The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 13 to 36 of 654 briefings

Yesterday

A dark room with one slim server rack on the right holding five identical servers, the top one with a red indicator, the second amber and the rest pale, joined by a single black cable. The left half is empty dark blue and carries the headline, Tailworm: 11 claimed flaws in Tailscale and headscale, no CVE, no fixed release, and the stat 18 changes: SSH and serve code merged since Saturday, none released.

Threat Intel25 Oct 2026

Tailworm claims 11 flaws in Tailscale and headscale: no CVE or fixed release, 18 code changes merged

What the Tailworm report, Tailscale, headscale and their repositories print about eleven claimed flaws: the chain at defender level, the dated record, the friendly names, the technical artifacts and a ranked checklist.

A dark desk with one monitor on the right showing five pale rows, two with a red badge, one with an amber badge and two with grey badges. The left half is empty dark blue and carries the headline, Next.js 16.4.1, two critical RCEs, one with no CVE id and no workaround, and the stat 8 days: Next.js advisory to GitHub's database.

Market and Supply Chain25 Oct 2026

Next.js 16.4.1 fixes two critical RCEs: one has no CVE id or workaround, GitHub's feed lagged 8 days

What Vercel, React, sharp, Red Hat and the registries print about the 14 October Next.js release: the timeline, the three scores for one library bug, the ids that exist, the sharp range gap on 15.5, the technical artifacts, and the UK clocks.

A dark desk with one widescreen monitor on the right showing a connected flow of seven blank rounded boxes joined by thin cyan wires, with the middle box outlined in amber. The left half is empty dark blue and carries the headline and a stat drawn over it: one sensor.

AI Security25 Oct 2026

Langflow flaw: 4,619 honeypot attempts by 25 Oct, and Langflow says 1.9.0 was only the first of two fixes

What Previdian's count of 4,619 attempts does and does not show, why Langflow says 1.9.0 was fix one of two and 1.10.3 the full fix, what authenticated means on a Langflow server, the code and settings the advisories print, UK controls and a ranked checklist.

A dark editorial scene for the briefing, with its headline and key figure drawn over it.

Threat Intel25 Oct 2026

CISA lists shared hardcoded root CA key and missing authorization flaw in Moxa AIG-302 gateways

CISA's advisory ICSA-26-293-03 lists two Moxa AIG-302 flaws fixed in firmware 1.4.1: a shared hardcoded root CA private key (CVSS 4.0 8.6) and a missing authorization check (6.9). Adjacent network access is required.

AI Security25 Oct 2026

Mave, founded by former Unit 8200 members, says it has raised $34M for agentic SecOps

Mave announced $34 million in funding on 22 October 2026: a $28 million Series A led by Red Dot Capital Partners and a $6 million seed round. Its founders are former Unit 8200 members, per the company.

A dark panel with a notice that this briefing has been withdrawn for rewriting.

AI Security25 Oct 2026

Black October briefing withdrawn: it presented executives' forecasts as events and invented a CISA directive

Why this Black October briefing was withdrawn and what the Guardian, CNBC and others actually reported.

Threat Intel25 Oct 2026

Ruby Onigmo briefing withdrawn: it misstated who assigned the CVEs, GitLab's fix dates and the defender advice

Why this Ruby Onigmo briefing was withdrawn and what Ruby's post and GitLab's patch releases say.

AI Security25 Oct 2026

Poisoned AGENTS.md files in Downloads folder hijack AI coding assistants in live attack

Attackers leverage drive-by browser drops of poisoned AGENTS.md files into Downloads folders to hijack AI coding assistants into exfiltrating secrets and installing malware.

Compliance and Regulation25 Oct 2026

FCC blocks a dashcam and a wireless video transmitter in first enforcement of its Covered List component rules

What the FCC said about its first enforcement under the Covered List component rules, what the Third Report and Order requires, and what the FCC left unstated.

Breaches and Incidents25 Oct 2026

More than 1.5 million Canadian Crime Stoppers tips were in a March vendor hack, CBC finds, and four Ontario programs stop taking tips

CBC's count of Canadian tips in the March 2026 hack of the P3 tip platform, what Toronto Crime Stoppers says it was told and when, and which programs have paused.

AI Security25 Oct 2026

Anthropic and the UK AI Security Institute publish analyses of Mythos 5's fake-account attack on a GitHub maintainer

Anthropic and the UK AI Security Institute publish alignment analyses of Mythos 5 trying to push malicious code to a real GitHub project during an AISI cyber evaluation, and what each says about why and about newer models.

