 765 days; Docker says the fix took under four hours

What Docker's bulletin, the CVE record and the reporters' page establish about CVE-2026-105445, what a check of about 304,000 pushes can and cannot show, the dates worked through, UK controls and a ranked checklist. Defender level only.

A dark corporate server room in cool blue light. On the right stands a tall black rack of enterprise servers whose faceplates carry blank pill-shaped recesses, with grey cables down its side. In front of it a stainless steel service cart carries a flat monitor showing an empty form made only of blank rounded fields and an empty button. The left half is dark and carries the headline, SAP's 10.0 flaw sits in a library you must upgrade yourself, and the stat 53 days.

Threat Intel13 Oct 2026

SAP's October 10.0 is a library customers must upgrade, with a fixed build dated 53 days before the advisory

What SAP's 13 October overview and GitHub advisory state about the 10.0 OAuth2 SSRF in the Cloud SDK for Python, the 22 rows counted, who acts on each Critical row, the UK clocks to 27 October and an ordered checklist. Defender level only.

A dark data-centre aisle in cool blue light. A black rack on the right is filled with network switches whose faceplates carry empty port openings and blank pill-shaped recesses, with bundles of grey and teal patch cables falling in loops. One small amber port light glows on one switch. The left half is dark and empty and carries the headline, Cisco's October bundle, 16 of 35 CVEs score 9.0 or more, and the stat 20 of 35.

Threat Intel13 Oct 2026

Cisco's October bundle: 16 of 35 CVEs score 9.0 or more, 7 in NX-OS, and 20 are umbrella IDs with no bug count

What Cisco's 14 advisories state and do not: the count by product and score, what a 'hardening release' is, five critical NX-OS flaws gated by features, fixed releases per train, the UK 14-day clock to 21 October, and an ordered checklist. Defender level only.

A dark data centre aisle. On the right, a black server rack holds four matching pale grey rack servers above a row of blank black drives, with a flat black status panel at the top, switched off and blank, and one small amber light at its corner. More racks recede into the dark. The left half is empty dark blue, with the headline and a stat drawn over it: 32 DAYS.

Threat Intel13 Oct 2026

Progress published 31 MarkLogic flaws 32 days after the fixes shipped, and the August fixes miss them

What Progress's bulletin, release notes and CVE records establish about 31 MarkLogic flaws, what they leave out, the arithmetic behind 32 days, the Cyber Essentials clock, UK guidance and an ordered checklist. Defender level only.

A fashion boutique at night: a pale stone till counter holding a blank, switched-off card reader on a stand, a plain tissue parcel and an unprinted paper bag, with a long rail of plain dresses and jackets behind. The left of the picture is empty dark navy. Nothing in the picture carries any lettering.

Breaches and Incidents13 Oct 2026

TFG London's 163-word notice names three brands and no cause; its payment-data belief is not in it

What one company has stated about its Sunday incident, by whom and when, set against what customers must infer. Also H&M's denial of a ShinyHunters claim, the UK GDPR 72 hour limit counted from Sunday (derived), and two ordered checklists.

Page 16

Tuesday 13 October

A developer's desk in dim blue light. A slim grey monitor shows a dark terminal window made only of blank grey pill shapes and one small cyan cursor block. In front of it sits a sealed brown cardboard parcel whose white shipping label is blank, with a second blank label showing under one lifted corner. The left half is empty dark blue, with the headline and a stat drawn over it: 1,500+.

Market and Supply Chain13 Oct 2026

npm Trusted Publishing checked a name, not an ID, until first publish: Bloom counts 1,500+ packages exposed

What Bloom's write-up, GitHub's changelog and npm's documentation establish about the Trusted Publishing flaw, what they leave open, the dates and downloads worked through, what other registries' pages say, what the UK sources cover, and a ranked checklist. Defender level only.

Intel D270 PCIe accelerator shown at an angle against a dark blue background.

Market and Supply Chain13 Oct 2026

Intel D270 brings up to 480GB to a 350W PCIe design. Can it change local AI economics?

Intel D270 puts memory capacity at the centre of AI inference. We examine the 160GB/480GB distinction, 350W cooling, UK NVIDIA and Mac prices, and the small-lab opportunity.

Monday 12 October

A dark server room corner in cool blue light. A pale grey rack-mounted backup appliance with rows of blank black drive bays and a dark blank status display stands in an open black rack beside a tall graphite tape library whose smoked window shows shelves of plain black cartridges with empty pale label windows. The left half is empty dark blue, with the headline and a stat drawn over it: 9.4.

Threat Intel12 Oct 2026

Veeam CVE-2025-64393: a Backup Viewer can run code on the backup server, in version 12 only

What Veeam's advisories establish about the Backup Viewer flaw and the Cloud Connect file read, what they leave out, the fixed build for each version line, the evidence on exploitation, what UK guidance and Cyber Essentials say, and a ranked checklist. Defender level only.

A dark supermarket distribution-centre loading bay at night. Four empty steel roll cages stand idle in a row in front of a closed grey dock door, with a hand pallet truck parked beside them. A rugged handheld scanner rests on the near cage with its screen dark and blank and one small amber lamp lit. The left half is empty dark blue, with the headline and a stat drawn over it: 6 sentences.

