The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 193 to 228 of 658 briefings

Monday 12 October

A dark server room. A black equipment rack holds six flat grey firewall appliances with blank label plates, and a single small cyan status light is lit on the third. Beside it a plain paper calendar page is taped to the rack, a grid of empty squares with one square outlined in cyan marker. The left half is empty dark blue, with the headline and a stat drawn over it: 149 days.

Threat Intel12 Oct 2026

Palo Alto's CVE-2026-0257 advisory was 149 days old when ReliaQuest warned ransomware groups still use it

A computed gap, 149 days, from Palo Alto's advisory to ReliaQuest's warning; the fixed versions per train; four scores for one flaw; what no source establishes; UK controls; and an ordered checklist. Defender level only.

A dark operations desk at night. A spiral-bound desk calendar with an empty grid and one blank square ringed in cyan stands in front of a black server rack with blank label wells, beside a monitor showing six empty rounded bars and a brass desk lamp. The left of the frame is empty dark blue with the headline drawn over it: Let's Encrypt moves to 64-day certificates, and a stat, 64 days.

Market and Supply Chain12 Oct 2026

Let's Encrypt moves to 64-day certificates on 10 February 2027; its last 90-day one should expire 11 May

What Let's Encrypt's own pages and the CA/Browser Forum's rules say about 64-day certificates, what a fixed renewal rule does at 90, 64 and 45 days, what the record leaves out, what UK guidance asks for, and an ordered checklist.

A dark desk in low blue light with one open laptop on the right. Its screen is tiled with about three dozen small identical blank windows, each with a pale title bar and two grey bars, and the keys are blank. The left half is empty dark blue, with the headline and a stat drawn over it: 51 agent files, WordPress flaws fixed on 17 July, 32 shells.

Threat Intel12 Oct 2026

CyberXero: 51 Claude Code agent files, 32 shells in 61 seconds, and WordPress flaws fixed on 17 July

What SOCRadar's CyberXero report establishes, what it does not, the arithmetic behind 32 shells in 61 seconds and 564,073 of 628,000 records, the public fixes and CISA KEV status for the named CVEs, what the model's maker has said, UK controls, and a ranked checklist. Defender level only.

A dark designer's desk at night. A large monitor shows a half-built web page layout made only of blank rounded shapes, with a dark indigo side panel and a bright canvas. Beside it stands a small industrial warning lamp with a smoked amber dome, switched off. A white mouse and stylus lie on a grey felt mat. The left half is empty dark blue, with the headline and a stat drawn over it: 21:47 UTC.

Threat Intel12 Oct 2026

Bricksforge CVE-2026-85097: exploit attempts began on disclosure day; the changelog has no 3.1.8.10 date

What the primary records establish about CVE-2026-85097: the first attempt, a fix date nobody publishes, three flaws in five weeks on one database's dates, a spray of 56 requests from 44 addresses, UK controls and an ordered checklist. Defender level only.

Sunday 11 October

A dark laboratory bench in dim blue light. An unmarked pale grey and white desktop robotic arm reaches forward with its gripper open, beside a plain grey control cabinet whose door carries two blank recessed plates. A brushed steel stopwatch with a plain dial and one blue hand lies in front. The left half is empty dark blue, with the headline and a stat drawn over it: 8 of 8.

AI Security11 Oct 2026

Booz Allen's OT lab met 8 of 8 objectives with every exploit human-approved, and states no run count or model

What Booz Allen's page and white paper establish about an AI test in its OT lab, what they leave out, the arithmetic behind 8 of 8, how the UK AI Security Institute's industrial range and the NCSC compare, what UK guidance covers, and a ranked checklist. Defender level only.

A dark room with an open paper desk diary on a walnut desk at the right of the picture. Its pages hold seven empty ruled boxes with blank pills at the top, and one amber sticky note lies in a box on the right page. The left is empty dark, with the headline and a stat drawn over it: 0 clicks.

