The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 205 to 228 of 658 briefings

Friday 9 October

A dark room with a dark walnut pigeonhole sorting frame at the right, three rows of four slots with blank colour tabs in indigo, cyan, amber and slate grey, holding cream envelopes at different depths. A steel pocket stopwatch with a plain dial lies open on the bench in front of it, beside two loose blank envelopes. No writing appears anywhere, and the left of the picture is empty dark.

AI Security9 Oct 2026

Microsoft calls Decision-1 '4.5 times faster'; JevBench's raw timing for the runner-up gives 1.4 times

Microsoft's launch chart sets an 85 ms measured API against JevBench's adjusted 380 ms for Quyet-1.0-Large, whose raw timing is 116 ms. The 36-benchmark accuracy ranking contains no general-purpose LLM, and no independent result for Decision-1 exists yet.

A dark room with a slim black monitor on a walnut desk at the right of the picture. Its screen shows one window outlined in pale cyan, made only of empty pills and blank rounded squares, with a small cyan pill at the top right. Beside it stands a compact black tower computer with a mesh front and one amber status light. The left is empty dark, with the headline and a stat drawn over it: 107 days.

Threat Intel9 Oct 2026

AnyDesk Linux: the researchers' root exploit came 107 days after a release logged only as a crash fix

What AnyDesk's changelogs, its post on X, the researchers' post, NVD, CVE.org and CISA's catalogue establish about the AnyDesk Linux flaw: dates, scope, the relay dispute, the UK timescales and a ranked checklist.

A dark pinboard covered in rows of pinned paper index cards, nearly all turned face-down and blank, with a few turned face-up to show blank white faces with empty grey bars. Text on the left reads: 2,627 ransomware claims, 247 confirmed by victims. 9.4% of Q3's claims are confirmed by the victim (247 of 2,627, derived).

Threat Intel9 Oct 2026

Q3's record 2,627 ransomware attacks: 247 confirmed by the victim, 2,380 only claimed

Recounting Comparitech's Q3 2026 ransomware record from its own tables: 247 of 2,627 confirmed, a Q2 that was a dip, 517 of the 597 extra claims from strains with no Q2 claims, and two other trackers that agree on direction and not size.

A dark server room: a black rack holds one graphite backup storage server with a grid of identical drive bays and an amber light, and a graphite monitor on a steel desk shows a console of blank rounded rows. Text on the left reads: Ahsay said 10.3.4 fixed it. A day later: not fully. 3 days 16 hours: NVD record to Huntress's first sighting (derived).

Threat Intel9 Oct 2026

Huntress said AhsayCBS 10.3.4 was affected; Ahsay said it fixed both flaws, then said it did not fully

A computed gap, one build that two vendors described in opposite ways until the vendor changed its answer, and a backup console that MSPs expose to clients. What the record, Huntress and Ahsay state, what is not stated, UK clocks for MSPs and the order of actions.

An old beige computer tower, switched off, stands beside a graphite laptop with a blank pale-blue screen, under a wall calendar with an empty grid and two cells ringed in red. Text on the left reads: Windows Update certificates expire 17 May, 19 June 2027. 125 days: Server 2016 support ends this long before 17 May.

Market and Supply Chain9 Oct 2026

Windows Update certificates expire 17 May and 19 June 2027; Server 2016 support ends 125 days before

Microsoft's 8 October notice sets two Windows Update certificate dates. What its six-row table states and leaves out, which listed versions leave support first, the WSUS exception, the UK clocks and the order to work in.

A regulator's desk at dusk with a row of identical pale grey-blue folders, some with a blank sheet sliding out, a printed checklist with empty boxes, a pen and an open laptop showing a blank response form. No people. Overlaid text reads ICO details changes at 8 of 10 AI developers, and dates none of them, plus 8 of 10, developers with a line of their own: 3 done, 3 promised, 2 both.

Compliance and Regulation9 Oct 2026

ICO details changes at 8 of 10 AI developers: 3 done, 3 promised, 2 both, and none dated

What the ICO's 8 October report prints for each of ten AI developers, what it leaves out, what the call for evidence on agentic AI asks, and the register a UK organisation using these tools should keep before 20 November.