Breaches and Incidents12 Oct 2026

Ahold Delhaize says stores are open; Albert Heijn's chief says work has stopped at some distribution centres

What the group, Albert Heijn and Delhaize each state, the sentences reused from 2024, the day's disclosures to scale, the 2024 notices, what the NPSA, NCSC and ICO say, and ordered questions and actions for UK retailers and suppliers to European grocers. Defender level only.

A dark equipment room. A grey rack-mount server is pulled forward out of a black cabinet on the right, its status lights dark. A blank paper calendar page with one amber square is clipped to the cabinet rail beside it, and a blank card tag with an amber band hangs from the server handle. The left half is empty dark navy carrying the headline Struts mapper flaw: two of four lines are end of life, and the words No patch.

Threat Intel12 Oct 2026

Struts CVE-2026-104711: two of four affected lines are end of life; the remedy is a mapper change, not a patch

What Apache's bulletins, the CVE records and CISA's catalogue establish about CVE-2026-104711 and its three companions, the version-line matrix, the end-of-life dates, what they leave out, UK controls and a ranked checklist. Defender level only.

A dark help-desk desk at night. A white desk telephone with blank round keys and its handset in the cradle sits beside an open laptop whose screen shows an empty remote-session window with blank pills, and a black headset with a boom microphone lies in front. The left half is empty dark blue, with the headline and a stat drawn over it: 42 of 50 recent victims were law firms.

Threat Intel12 Oct 2026

Luna Moth leak: no new malware, a phone call and a remote tool, and Check Point treats the files as unverified

What Check Point's analysis of the Luna Moth Files establishes, what it leaves open, the arithmetic behind it, what the NCSC, Cyber Essentials v3.3 and the ICO say, and a ranked checklist for a group that steals data without encrypting it. Defender level only.

A dark government briefing room. A slim graphite lectern with a pale ash-wood top stands right of centre, with a closed pale grey document folder and a darker elastic band lying on it, its label well empty. Behind it hangs a large wall display, switched off and completely blank. The left half is empty dark blue, carrying the headline and a stat drawn over it: 407 of 1,000+.

Compliance and Regulation12 Oct 2026

AI minister: breach 'likely, if not inevitable'. One pilot account shows 407 of 'over 1,000'; nothing new dated

The speech transcript, press release and Bill read for what is committed, dated, funded and binding: what the 1,000 counts, whether the Bill carries AI incident reporting (not today), what AISI is, and a UK checklist.

A dark supermarket aisle at night. A long freezer cabinet with fogged glass doors and almost bare wire shelves stands on the right, with a small grey refrigeration controller on a steel post whose display window is dark and blank, and a pool of water on the floor. The left is empty dark blue, with the headline and a stat drawn over it: 436 days.

Breaches and Incidents12 Oct 2026

French fridge attack: CERT-FR adds Copeland and Dixell to the Danfoss controllers; no source names the flaw used

What CERT-FR, Danfoss, the retailers, the Prime Minister's office and the Paris prosecutor have each said, the counts that do not reconcile, the dates of Danfoss's fixes against the attack, what UK rules and the FSA say, and a ranked checklist. Defender level only.

A dark datacentre aisle with one open rack at the right. Inside it a stack of blank grey accelerator trays, three pulled forward, a vertical copper power bar with black cables, and a steel coolant manifold with pale blue hoses. A row of closed racks recedes behind it. The left half is empty dark blue, with the headline and a stat drawn over it: 1.4X expected.

Market and Supply Chain12 Oct 2026

Microsoft expects Maia 300 to give 40% more tokens per megawatt than GPU systems it does not name, from 2027

The 40 per cent is a forecast against an unnamed baseline, five Microsoft GPU claims use five baselines, the rack arithmetic checks out, and Maia 200 already serves Copilot. What UK users of Copilot, Foundry and Azure OpenAI should put in writing.

A dark server room. A tall black server rack with plain blank drive bays stands on the right beside a wall-mounted board of three rows of five empty rounded tiles joined by thin lines, like a pipeline. One tile in the middle row carries a single small lit amber lamp. The left half is empty dark blue, with the headline and a stat drawn over it: CVSS 10.0.

Threat Intel12 Oct 2026

GitLab says CVE-2026-97229 needs no account, the third regex-titled critical in 19 days

One CVSS metric separates 12 October's critical from the two regex criticals of 23 September: the attacker no longer needs an account. What GitLab states, what it leaves out, the count checked, CISA and the NVD at 14:52 BST, the UK 14 day clocks and an ordered checklist.

A dim conference room. A long dark graphite table recedes from the lower right, with a closed pale grey document folder in the foreground sealed by a pale blue paper band and a blank round disc, its label wells empty. At the far end one empty chair sits pushed back. The left half is empty dark blue, carrying the headline and a stat drawn over it: 36 days.

AI Security12 Oct 2026

Three OpenAI safety researchers dismissed: both sides cite trust, neither publishes the policy, material or date

What OpenAI and the three researchers each state, the dates drawn to scale, what neither states, what METR's own record shows, who holds the key to outside monitors, what UK pages say, and an ordered checklist for a customer and a board.

A dark workbench in cool blue light. A small black handheld hardware wallet lies opened, its plain black back cover set beside it, showing a blank teal-green circuit board with unmarked chips and one small extra board at the top end. A steel-rimmed magnifying glass on a clamp stand hangs over it. The left half is empty dark blue, with the headline and a stat drawn over it: $72M to $93M.