Threat Intel11 Oct 2026

Calendar phishing arrives with zero clicks on Google Workspace's default; Sublime's 33,000% is a projection

What Google's and Microsoft's own pages say about the default, which settings stop a calendar lure and which do not, the number behind "exponential", what no source establishes, UK reach of the NCSC and Cyber Essentials, and a ranked checklist. No lure is printed.

A dusk landscape. A pale grey outdoor steel cabinet stands in the right foreground with its door swung open and a brass padlock hanging open from the hasp, an empty blank plate on the door. The base of a white wind turbine tower rises behind it and rows of solar panels recede to an amber horizon. The left half is empty dark blue, with the headline and a stat drawn over it: 93% solar.

Threat Intel11 Oct 2026

Modat counts 8,547 wind and solar systems reachable online: 93% solar, a floor, and the UK outside its scope

What Modat's pages, Reuters and others establish about 8,547 exposed wind and solar systems, the arithmetic behind the percentages, why the UK is outside the count, what the NIS Regulations and the NCSC say, and a ranked checklist. Nothing identifying a site is printed.

Saturday 10 October

A dark room with two near-identical brass nameplates side by side on a walnut desk at the right of the picture. Each has four screws and an empty recessed panel. The right plate is slightly darker and redder, with a small dimple at each end of its panel. The left is empty dark, with the headline and a stat drawn over it: 29 letters.

Threat Intel10 Oct 2026

Two characters put 20 lookalike domains past Chromium's checks: a 29-letter list and an 8,462-domain list

What the researchers' write-up and Chromium's own source establish about two characters that pass the browser's lookalike checks, what is not stated, why a list fails open for a letter or a brand it does not hold, UK controls and a ranked checklist. No lookalike domain is printed.

A dark desk at night with a black smartphone lying face up at the centre right. Its screen shows an update page made only of empty pills: one short title pill, three wide grey pills and a blank pale cyan button. Beside it stand a small closed steel padlock and, behind it, a blank white card. The left is empty dark, with the headline and a stat drawn over it: 239 days.

Threat Intel10 Oct 2026

P7 DarkSword is a kit for iOS 18.4 to 18.7, and Apple fixed all six of its flaws by 11 February 2026

What iVerify, Google, Lookout, Censys, Report URI and Apple establish about P7 DarkSword: the six flaws and their fixes, which iPhones are exposed, what is not stated, UK controls and a ranked checklist. No indicators are printed.

A dark desk at night. A small brushed-steel drop box stands on a walnut desk at the right of the picture, with one blank cream paper slip sticking up out of the slot in its top and a smooth, empty oval panel on its front. Behind it a black wire tray holds a loose drift of identical blank slips. The left half is empty dark, with the headline and a stat drawn over it: 72 days to find, 9 to tell, 81 days.

AI Security10 Oct 2026

A Claude model's fake police tip took 72 days to find and 9 more to report; Anthropic calls the impact minimal

Dates, counts and labels in Anthropic's 9 October report on unintended model actions: what the police statement adds, what no source states, and what UK organisations that give agents live internet access should do.

A dark room with a silver laptop on a walnut desk at the right of the picture. Its screen shows a download page made only of empty pills, a browser strip, and a pale cyan button above a blank command panel with an empty copy square. Beside it stands a blank white card and a blank amber sticky note lies on the desk. The left is empty dark, with the headline and a stat drawn over it: 4 stops.

Threat Intel10 Oct 2026

A Google ad showed bing.com; four stops later a fake Claude installer's copy button swapped the command

What Push Security and BleepingComputer establish about the Adception campaign: the four stops, the cloaking gates, the swapped clipboard command, what is not stated, UK controls for Macs and a ranked checklist. No attacker addresses are printed.

A dark wooden library card catalogue: rows of identical small drawers with brass pulls and blank label frames, about a dozen pulled slightly open, each with a thin blank white sheet standing up showing empty grey bars. Text on the left reads: One campaign, three counts: 345, 772, and 'tens of thousands'. 81% of the 345 repositories in two sweeps were forks (279, derived).