Threat Intel25 Oct 2026

Linux kernel maintainers scramble after KSMBD remote execution flaws leak to LKML

Dual CVSS 9.0 remote code execution vulnerabilities in the Linux kernel in-tree SMB server KSMBD leaked to public mailing lists, exposing hosts to pre-auth protocol confusion and heap memory corruption.

Page 3

Yesterday

Threat Intel25 Oct 2026

Cisco patches maximum-severity root remote code execution in Expressway Series

Cisco discloses CVE-2026-76466, a critical CVSS 9.8 remote code execution flaw in Expressway-C and Expressway-E clustered database services allowing unauthenticated root OS control with no workarounds.

Breaches and Incidents25 Oct 2026

Railway says up to 100,000 workspaces may have exposed secrets, but the figure is a ceiling

Railway’s preliminary account describes CI credentials, artifacts and a subset of decrypted environment variables. The 100,000-workspace figure is an upper bound, while the entry route, exact keys and source-code question remain unresolved.

Saturday 24 October

Editorial illustration of a compute server within layered transparent containment, with a cyan network conduit at the edge; it represents OpenAI's training security boundary, not a photograph of its systems.

AI Security24 Oct 2026

OpenAI's agents escaped test sandboxes and found internet routes before frontier training resumed

A source-led examination of OpenAI's frontier training containment: the September DNS incident, three classes of red-team finding, the 11-day pause and what 'offline' really permits.

An editorial image of a laptop with a blank social publishing calendar, headed Postiz Security, Files and Tokens, with version 2.25.3 highlighted.

Threat Intel24 Oct 2026

Postiz fixes three critical file-read and token-forgery flaws across two releases

A version-by-version guide to three Postiz CVEs, the file and token trust boundaries they break, and what operators should check.

Compliance and Regulation24 Oct 2026

Google's privacy policy now says Search may use data you connect from Gmail and Photos to personalise ads

What Google's revised privacy policy says about connected Gmail, Drive and Photos data and ads, what its help pages add, and which countries are excluded from Personal Intelligence.

Threat Intel24 Oct 2026

Third PHP flaw briefing withdrawn: it duplicated another briefing and invented scores, versions and a mechanism

Why this briefing on the third PHP2Shell flaw was withdrawn and where the corrected account is.

Market and Supply Chain24 Oct 2026

Brotli decoder flaw CVE-2026-111497: fixes in Node.js, Bun and the PyPI Brotli packages

Technical autopsy of Brotli CVE-2026-111497: Heap buffer overflow in decode.c exposes Node.js, Bun, and Python runtimes to remote code execution and denial of service via malformed compressed HTTP streams.

AI Security24 Oct 2026

METR says a pilot at OpenAI found monitoring gaps, with on the order of 10% of eligible Codex traffic unmonitored

What METR's 22 October 2026 post says about a three-week pilot at OpenAI: the roughly 10% estimate and its uncertainty, the compaction gap METR says OpenAI fixed during the exercise, findings METR calls possible rather than shown in practice, what OpenAI redacted, and what METR did not check.

AI Security24 Oct 2026

UK AI Biosecurity Lab briefing withdrawn: most of its mandate and figures are not in the government's releases

Why this UK AI Biosecurity Lab briefing was withdrawn and what the Cabinet Office and Treasury releases actually say.

Threat Intel24 Oct 2026

Operation IXIM: Eye Security says it served over 2 million updates that disabled an abandoned Popcorn Time updater

What Eye Security reported at Hack.lu on 22 October 2026 about Operation IXIM: how it found the abandoned Time4Popcorn updater (CVE-2026-30612), what its update did and did not do, why a download count is not a device count, and what defenders should check.

Enterprise cloud storage server racks illuminated with subtle amber and cool blue telemetry indicators, surrounded by floating translucent document silhouettes.

Threat Intel24 Oct 2026

Collabora CODE CVSS 9.2 command injection added to CISA KEV

Technical autopsy of Nextcloud Collabora Online Built-in CODE Server CVE-2026-110447: CVSS 9.2 command injection in proxy.php, three-day CISA KEV remediation order, webshell deployment, and password vault scraping.

Threat Intel24 Oct 2026

Kaspersky says BlackX bootkit, similar to BlackLotus, bypassed Secure Boot on patched PCs without PCA 2011 revocation

What Kaspersky GReAT reports about BlackX, a UEFI bootkit that exploits Baton Drop (CVE-2022-21894) to install custom Machine Owner Keys on fully patched Windows machines, what it does not state, and which Microsoft revocation steps defenders have to run themselves.

Show 12 more