A dark desk at night. A black wire in-tray is buried under a slumping heap of identical blank report sheets, each with an empty title bar and rows of grey bars where text would be, and some sheets have slid across the desk. A small closed steel box with one narrow empty slot stands beside it, and behind them a laptop shows a plain list of blank rows with one cyan row. Nothing is written anywhere and nobody is in the room.

AI Security9 Oct 2026

OSS Scanner skips human review: Anthropic expects over 90% true, but prints no rate for the 4,824 already sent

Anthropic expects over 90 per cent of OSS Scanner's unreviewed reports to be true, but gives no rate for the 4,824 already sent direct. Its early sample reads 88 or 99 per cent by definition. Also the infrastructure program's eleven partners, and UK clocks.

A dark equipment room: a black rack holds three identical graphite network appliances, each with one amber light, and below them a graphite laptop on a steel cart shows a blank sign-in screen of rounded empty fields. Text on the left reads: The previous NetScaler fix build is affected, for SAML IdPs. 3 in 11 days: NetScaler bulletins on 27 Sep, 3 Oct and 8 Oct.

Threat Intel9 Oct 2026

Citrix's third NetScaler bulletin in 11 days lists the previous fix build as affected, for SAML identity providers

Three NetScaler bulletins in 11 days, ten CVEs, and a new SAML flaw whose affected range ends at the previous fix build. What Citrix states and leaves out, the UK patching clocks and what to check.

A dark exhibition-hall bench holding a smartphone on a stand showing blank rounded rows, a white smart-home hub, a grey printer and a small server rack, each with a blank white card in front. Text on the left reads: Pwn2Own: AI infrastructure gave 23 of 98 zero-days, 15% of cash. 23 OF 98 zero-days, for 14.9% of the cash.

AI Security9 Oct 2026

Pwn2Own Ireland: AI infrastructure gave 23 of the 98 zero-days but 15% of the $1,262,000

Recounting Pwn2Own Ireland 2026 from ZDI's own tables: 61 attempts, 51 successes, 10 failures, 2 inferred withdrawals and 29 collision-labelled successes. No vendor page read on 9 October ties a fix to a contest bug.

A compliance desk at dusk with a thin and a thick printed policy document, a printed checklist with empty boxes, a blank approval card, an open laptop showing a blank document viewer and a small red emergency-stop button. No people. Overlaid text reads Usage Policy: 79% longer, effective 12 November, plus 79%, our word count 4,424 against 2,473.

Compliance and Regulation9 Oct 2026

Anthropic's new Usage Policy is 79% longer and takes effect 35 days after it was posted

Anthropic's Usage Policy takes effect 12 November: 4,424 words against 2,473. What changed in substance, what the texts do not establish, and what a UK organisation building on Claude should record before the date.

An empty newsroom desk at dusk with an open laptop showing an article page made of blank shapes, a blank press-pass lanyard, a printed page proof with one highlighted byline slot and a row of wooden blocks stepping upward, two of them amber. No people. Overlaid text reads: Two of 30 rated Category 5 and 4, no outlet named in the text, 5 of 6.

Threat Intel9 Oct 2026

Two of OpenAI's 30 exposed influence operations rate Category 5 and 4; its text names no outlet that ran them

OpenAI says it banned two influence operations that used ChatGPT and rates their reach Category 5 and 4 of 6. What the page states and omits, how Anthropic's reports compare, and what UK publishers and security teams can check.

A back-office desk at dusk with a handheld card terminal beside an open laptop whose screen shows a chat window and a small approval card with two blank buttons, a blank card, a plain security key and an emergency stop button. No people. Overlaid text reads One 'must', 130 'should' in PCI SSC's AI guidance, 130 : 1.

Compliance and Regulation9 Oct 2026

PCI SSC's AI guidance has one 'must' and 130 'should', and asks for explicit human approval in one example

PCI SSC's advisory AI guidance, dated September 2026, has one 'must' against 130 'should'. What it ties to PCI DSS, what is new, what it leaves undefined, and what UK merchants and suppliers can check.