Market and Supply Chain10 Oct 2026

GhostAction: 345 repositories in two sweeps; GitGuardian's update of 13 October counts more than 30,000

A fake security-audit workflow, counted four ways: 345 repositories in a day (81% forks), 772 over a month, Socket's unnumbered tens of thousands, and now more than 30,000 from GitGuardian. What each counts, what ran, and what a UK reader can conclude.

Page 18

Friday 9 October

A dark room with a dark walnut pigeonhole sorting frame at the right, three rows of four slots with blank colour tabs in indigo, cyan, amber and slate grey, holding cream envelopes at different depths. A steel pocket stopwatch with a plain dial lies open on the bench in front of it, beside two loose blank envelopes. No writing appears anywhere, and the left of the picture is empty dark.

AI Security9 Oct 2026

Microsoft calls Decision-1 '4.5 times faster'; JevBench's raw timing for the runner-up gives 1.4 times

Microsoft's launch chart sets an 85 ms measured API against JevBench's adjusted 380 ms for Quyet-1.0-Large, whose raw timing is 116 ms. The 36-benchmark accuracy ranking contains no general-purpose LLM, and no independent result for Decision-1 exists yet.

A dark room with a slim black monitor on a walnut desk at the right of the picture. Its screen shows one window outlined in pale cyan, made only of empty pills and blank rounded squares, with a small cyan pill at the top right. Beside it stands a compact black tower computer with a mesh front and one amber status light. The left is empty dark, with the headline and a stat drawn over it: 107 days.

Threat Intel9 Oct 2026

AnyDesk Linux: the researchers' root exploit came 107 days after a release logged only as a crash fix

What AnyDesk's changelogs, its post on X, the researchers' post, NVD, CVE.org and CISA's catalogue establish about the AnyDesk Linux flaw: dates, scope, the relay dispute, the UK timescales and a ranked checklist.

A dark pinboard covered in rows of pinned paper index cards, nearly all turned face-down and blank, with a few turned face-up to show blank white faces with empty grey bars. Text on the left reads: 2,627 ransomware claims, 247 confirmed by victims. 9.4% of Q3's claims are confirmed by the victim (247 of 2,627, derived).

Threat Intel9 Oct 2026

Q3's record 2,627 ransomware attacks: 247 confirmed by the victim, 2,380 only claimed

Recounting Comparitech's Q3 2026 ransomware record from its own tables: 247 of 2,627 confirmed, a Q2 that was a dip, 517 of the 597 extra claims from strains with no Q2 claims, and two other trackers that agree on direction and not size.

A dark server room: a black rack holds one graphite backup storage server with a grid of identical drive bays and an amber light, and a graphite monitor on a steel desk shows a console of blank rounded rows. Text on the left reads: Ahsay said 10.3.4 fixed it. A day later: not fully. 3 days 16 hours: NVD record to Huntress's first sighting (derived).

Threat Intel9 Oct 2026

Huntress said AhsayCBS 10.3.4 was affected; Ahsay said it fixed both flaws, then said it did not fully

A computed gap, one build that two vendors described in opposite ways until the vendor changed its answer, and a backup console that MSPs expose to clients. What the record, Huntress and Ahsay state, what is not stated, UK clocks for MSPs and the order of actions.

An old beige computer tower, switched off, stands beside a graphite laptop with a blank pale-blue screen, under a wall calendar with an empty grid and two cells ringed in red. Text on the left reads: Windows Update certificates expire 17 May, 19 June 2027. 125 days: Server 2016 support ends this long before 17 May.

Market and Supply Chain9 Oct 2026

Windows Update certificates expire 17 May and 19 June 2027; Server 2016 support ends 125 days before

Microsoft's 8 October notice sets two Windows Update certificate dates. What its six-row table states and leaves out, which listed versions leave support first, the WSUS exception, the UK clocks and the order to work in.

A regulator's desk at dusk with a row of identical pale grey-blue folders, some with a blank sheet sliding out, a printed checklist with empty boxes, a pen and an open laptop showing a blank response form. No people. Overlaid text reads ICO details changes at 8 of 10 AI developers, and dates none of them, plus 8 of 10, developers with a line of their own: 3 done, 3 promised, 2 both.