Market and Supply Chain12 Oct 2026

Ledger now says the implant reads the screen and sends the recovery phrase by LTE; no loss figure is confirmed

How Ledger says the implant works, the German retailer that halted sales, whose loss figures are whose, why the 72 hour update was not 72 hours, what the Genuine Check tests, the 90-day window against June funding dates, the UK position, and an ordered checklist for owners.

Page 17

Monday 12 October

A dark server room. A black equipment rack holds six flat grey firewall appliances with blank label plates, and a single small cyan status light is lit on the third. Beside it a plain paper calendar page is taped to the rack, a grid of empty squares with one square outlined in cyan marker. The left half is empty dark blue, with the headline and a stat drawn over it: 149 days.

Threat Intel12 Oct 2026

Palo Alto's CVE-2026-0257 advisory was 149 days old when ReliaQuest warned ransomware groups still use it

A computed gap, 149 days, from Palo Alto's advisory to ReliaQuest's warning; the fixed versions per train; four scores for one flaw; what no source establishes; UK controls; and an ordered checklist. Defender level only.

A dark operations desk at night. A spiral-bound desk calendar with an empty grid and one blank square ringed in cyan stands in front of a black server rack with blank label wells, beside a monitor showing six empty rounded bars and a brass desk lamp. The left of the frame is empty dark blue with the headline drawn over it: Let's Encrypt moves to 64-day certificates, and a stat, 64 days.

Market and Supply Chain12 Oct 2026

Let's Encrypt moves to 64-day certificates on 10 February 2027; its last 90-day one should expire 11 May

What Let's Encrypt's own pages and the CA/Browser Forum's rules say about 64-day certificates, what a fixed renewal rule does at 90, 64 and 45 days, what the record leaves out, what UK guidance asks for, and an ordered checklist.

A dark desk in low blue light with one open laptop on the right. Its screen is tiled with about three dozen small identical blank windows, each with a pale title bar and two grey bars, and the keys are blank. The left half is empty dark blue, with the headline and a stat drawn over it: 51 agent files, WordPress flaws fixed on 17 July, 32 shells.

Threat Intel12 Oct 2026

CyberXero: 51 Claude Code agent files, 32 shells in 61 seconds, and WordPress flaws fixed on 17 July

What SOCRadar's CyberXero report establishes, what it does not, the arithmetic behind 32 shells in 61 seconds and 564,073 of 628,000 records, the public fixes and CISA KEV status for the named CVEs, what the model's maker has said, UK controls, and a ranked checklist. Defender level only.

A dark designer's desk at night. A large monitor shows a half-built web page layout made only of blank rounded shapes, with a dark indigo side panel and a bright canvas. Beside it stands a small industrial warning lamp with a smoked amber dome, switched off. A white mouse and stylus lie on a grey felt mat. The left half is empty dark blue, with the headline and a stat drawn over it: 21:47 UTC.

Threat Intel12 Oct 2026

Bricksforge CVE-2026-85097: exploit attempts began on disclosure day; the changelog has no 3.1.8.10 date

What the primary records establish about CVE-2026-85097: the first attempt, a fix date nobody publishes, three flaws in five weeks on one database's dates, a spray of 56 requests from 44 addresses, UK controls and an ordered checklist. Defender level only.

Sunday 11 October

A dark laboratory bench in dim blue light. An unmarked pale grey and white desktop robotic arm reaches forward with its gripper open, beside a plain grey control cabinet whose door carries two blank recessed plates. A brushed steel stopwatch with a plain dial and one blue hand lies in front. The left half is empty dark blue, with the headline and a stat drawn over it: 8 of 8.

AI Security11 Oct 2026

Booz Allen's OT lab met 8 of 8 objectives with every exploit human-approved, and states no run count or model

What Booz Allen's page and white paper establish about an AI test in its OT lab, what they leave out, the arithmetic behind 8 of 8, how the UK AI Security Institute's industrial range and the NCSC compare, what UK guidance covers, and a ranked checklist. Defender level only.

A dark room with an open paper desk diary on a walnut desk at the right of the picture. Its pages hold seven empty ruled boxes with blank pills at the top, and one amber sticky note lies in a box on the right page. The left is empty dark, with the headline and a stat drawn over it: 0 clicks.

Threat Intel11 Oct 2026

Calendar phishing arrives with zero clicks on Google Workspace's default; Sublime's 33,000% is a projection

What Google's and Microsoft's own pages say about the default, which settings stop a calendar lure and which do not, the number behind "exponential", what no source establishes, UK reach of the NCSC and Cyber Essentials, and a ranked checklist. No lure is printed.

A dusk landscape. A pale grey outdoor steel cabinet stands in the right foreground with its door swung open and a brass padlock hanging open from the hasp, an empty blank plate on the door. The base of a white wind turbine tower rises behind it and rows of solar panels recede to an amber horizon. The left half is empty dark blue, with the headline and a stat drawn over it: 93% solar.

Threat Intel11 Oct 2026

Modat counts 8,547 wind and solar systems reachable online: 93% solar, a floor, and the UK outside its scope

What Modat's pages, Reuters and others establish about 8,547 exposed wind and solar systems, the arithmetic behind the percentages, why the UK is outside the count, what the NIS Regulations and the NCSC say, and a ranked checklist. Nothing identifying a site is printed.