Page 19

Friday 9 October

A dark room with a graphite laptop on a walnut desk at the right of the picture. Its screen shows a chat of empty message pills with one cyan pill sent. Beside it stands a charcoal cabinet holding a stack of identical dark modules, one with a cyan status light, with an amber strip glowing between the modules as a shared rail. The left of the picture is empty dark, with the headline and a stat drawn over it: 260 days.

AI Security9 Oct 2026

AgentCorruption: Zenity saw the AgentCore default role narrowed 260 days after its report; no AWS notice found

What Zenity's five posts, AWS's AgentCore pages and Dark Reading's report establish about AgentCorruption: dates, scope, what AWS states, what UK customers must still check on agent roles, and a ranked checklist.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows one empty bar above a grid of eight empty tiles, two of them filled amber. In front of it lies a clear evidence bag holding a small router and a round camera, with a blank label strip. Beside it is a stapled sheaf of pages with grey bars for text and an amber tab. The left of the picture is empty dark, with the headline and a stat drawn over it: 2 of 8+.

Threat Intel9 Oct 2026

Integrity Tech seizure: of at least eight scanned targets, the affidavit alleges breaches at two universities

What the 8 October seizure papers, the 58-page joint advisory and the NCSC's own item establish: two alleged breaches, six scan targets not said to be breached, 20 universities or six, and a UK checklist.

Thursday 8 October

A school desk at dusk with an open laptop showing a chat window with a rounded reminder card, an open study planner with one highlighted row, a stack of blank flashcards and a sand timer. No people. Overlaid text reads 2.7 million more messages, no group size or method stated.

Compliance and Regulation8 Oct 2026

OpenAI's teen figures: 2.7 million more messages, with no group size, period or method stated

OpenAI's 7 October teen post gives no group size, period or method for its figures, and its social media comparison sets a survey against logs. What UK schools, parents and providers can check under Ofcom, ICO and DfE rules.

A dim security operations desk with a graphite laptop open in front of a black server rack holding three plain servers. The laptop screen shows a log search view of blank rounded rows, three of five outlined in amber and the first opened out. Text on the left reads: Only one of Splunk's three Critical CVEs says how it works. 1 of 3, Critical CVEs with a stated precondition and mitigation.

Threat Intel8 Oct 2026

Splunk's three Critical Enterprise CVEs: one is explained, two are only a weakness class and a score

Of 83 CVEs in Splunk's five 7 October advisories, three Splunk Enterprise flaws score 9.0 or more. One is explained. Two are a weakness class and a score, and the October affected ranges end at August's fix builds.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows a map of connected empty circles, three filled cyan and one amber, with a column of empty pills at the left and three empty cards at the right. A tablet on a stand beside it shows a pale card with one empty field and a cyan button, and a phone in front shows three empty rows. The left of the picture is empty dark, with the headline and a stat drawn over it: 1 footnote.

Threat Intel8 Oct 2026

CrowdStrike's ARTEX report: AI use rests on the actor's own files, the bank breaches on one press footnote

What CrowdStrike's 7 October post establishes and what it leaves out: AI tooling from the actor's files, no named bank, no victim count, no Anthropic model named, a stack 3 to 63 days old, and a UK checklist.

A graphite budget smartphone stands against an open plain cardboard box on a dark walnut desk, its screen film peeling at one corner and its screen showing a list of blank rows with one outlined in amber, a white charging cable beside it. Text on the left reads: UK is 3.49% of Bitdefender's infected-phone chart. 3.49%. UK share of observed infected devices. No device count given.