Compliance and Regulation9 Oct 2026

ICO details changes at 8 of 10 AI developers: 3 done, 3 promised, 2 both, and none dated

What the ICO's 8 October report prints for each of ten AI developers, what it leaves out, what the call for evidence on agentic AI asks, and the register a UK organisation using these tools should keep before 20 November.

A dark desk at night. A black wire in-tray is buried under a slumping heap of identical blank report sheets, each with an empty title bar and rows of grey bars where text would be, and some sheets have slid across the desk. A small closed steel box with one narrow empty slot stands beside it, and behind them a laptop shows a plain list of blank rows with one cyan row. Nothing is written anywhere and nobody is in the room.

AI Security9 Oct 2026

OSS Scanner skips human review: Anthropic expects over 90% true, but prints no rate for the 4,824 already sent

Anthropic expects over 90 per cent of OSS Scanner's unreviewed reports to be true, but gives no rate for the 4,824 already sent direct. Its early sample reads 88 or 99 per cent by definition. Also the infrastructure program's eleven partners, and UK clocks.

A dark equipment room: a black rack holds three identical graphite network appliances, each with one amber light, and below them a graphite laptop on a steel cart shows a blank sign-in screen of rounded empty fields. Text on the left reads: The previous NetScaler fix build is affected, for SAML IdPs. 3 in 11 days: NetScaler bulletins on 27 Sep, 3 Oct and 8 Oct.

Threat Intel9 Oct 2026

Citrix's third NetScaler bulletin in 11 days lists the previous fix build as affected, for SAML identity providers

Three NetScaler bulletins in 11 days, ten CVEs, and a new SAML flaw whose affected range ends at the previous fix build. What Citrix states and leaves out, the UK patching clocks and what to check.

A dark exhibition-hall bench holding a smartphone on a stand showing blank rounded rows, a white smart-home hub, a grey printer and a small server rack, each with a blank white card in front. Text on the left reads: Pwn2Own: AI infrastructure gave 23 of 98 zero-days, 15% of cash. 23 OF 98 zero-days, for 14.9% of the cash.

AI Security9 Oct 2026

Pwn2Own Ireland: AI infrastructure gave 23 of the 98 zero-days but 15% of the $1,262,000

Recounting Pwn2Own Ireland 2026 from ZDI's own tables: 61 attempts, 51 successes, 10 failures, 2 inferred withdrawals and 29 collision-labelled successes. No vendor page read on 9 October ties a fix to a contest bug.

A compliance desk at dusk with a thin and a thick printed policy document, a printed checklist with empty boxes, a blank approval card, an open laptop showing a blank document viewer and a small red emergency-stop button. No people. Overlaid text reads Usage Policy: 79% longer, effective 12 November, plus 79%, our word count 4,424 against 2,473.

Compliance and Regulation9 Oct 2026

Anthropic's new Usage Policy is 79% longer and takes effect 35 days after it was posted

Anthropic's Usage Policy takes effect 12 November: 4,424 words against 2,473. What changed in substance, what the texts do not establish, and what a UK organisation building on Claude should record before the date.

An empty newsroom desk at dusk with an open laptop showing an article page made of blank shapes, a blank press-pass lanyard, a printed page proof with one highlighted byline slot and a row of wooden blocks stepping upward, two of them amber. No people. Overlaid text reads: Two of 30 rated Category 5 and 4, no outlet named in the text, 5 of 6.

Threat Intel9 Oct 2026

Two of OpenAI's 30 exposed influence operations rate Category 5 and 4; its text names no outlet that ran them

OpenAI says it banned two influence operations that used ChatGPT and rates their reach Category 5 and 4 of 6. What the page states and omits, how Anthropic's reports compare, and what UK publishers and security teams can check.

A back-office desk at dusk with a handheld card terminal beside an open laptop whose screen shows a chat window and a small approval card with two blank buttons, a blank card, a plain security key and an emergency stop button. No people. Overlaid text reads One 'must', 130 'should' in PCI SSC's AI guidance, 130 : 1.