Saturday 10 October

A dark room with two near-identical brass nameplates side by side on a walnut desk at the right of the picture. Each has four screws and an empty recessed panel. The right plate is slightly darker and redder, with a small dimple at each end of its panel. The left is empty dark, with the headline and a stat drawn over it: 29 letters.

Threat Intel10 Oct 2026

Two characters put 20 lookalike domains past Chromium's checks: a 29-letter list and an 8,462-domain list

What the researchers' write-up and Chromium's own source establish about two characters that pass the browser's lookalike checks, what is not stated, why a list fails open for a letter or a brand it does not hold, UK controls and a ranked checklist. No lookalike domain is printed.

A dark desk at night with a black smartphone lying face up at the centre right. Its screen shows an update page made only of empty pills: one short title pill, three wide grey pills and a blank pale cyan button. Beside it stand a small closed steel padlock and, behind it, a blank white card. The left is empty dark, with the headline and a stat drawn over it: 239 days.

Threat Intel10 Oct 2026

P7 DarkSword is a kit for iOS 18.4 to 18.7, and Apple fixed all six of its flaws by 11 February 2026

What iVerify, Google, Lookout, Censys, Report URI and Apple establish about P7 DarkSword: the six flaws and their fixes, which iPhones are exposed, what is not stated, UK controls and a ranked checklist. No indicators are printed.

A dark desk at night. A small brushed-steel drop box stands on a walnut desk at the right of the picture, with one blank cream paper slip sticking up out of the slot in its top and a smooth, empty oval panel on its front. Behind it a black wire tray holds a loose drift of identical blank slips. The left half is empty dark, with the headline and a stat drawn over it: 72 days to find, 9 to tell, 81 days.

AI Security10 Oct 2026

A Claude model's fake police tip took 72 days to find and 9 more to report; Anthropic calls the impact minimal

Dates, counts and labels in Anthropic's 9 October report on unintended model actions: what the police statement adds, what no source states, and what UK organisations that give agents live internet access should do.

A dark room with a silver laptop on a walnut desk at the right of the picture. Its screen shows a download page made only of empty pills, a browser strip, and a pale cyan button above a blank command panel with an empty copy square. Beside it stands a blank white card and a blank amber sticky note lies on the desk. The left is empty dark, with the headline and a stat drawn over it: 4 stops.

Threat Intel10 Oct 2026

A Google ad showed bing.com; four stops later a fake Claude installer's copy button swapped the command

What Push Security and BleepingComputer establish about the Adception campaign: the four stops, the cloaking gates, the swapped clipboard command, what is not stated, UK controls for Macs and a ranked checklist. No attacker addresses are printed.

A dark wooden library card catalogue: rows of identical small drawers with brass pulls and blank label frames, about a dozen pulled slightly open, each with a thin blank white sheet standing up showing empty grey bars. Text on the left reads: One campaign, three counts: 345, 772, and 'tens of thousands'. 81% of the 345 repositories in two sweeps were forks (279, derived).

Market and Supply Chain10 Oct 2026

GhostAction: 345 repositories in two sweeps; GitGuardian's update of 13 October counts more than 30,000

A fake security-audit workflow, counted four ways: 345 repositories in a day (81% forks), 772 over a month, Socket's unnumbered tens of thousands, and now more than 30,000 from GitGuardian. What each counts, what ran, and what a UK reader can conclude.

Page 18

Friday 9 October

A dark room with a dark walnut pigeonhole sorting frame at the right, three rows of four slots with blank colour tabs in indigo, cyan, amber and slate grey, holding cream envelopes at different depths. A steel pocket stopwatch with a plain dial lies open on the bench in front of it, beside two loose blank envelopes. No writing appears anywhere, and the left of the picture is empty dark.

AI Security9 Oct 2026

Microsoft calls Decision-1 '4.5 times faster'; JevBench's raw timing for the runner-up gives 1.4 times

Microsoft's launch chart sets an 85 ms measured API against JevBench's adjusted 380 ms for Quyet-1.0-Large, whose raw timing is 116 ms. The 36-benchmark accuracy ranking contains no general-purpose LLM, and no independent result for Decision-1 exists yet.

A dark room with a slim black monitor on a walnut desk at the right of the picture. Its screen shows one window outlined in pale cyan, made only of empty pills and blank rounded squares, with a small cyan pill at the top right. Beside it stands a compact black tower computer with a mesh front and one amber status light. The left is empty dark, with the headline and a stat drawn over it: 107 days.

Threat Intel9 Oct 2026

AnyDesk Linux: the researchers' root exploit came 107 days after a release logged only as a crash fix

What AnyDesk's changelogs, its post on X, the researchers' post, NVD, CVE.org and CISA's catalogue establish about the AnyDesk Linux flaw: dates, scope, the relay dispute, the UK timescales and a ranked checklist.

A dark pinboard covered in rows of pinned paper index cards, nearly all turned face-down and blank, with a few turned face-up to show blank white faces with empty grey bars. Text on the left reads: 2,627 ransomware claims, 247 confirmed by victims. 9.4% of Q3's claims are confirmed by the victim (247 of 2,627, derived).

Threat Intel9 Oct 2026

Q3's record 2,627 ransomware attacks: 247 confirmed by the victim, 2,380 only claimed

Recounting Comparitech's Q3 2026 ransomware record from its own tables: 247 of 2,627 confirmed, a Q2 that was a dip, 517 of the 597 extra claims from strains with no Q2 claims, and two other trackers that agree on direction and not size.