Market and Supply Chain8 Oct 2026

Bitdefender: malware ships in cheap Android firmware. The UK is 3.49% of its chart; no device count above 199

Bitdefender's Midnight Mimosa report: malware preinstalled in cheap Android firmware, not removable by the owner. The UK is in a chart at 3.49% with no count behind it. The actor, the point of insertion and any reset test are not given; 13 Play apps were still listed.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows a generic window of empty pills with three horizontal bars: one full length in slate, one short cyan stub and one short amber bar, above a grid of blank grey pills. A blank paper receipt with grey bars curls off the desk edge beside it. No writing appears anywhere, and the left of the picture is empty dark.

AI Security8 Oct 2026

Haiku 5.5 'costs around 75% less', but at Max effort three of Anthropic's four charts show it dearer than 4.5

Footnote 2 explains why 90 per cent off a token is 'around 75 per cent' off the bill. Anthropic's chart data put the 75 per cent at Medium effort and show Max costing 2.3 to 3.6 times Haiku 4.5 per task on three of four benchmarks.

A dim desk at dusk. A graphite laptop at the right shows a chat window drawn in plain shapes: an empty heading capsule, five empty tabs with one cyan, a small bar chart in indigo and cyan, an amber slider handle and two empty buttons. Behind it a larger monitor shows a dark workspace of plain grey bars. No writing appears anywhere, and the left of the picture is empty dark.

AI Security8 Oct 2026

GPT-6 Sol is two versions under one name: October's in ChatGPT chat, September's in Codex, 15 days apart

One name, two versions, 15 days apart: what OpenAI's card, help pages and API docs establish about GPT-6 Sol in ChatGPT chat, what they leave out, and a UK checklist for model change control.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows a pale card of empty grey pills with a cyan button. A phone lies face up in front with a small card of two empty pills, and behind the laptop a paper poster with an amber header bar and grey lines is pinned to a felt board. The left of the picture is empty dark, with the headline and a stat drawn over it: three emails.

Threat Intel8 Oct 2026

Talos's 'AI-assisted' label rests on three emails; the Google relay behind them forwards the codes people type

What Talos's 8 October post on UAT-11985 establishes and what it leaves out: three emails behind the AI-assisted label, a relay that forwards typed codes and taps, no victim count, and what UK organisations on Google can do.

A dark room with a graphite laptop at the back right whose screen shows a list of twelve rows, each with a bright teal disc and three empty grey pills with nothing written in them. On the walnut desk in front lies a very thick ream of paper ruled the same way: a teal disc and blank grey pills on every row and three small amber pills at the top: a long list marked finished, nothing named. Our own words at left read 400+ Java flaws fixed, they say, no CVE, library or date given, 0 identifiers.

Market and Supply Chain8 Oct 2026

IBM and Red Hat say Lightwell fixed 400+ Java flaws, and the release names no CVE, library or date

What the 6 October Lightwell release states and leaves out, what a search of NVD, CVE.org, GitHub and osv.dev found, how backports confuse scanners, and what Cyber Essentials and the NCSC mean for a UK Java estate.

A graphite laptop on a dark walnut desk at night shows a list of blank release rows with the top row outlined in amber, and a ring of plain brass keys lies on the desk in front of it. Text on the left reads: Malicious Tensorlake release was live up to about 102 minutes. 102 MIN. Publish stamp to last change: 1 h 42 m 20 s. Derived; an upper bound.

Market and Supply Chain8 Oct 2026

Tensorlake's malicious npm release was live for up to about 102 minutes, and carried valid provenance

A Shai-Hulud worm release of the tensorlake package sat on npm for no more than about 102 minutes, about 91 of them after Socket flagged it. It carried valid provenance and a trusted publisher. No source reports a victim count, and six native packages at the same version remain.

A dark desk with an open silver laptop and a plain graphite call-centre headset lying in front of it. The laptop screen shows a tall list of eight blank rounded rows, each with a small dot at the left and a small blank pill at the right, with no writing anywhere. Nobody is in the room.

Compliance and Regulation8 Oct 2026

Guardian: AI scores Co-op Legal Services calls on more than 50 aspects; the Co-op calls it a support tool

Monitoring is not unlawful in itself, and a score is not a decision. The Guardian's account leaves open whether callers were told, whether an impact assessment came first, and what managers do with a fail score.

Show 12 more