Compliance and Regulation9 Oct 2026

PCI SSC's AI guidance has one 'must' and 130 'should', and asks for explicit human approval in one example

PCI SSC's advisory AI guidance, dated September 2026, has one 'must' against 130 'should'. What it ties to PCI DSS, what is new, what it leaves undefined, and what UK merchants and suppliers can check.

Page 19

Friday 9 October

A dark room with a graphite laptop on a walnut desk at the right of the picture. Its screen shows a chat of empty message pills with one cyan pill sent. Beside it stands a charcoal cabinet holding a stack of identical dark modules, one with a cyan status light, with an amber strip glowing between the modules as a shared rail. The left of the picture is empty dark, with the headline and a stat drawn over it: 260 days.

AI Security9 Oct 2026

AgentCorruption: Zenity saw the AgentCore default role narrowed 260 days after its report; no AWS notice found

What Zenity's five posts, AWS's AgentCore pages and Dark Reading's report establish about AgentCorruption: dates, scope, what AWS states, what UK customers must still check on agent roles, and a ranked checklist.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows one empty bar above a grid of eight empty tiles, two of them filled amber. In front of it lies a clear evidence bag holding a small router and a round camera, with a blank label strip. Beside it is a stapled sheaf of pages with grey bars for text and an amber tab. The left of the picture is empty dark, with the headline and a stat drawn over it: 2 of 8+.

Threat Intel9 Oct 2026

Integrity Tech seizure: of at least eight scanned targets, the affidavit alleges breaches at two universities

What the 8 October seizure papers, the 58-page joint advisory and the NCSC's own item establish: two alleged breaches, six scan targets not said to be breached, 20 universities or six, and a UK checklist.

Thursday 8 October

A school desk at dusk with an open laptop showing a chat window with a rounded reminder card, an open study planner with one highlighted row, a stack of blank flashcards and a sand timer. No people. Overlaid text reads 2.7 million more messages, no group size or method stated.

Compliance and Regulation8 Oct 2026

OpenAI's teen figures: 2.7 million more messages, with no group size, period or method stated

OpenAI's 7 October teen post gives no group size, period or method for its figures, and its social media comparison sets a survey against logs. What UK schools, parents and providers can check under Ofcom, ICO and DfE rules.

A dim security operations desk with a graphite laptop open in front of a black server rack holding three plain servers. The laptop screen shows a log search view of blank rounded rows, three of five outlined in amber and the first opened out. Text on the left reads: Only one of Splunk's three Critical CVEs says how it works. 1 of 3, Critical CVEs with a stated precondition and mitigation.

Threat Intel8 Oct 2026

Splunk's three Critical Enterprise CVEs: one is explained, two are only a weakness class and a score

Of 83 CVEs in Splunk's five 7 October advisories, three Splunk Enterprise flaws score 9.0 or more. One is explained. Two are a weakness class and a score, and the October affected ranges end at August's fix builds.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows a map of connected empty circles, three filled cyan and one amber, with a column of empty pills at the left and three empty cards at the right. A tablet on a stand beside it shows a pale card with one empty field and a cyan button, and a phone in front shows three empty rows. The left of the picture is empty dark, with the headline and a stat drawn over it: 1 footnote.

Threat Intel8 Oct 2026

CrowdStrike's ARTEX report: AI use rests on the actor's own files, the bank breaches on one press footnote

What CrowdStrike's 7 October post establishes and what it leaves out: AI tooling from the actor's files, no named bank, no victim count, no Anthropic model named, a stack 3 to 63 days old, and a UK checklist.

A graphite budget smartphone stands against an open plain cardboard box on a dark walnut desk, its screen film peeling at one corner and its screen showing a list of blank rows with one outlined in amber, a white charging cable beside it. Text on the left reads: UK is 3.49% of Bitdefender's infected-phone chart. 3.49%. UK share of observed infected devices. No device count given.