A dark server room: a black rack holds one graphite backup storage server with a grid of identical drive bays and an amber light, and a graphite monitor on a steel desk shows a console of blank rounded rows. Text on the left reads: Ahsay said 10.3.4 fixed it. A day later: not fully. 3 days 16 hours: NVD record to Huntress's first sighting (derived).

Threat Intel9 Oct 2026

Huntress said AhsayCBS 10.3.4 was affected; Ahsay said it fixed both flaws, then said it did not fully

A computed gap, one build that two vendors described in opposite ways until the vendor changed its answer, and a backup console that MSPs expose to clients. What the record, Huntress and Ahsay state, what is not stated, UK clocks for MSPs and the order of actions.

An old beige computer tower, switched off, stands beside a graphite laptop with a blank pale-blue screen, under a wall calendar with an empty grid and two cells ringed in red. Text on the left reads: Windows Update certificates expire 17 May, 19 June 2027. 125 days: Server 2016 support ends this long before 17 May.

Market and Supply Chain9 Oct 2026

Windows Update certificates expire 17 May and 19 June 2027; Server 2016 support ends 125 days before

Microsoft's 8 October notice sets two Windows Update certificate dates. What its six-row table states and leaves out, which listed versions leave support first, the WSUS exception, the UK clocks and the order to work in.

A regulator's desk at dusk with a row of identical pale grey-blue folders, some with a blank sheet sliding out, a printed checklist with empty boxes, a pen and an open laptop showing a blank response form. No people. Overlaid text reads ICO details changes at 8 of 10 AI developers, and dates none of them, plus 8 of 10, developers with a line of their own: 3 done, 3 promised, 2 both.

Compliance and Regulation9 Oct 2026

ICO details changes at 8 of 10 AI developers: 3 done, 3 promised, 2 both, and none dated

What the ICO's 8 October report prints for each of ten AI developers, what it leaves out, what the call for evidence on agentic AI asks, and the register a UK organisation using these tools should keep before 20 November.

A dark desk at night. A black wire in-tray is buried under a slumping heap of identical blank report sheets, each with an empty title bar and rows of grey bars where text would be, and some sheets have slid across the desk. A small closed steel box with one narrow empty slot stands beside it, and behind them a laptop shows a plain list of blank rows with one cyan row. Nothing is written anywhere and nobody is in the room.

AI Security9 Oct 2026

OSS Scanner skips human review: Anthropic expects over 90% true, but prints no rate for the 4,824 already sent

Anthropic expects over 90 per cent of OSS Scanner's unreviewed reports to be true, but gives no rate for the 4,824 already sent direct. Its early sample reads 88 or 99 per cent by definition. Also the infrastructure program's eleven partners, and UK clocks.

A dark equipment room: a black rack holds three identical graphite network appliances, each with one amber light, and below them a graphite laptop on a steel cart shows a blank sign-in screen of rounded empty fields. Text on the left reads: The previous NetScaler fix build is affected, for SAML IdPs. 3 in 11 days: NetScaler bulletins on 27 Sep, 3 Oct and 8 Oct.

Threat Intel9 Oct 2026

Citrix's third NetScaler bulletin in 11 days lists the previous fix build as affected, for SAML identity providers

Three NetScaler bulletins in 11 days, ten CVEs, and a new SAML flaw whose affected range ends at the previous fix build. What Citrix states and leaves out, the UK patching clocks and what to check.

A dark exhibition-hall bench holding a smartphone on a stand showing blank rounded rows, a white smart-home hub, a grey printer and a small server rack, each with a blank white card in front. Text on the left reads: Pwn2Own: AI infrastructure gave 23 of 98 zero-days, 15% of cash. 23 OF 98 zero-days, for 14.9% of the cash.

AI Security9 Oct 2026

Pwn2Own Ireland: AI infrastructure gave 23 of the 98 zero-days but 15% of the $1,262,000

Recounting Pwn2Own Ireland 2026 from ZDI's own tables: 61 attempts, 51 successes, 10 failures, 2 inferred withdrawals and 29 collision-labelled successes. No vendor page read on 9 October ties a fix to a contest bug.

A compliance desk at dusk with a thin and a thick printed policy document, a printed checklist with empty boxes, a blank approval card, an open laptop showing a blank document viewer and a small red emergency-stop button. No people. Overlaid text reads Usage Policy: 79% longer, effective 12 November, plus 79%, our word count 4,424 against 2,473.

Compliance and Regulation9 Oct 2026

Anthropic's new Usage Policy is 79% longer and takes effect 35 days after it was posted

Anthropic's Usage Policy takes effect 12 November: 4,424 words against 2,473. What changed in substance, what the texts do not establish, and what a UK organisation building on Claude should record before the date.

An empty newsroom desk at dusk with an open laptop showing an article page made of blank shapes, a blank press-pass lanyard, a printed page proof with one highlighted byline slot and a row of wooden blocks stepping upward, two of them amber. No people. Overlaid text reads: Two of 30 rated Category 5 and 4, no outlet named in the text, 5 of 6.

Threat Intel9 Oct 2026

Two of OpenAI's 30 exposed influence operations rate Category 5 and 4; its text names no outlet that ran them

OpenAI says it banned two influence operations that used ChatGPT and rates their reach Category 5 and 4 of 6. What the page states and omits, how Anthropic's reports compare, and what UK publishers and security teams can check.

A back-office desk at dusk with a handheld card terminal beside an open laptop whose screen shows a chat window and a small approval card with two blank buttons, a blank card, a plain security key and an emergency stop button. No people. Overlaid text reads One 'must', 130 'should' in PCI SSC's AI guidance, 130 : 1.

Compliance and Regulation9 Oct 2026

PCI SSC's AI guidance has one 'must' and 130 'should', and asks for explicit human approval in one example

PCI SSC's advisory AI guidance, dated September 2026, has one 'must' against 130 'should'. What it ties to PCI DSS, what is new, what it leaves undefined, and what UK merchants and suppliers can check.

Page 19

Friday 9 October

A dark room with a graphite laptop on a walnut desk at the right of the picture. Its screen shows a chat of empty message pills with one cyan pill sent. Beside it stands a charcoal cabinet holding a stack of identical dark modules, one with a cyan status light, with an amber strip glowing between the modules as a shared rail. The left of the picture is empty dark, with the headline and a stat drawn over it: 260 days.

AI Security9 Oct 2026

AgentCorruption: Zenity saw the AgentCore default role narrowed 260 days after its report; no AWS notice found

What Zenity's five posts, AWS's AgentCore pages and Dark Reading's report establish about AgentCorruption: dates, scope, what AWS states, what UK customers must still check on agent roles, and a ranked checklist.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows one empty bar above a grid of eight empty tiles, two of them filled amber. In front of it lies a clear evidence bag holding a small router and a round camera, with a blank label strip. Beside it is a stapled sheaf of pages with grey bars for text and an amber tab. The left of the picture is empty dark, with the headline and a stat drawn over it: 2 of 8+.

Threat Intel9 Oct 2026

Integrity Tech seizure: of at least eight scanned targets, the affidavit alleges breaches at two universities

What the 8 October seizure papers, the 58-page joint advisory and the NCSC's own item establish: two alleged breaches, six scan targets not said to be breached, 20 universities or six, and a UK checklist.

Thursday 8 October

A school desk at dusk with an open laptop showing a chat window with a rounded reminder card, an open study planner with one highlighted row, a stack of blank flashcards and a sand timer. No people. Overlaid text reads 2.7 million more messages, no group size or method stated.

Compliance and Regulation8 Oct 2026

OpenAI's teen figures: 2.7 million more messages, with no group size, period or method stated

OpenAI's 7 October teen post gives no group size, period or method for its figures, and its social media comparison sets a survey against logs. What UK schools, parents and providers can check under Ofcom, ICO and DfE rules.

A dim security operations desk with a graphite laptop open in front of a black server rack holding three plain servers. The laptop screen shows a log search view of blank rounded rows, three of five outlined in amber and the first opened out. Text on the left reads: Only one of Splunk's three Critical CVEs says how it works. 1 of 3, Critical CVEs with a stated precondition and mitigation.

Threat Intel8 Oct 2026

Splunk's three Critical Enterprise CVEs: one is explained, two are only a weakness class and a score

Of 83 CVEs in Splunk's five 7 October advisories, three Splunk Enterprise flaws score 9.0 or more. One is explained. Two are a weakness class and a score, and the October affected ranges end at August's fix builds.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows a map of connected empty circles, three filled cyan and one amber, with a column of empty pills at the left and three empty cards at the right. A tablet on a stand beside it shows a pale card with one empty field and a cyan button, and a phone in front shows three empty rows. The left of the picture is empty dark, with the headline and a stat drawn over it: 1 footnote.

Threat Intel8 Oct 2026

CrowdStrike's ARTEX report: AI use rests on the actor's own files, the bank breaches on one press footnote

What CrowdStrike's 7 October post establishes and what it leaves out: AI tooling from the actor's files, no named bank, no victim count, no Anthropic model named, a stack 3 to 63 days old, and a UK checklist.

A graphite budget smartphone stands against an open plain cardboard box on a dark walnut desk, its screen film peeling at one corner and its screen showing a list of blank rows with one outlined in amber, a white charging cable beside it. Text on the left reads: UK is 3.49% of Bitdefender's infected-phone chart. 3.49%. UK share of observed infected devices. No device count given.

Market and Supply Chain8 Oct 2026

Bitdefender: malware ships in cheap Android firmware. The UK is 3.49% of its chart; no device count above 199

Bitdefender's Midnight Mimosa report: malware preinstalled in cheap Android firmware, not removable by the owner. The UK is in a chart at 3.49% with no count behind it. The actor, the point of insertion and any reset test are not given; 13 Play apps were still listed.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows a generic window of empty pills with three horizontal bars: one full length in slate, one short cyan stub and one short amber bar, above a grid of blank grey pills. A blank paper receipt with grey bars curls off the desk edge beside it. No writing appears anywhere, and the left of the picture is empty dark.

AI Security8 Oct 2026

Haiku 5.5 'costs around 75% less', but at Max effort three of Anthropic's four charts show it dearer than 4.5

Footnote 2 explains why 90 per cent off a token is 'around 75 per cent' off the bill. Anthropic's chart data put the 75 per cent at Medium effort and show Max costing 2.3 to 3.6 times Haiku 4.5 per task on three of four benchmarks.