Market and Supply Chain8 Oct 2026

Bitdefender: malware ships in cheap Android firmware. The UK is 3.49% of its chart; no device count above 199

Bitdefender's Midnight Mimosa report: malware preinstalled in cheap Android firmware, not removable by the owner. The UK is in a chart at 3.49% with no count behind it. The actor, the point of insertion and any reset test are not given; 13 Play apps were still listed.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows a generic window of empty pills with three horizontal bars: one full length in slate, one short cyan stub and one short amber bar, above a grid of blank grey pills. A blank paper receipt with grey bars curls off the desk edge beside it. No writing appears anywhere, and the left of the picture is empty dark.

AI Security8 Oct 2026

Haiku 5.5 'costs around 75% less', but at Max effort three of Anthropic's four charts show it dearer than 4.5

Footnote 2 explains why 90 per cent off a token is 'around 75 per cent' off the bill. Anthropic's chart data put the 75 per cent at Medium effort and show Max costing 2.3 to 3.6 times Haiku 4.5 per task on three of four benchmarks.

A dim desk at dusk. A graphite laptop at the right shows a chat window drawn in plain shapes: an empty heading capsule, five empty tabs with one cyan, a small bar chart in indigo and cyan, an amber slider handle and two empty buttons. Behind it a larger monitor shows a dark workspace of plain grey bars. No writing appears anywhere, and the left of the picture is empty dark.

AI Security8 Oct 2026

GPT-6 Sol is two versions under one name: October's in ChatGPT chat, September's in Codex, 15 days apart

One name, two versions, 15 days apart: what OpenAI's card, help pages and API docs establish about GPT-6 Sol in ChatGPT chat, what they leave out, and a UK checklist for model change control.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows a pale card of empty grey pills with a cyan button. A phone lies face up in front with a small card of two empty pills, and behind the laptop a paper poster with an amber header bar and grey lines is pinned to a felt board. The left of the picture is empty dark, with the headline and a stat drawn over it: three emails.

Threat Intel8 Oct 2026

Talos's 'AI-assisted' label rests on three emails; the Google relay behind them forwards the codes people type

What Talos's 8 October post on UAT-11985 establishes and what it leaves out: three emails behind the AI-assisted label, a relay that forwards typed codes and taps, no victim count, and what UK organisations on Google can do.

A dark room with a graphite laptop at the back right whose screen shows a list of twelve rows, each with a bright teal disc and three empty grey pills with nothing written in them. On the walnut desk in front lies a very thick ream of paper ruled the same way: a teal disc and blank grey pills on every row and three small amber pills at the top: a long list marked finished, nothing named. Our own words at left read 400+ Java flaws fixed, they say, no CVE, library or date given, 0 identifiers.

Market and Supply Chain8 Oct 2026

IBM and Red Hat say Lightwell fixed 400+ Java flaws, and the release names no CVE, library or date

What the 6 October Lightwell release states and leaves out, what a search of NVD, CVE.org, GitHub and osv.dev found, how backports confuse scanners, and what Cyber Essentials and the NCSC mean for a UK Java estate.

A graphite laptop on a dark walnut desk at night shows a list of blank release rows with the top row outlined in amber, and a ring of plain brass keys lies on the desk in front of it. Text on the left reads: Malicious Tensorlake release was live up to about 102 minutes. 102 MIN. Publish stamp to last change: 1 h 42 m 20 s. Derived; an upper bound.

Market and Supply Chain8 Oct 2026

Tensorlake's malicious npm release was live for up to about 102 minutes, and carried valid provenance

A Shai-Hulud worm release of the tensorlake package sat on npm for no more than about 102 minutes, about 91 of them after Socket flagged it. It carried valid provenance and a trusted publisher. No source reports a victim count, and six native packages at the same version remain.

A dark desk with an open silver laptop and a plain graphite call-centre headset lying in front of it. The laptop screen shows a tall list of eight blank rounded rows, each with a small dot at the left and a small blank pill at the right, with no writing anywhere. Nobody is in the room.

Compliance and Regulation8 Oct 2026

Guardian: AI scores Co-op Legal Services calls on more than 50 aspects; the Co-op calls it a support tool

Monitoring is not unlawful in itself, and a score is not a decision. The Guardian's account leaves open whether callers were told, whether an impact assessment came first, and what managers do with a fail score.

Show 12 more