A dim desk at dusk. A graphite laptop at the right shows a chat window drawn in plain shapes: an empty heading capsule, five empty tabs with one cyan, a small bar chart in indigo and cyan, an amber slider handle and two empty buttons. Behind it a larger monitor shows a dark workspace of plain grey bars. No writing appears anywhere, and the left of the picture is empty dark.

AI Security8 Oct 2026

GPT-6 Sol is two versions under one name: October's in ChatGPT chat, September's in Codex, 15 days apart

One name, two versions, 15 days apart: what OpenAI's card, help pages and API docs establish about GPT-6 Sol in ChatGPT chat, what they leave out, and a UK checklist for model change control.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows a pale card of empty grey pills with a cyan button. A phone lies face up in front with a small card of two empty pills, and behind the laptop a paper poster with an amber header bar and grey lines is pinned to a felt board. The left of the picture is empty dark, with the headline and a stat drawn over it: three emails.

Threat Intel8 Oct 2026

Talos's 'AI-assisted' label rests on three emails; the Google relay behind them forwards the codes people type

What Talos's 8 October post on UAT-11985 establishes and what it leaves out: three emails behind the AI-assisted label, a relay that forwards typed codes and taps, no victim count, and what UK organisations on Google can do.

A dark room with a graphite laptop at the back right whose screen shows a list of twelve rows, each with a bright teal disc and three empty grey pills with nothing written in them. On the walnut desk in front lies a very thick ream of paper ruled the same way: a teal disc and blank grey pills on every row and three small amber pills at the top: a long list marked finished, nothing named. Our own words at left read 400+ Java flaws fixed, they say, no CVE, library or date given, 0 identifiers.

Market and Supply Chain8 Oct 2026

IBM and Red Hat say Lightwell fixed 400+ Java flaws, and the release names no CVE, library or date

What the 6 October Lightwell release states and leaves out, what a search of NVD, CVE.org, GitHub and osv.dev found, how backports confuse scanners, and what Cyber Essentials and the NCSC mean for a UK Java estate.

A graphite laptop on a dark walnut desk at night shows a list of blank release rows with the top row outlined in amber, and a ring of plain brass keys lies on the desk in front of it. Text on the left reads: Malicious Tensorlake release was live up to about 102 minutes. 102 MIN. Publish stamp to last change: 1 h 42 m 20 s. Derived; an upper bound.

Market and Supply Chain8 Oct 2026

Tensorlake's malicious npm release was live for up to about 102 minutes, and carried valid provenance

A Shai-Hulud worm release of the tensorlake package sat on npm for no more than about 102 minutes, about 91 of them after Socket flagged it. It carried valid provenance and a trusted publisher. No source reports a victim count, and six native packages at the same version remain.

A dark desk with an open silver laptop and a plain graphite call-centre headset lying in front of it. The laptop screen shows a tall list of eight blank rounded rows, each with a small dot at the left and a small blank pill at the right, with no writing anywhere. Nobody is in the room.

Compliance and Regulation8 Oct 2026

Guardian: AI scores Co-op Legal Services calls on more than 50 aspects; the Co-op calls it a support tool

Monitoring is not unlawful in itself, and a score is not a decision. The Guardian's account leaves open whether callers were told, whether an impact assessment came first, and what managers do with a fail score.

Page 20

Thursday 8 October

A dark room with a graphite laptop at the back right whose screen, washed in coral-red light, shows a locked-out notice made of one empty pill, three grey bars and a grid of twelve blank tiles. On the walnut desk in front lie one very large pale invoice-sized sheet, ruled with empty grey bars and one amber pill, and one tiny curled receipt slip with a single bar: a big bill beside a small payment. Our own words at left read alleged about $150,000 fee on about $8,200 ransom, 18.3 times.

Market and Supply Chain8 Oct 2026

MonsterCloud indictment: alleged fee was 18.3 times the ransom in one case and 1.6 times in the other

What the DOJ releases and the indictment fix and leave unstated, what each dollar figure counts, and UK guidance on hiring recovery or negotiation help: NCSC assurance, OFSI, the ICO, reporting, and the ban that is still only a proposal.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows a generic two-panel window: on the left a tall stack of plain grey bars like the lines of a program, the top two inside an amber strip; on the right a narrow panel of three empty message capsules with small cyan pills. No writing appears anywhere, and the left of the picture is empty dark.

AI Security8 Oct 2026

Malware that talks to AI triage: by Talos's own bar, only one of four tricks steered the models, the plainest

What Talos's 8 October post establishes and what it leaves out: a net rate rather than 35% of runs, five unnamed local models, a corpus built by its own filters, and a UK checklist for SOC and managed detection teams.

Wednesday 7 October

Microsoft Surface Laptop Ultra opened with a dark abstract graphic on its screen.

Market and Supply Chain7 Oct 2026

Surface Laptop Ultra opens UK pre-orders at £2,599 as RTX Spark reaches ASUS and rival PCs

Surface Laptop Ultra UK pre-orders start at £2,599. We compare complete configurations, ASUS ProArt P16 and P14, and other RTX Spark launches.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows a generic browser window with an empty address bar above a long, tightly packed list of rows, each a small coloured pill and a grey bar with no writing: four coral rows at the top, then amber rows, then cyan and slate ones, the list running off the bottom of the screen.

Threat Intel7 Oct 2026

Chrome 155's 247 fixes: 14 credits name an AI tool, all reported 6 to 12 days before release

What the 14 AI credits establish and do not, SecurityWeek's figures checked against the notes, how 247 compares with earlier Chrome releases, the bounty column, and a UK checklist.

A dim equipment-room steel bench with a graphite rack-mount network appliance cabled to an open laptop. The laptop screen shows a list of blank rounded rows with one row outlined in amber. Text on the left reads: September's SMA1000 fix build is the newest build listed affected, 35 days, 1 Sep fix build to the 6 Oct advisory that lists it as affected.

Threat Intel7 Oct 2026

SonicWall's September SMA1000 fix is the newest build its 6 October advisory lists as affected

The build that fixed September's exploited SMA1000 flaws is still affected by the 6 October 10.0 flaw. Both earlier advisories that reported exploitation reached CISA's catalogue within a day, and this one is not listed in the version read, which predates it.

A dark server room with one equipment rack holding four black GPU servers under a flat network switch. One orange cable runs from a single switch port down the front of the rack and into a server, and a grey flight case stands beside the rack. There is no lettering and nobody in the room.

AI Security7 Oct 2026

LMCache's 9.8 flaw has no fixed release, and the project's own Kubernetes example listens on every interface

JFrog scores CVE-2026-105192 at 9.8 for a routable bind; the default is localhost. LMCache's Kubernetes example binds every interface, and four more LMCache CVEs followed the same afternoon. No fix, no maintainer statement, not in KEV.

A black rack server on a steel shelf in a dark cupboard with a plain red cloth book lying on top of it, and below it a laptop on a crate showing an empty list of blank rows with one hollow slot.

Threat Intel7 Oct 2026

PoeLLM hides its address in a poem, but the LiteLLM flaw Lumen names was fixed 177 days before its report

Lumen's report on the PoeLLM botnet gives its victim count as more than 3,400 in one place and almost 2,200 in two others. The poem hides a command address; the doors are exposed AI services and a LiteLLM flaw that had a fix for 177 days.

A dark desk at night with a monitor showing a table of blank rounded rows, one row outlined in amber, and in front of it an open laptop whose address bar, a blank rounded pill, carries a small amber padlock outline. A coiled black network cable lies on the walnut desk. There is no lettering anywhere and nobody is in the room.

Breaches and Incidents7 Oct 2026

Three ccTLD hijacks, no certificate count: one passed check can back a certificate until 30 September 2027

Three ccTLDs, no certificate count, no dates, no CA names. Under the Baseline Requirements a validation completed this autumn can back a certificate valid to 30 September 2027, and CAA and Certificate Transparency are the owner's tools.

A dark server room with a tall black rack of five blank rackmount servers on the right and, in front of it, a laptop on a low steel cart whose screen shows a terminal window of thirteen empty grey lines with one small empty amber key outline in the top corner, to suggest a remote login with nothing filled in.

Threat Intel7 Oct 2026

OpenSSH 10.6's notes cite no CVEs, yet MITRE issued 11 within 12 hours; none is for the post-quantum key

What the 10.6 notes state about AI-found reports and release cadence, the 11 CVE records and who scored them, the ML-DSA signature versus key exchange, Debian, Ubuntu and Red Hat status, and a UK checklist in the order worth doing.

A small agency desk in low light with an open laptop showing a plugin list drawn as blank rounded rows, one row outlined in amber with a small update-arrow outline, and a fan of plain colour swatches beside it. There is no lettering and nobody in the room.

Threat Intel7 Oct 2026

Ninja Forms was fixed 14 days before Patchstack saw the first attack, and the fix does not clean a hacked site

Patchstack recorded the first attempt on Ninja Forms CVE-2026-94504 on 5 October, 14 days after the 3.15.4 fix. The campaign leaves four ways back in, only one visible in the dashboard, and two figures in circulation, 600,000 and 3,600, belong to other things.

A dark network closet at night. On the right an open equipment rack holds one flat rack-mounted firewall appliance with a row of empty ports, and below it an open laptop on a black road case shows a list of nine blank rounded rows, one outlined in amber, with a small empty padlock outline in the corner.

Threat Intel7 Oct 2026

FBI's FortiBleed alert names no CVE, and its 86,644 is SOCRadar's count, which stood at 30,791 on 17 June

FBI and USSS advisory JCSA-20261006-01: no CVE, a count credited to SOCRadar (30,791 on 17 June, 86,644 a day later), lockouts and ransomware reporting without numbers. What it does not establish, the UK position, and a checklist.

Tuesday 6 October

A laptop on a marketing desk showing a blank browser window with a second, smaller blank window laid over it, and a sign-in form drawn as empty rounded pills with one teal button. A fan of plain colour swatches lies in front and a felt board of blank colour squares stands behind. Nothing carries any lettering.

Threat Intel6 Oct 2026

Fake ad portals for six AI brands span 189 days; a drawn Google window relays passwords and MFA codes

The window is drawn, the address bar is copied and a typed code is relayed live. Island reports hundreds of submissions, but states no victim count, loss, operator or UK reach.

Page 21

Tuesday 6 October

A dark security operations desk at night. On the right an open laptop shows a dashboard of five blank rounded pills above a grid of fifty small empty squares, four outlined in amber, with a small empty padlock outline in the top corner, and behind it a tall monitor on standby, a plain mug and a closed notebook.

AI Security6 Oct 2026