The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 253 to 276 of 658 briefings

Monday 5 October

A dark server room with a black rack of four plain servers and, on a rolling cart in front of it, an open laptop whose screen shows a list of six blank rounded pills and a hollow amber padlock outline, to suggest a certificate list with nothing issued yet.

Market and Supply Chain5 Oct 2026

Cloudflare's post-quantum CA has issued nothing yet, and it targets authentication, not recorded traffic

What Cloudflare, Chrome, Apple, Microsoft, Mozilla, the IETF and the NCSC have said about post-quantum certificates, what is still a draft, what the GlobalSign deal covers, and a UK checklist in the order worth doing.

A matte black laptop on a dark desk, its screen showing a social feed made only of blank rounded cards and empty pills, with a thin hollow amber padlock outline beside the feed, to suggest a lock that is drawn but not engaged.

Breaches and Incidents5 Oct 2026

Microsoft's X account: two unauthorised posts, 47 minutes apart by our arithmetic, and no word on the cause

Microsoft's 13-million-follower X account carried a disclaimer that told readers to trust only official channels, and Microsoft says it did not write it. The minutes, what is not stated, five routes in, and a UK checklist.

A free-standing cash machine at night in a dark shopfront, seen from a low three-quarter angle: its screen lit with blank rounded pills and the large hinged service panel on its upper cabinet shut and locked with a small round lock. The left side of the picture is empty darkness carrying the headline.

Threat Intel5 Oct 2026

$40.73M over 1,500+ ATM attacks is at most about $27,000 each, and the charged route starts at the cabinet door

Divide Treasury's headline loss by its own attack count and the average is at most about $27,000. The DOJ, FBI and ATM makers all put the real control at the cabinet door, the keys, the alarm response and the disk, not at the arrest.

A dark corridor with a wall-mounted digital signage display showing only blank empty panels, a small black PC box fixed to the wall beside it, and a laptop on a trolley showing a task list of six empty rows, one outlined in amber.

Threat Intel5 Oct 2026

A Samsung signage flaw at least 476 days old led to AnyDesk on try three and a miner built on the host

At least 476 days between the CVE record and the incident, three AnyDesk download attempts, eight days between two reports on one endpoint. What Huntress states, what it does not, and the order of checks for signage servers.

AI Security5 Oct 2026

OpenAI to test ads during ChatGPT image generation in the US; its free no-ads option has no image tools

OpenAI will test ads during ChatGPT image generation, in the US, later in October. A read of its ads pages and policies, and of ICO, ASA and CMA guidance, sets out what is stated, what is not, and what a UK organisation should check.

A small router and a small CCTV recorder on a bare shelf in a cupboard, with a laptop in front showing an empty list of blank rows and one hollow slot.

Threat Intel5 Oct 2026

Cling botnet poses as STUN traffic, but gets in through flaws catalogued up to 4,175 days ago

A Linux botnet dresses its command traffic as STUN, the NAT-traversal protocol behind video calls, but it gets in through flaws first recorded between 2015 and 2026. The disguise is the news; the doors are the part a UK security lead can still control.

Threat Intel5 Oct 2026

Dell posted the DSU fix 65 days before it called the flaw critical, and the download says Optional

The lead flaw is scored Network with no privileges, so it is not a local escalation by Dell's own scoring, but all five need user interaction Dell never explains. One fix, no workaround, nothing on exploitation.

Editorial illustration for the briefing: Android 17's accessibility lock works only if the user turns Advanced Protection on; no uptake figure found

Threat Intel5 Oct 2026

Android 17's accessibility lock works only if the user turns Advanced Protection on; no uptake figure found

Google's accessibility restriction needs three things at once: Android 17, Advanced Protection switched on, and an app that is not a verified accessibility tool. Only the first has a published figure, and it is a third party's estimate.

A quiet newsroom desk at night: an open laptop showing a contact list made only of blank rounded pills, and a plain closed notebook with one amber ribbon beside it. No people, no writing on the screen or the notebook.

Breaches and Incidents5 Oct 2026

About 9,000 spoofed Nikkei emails reached news sources among others; who was exposed is not yet counted

What Nikkei's notices say in Japanese and English, what they leave out, how Japanese and UK law treat the security of data held for journalism, and an ordered checklist for any organisation that holds the names of sources or whistleblowers.

A rack of three servers in a dark equipment room with an engineer's laptop on a flight case in front of it, the laptop screen showing a table of blank request and response slots with two rows outlined in amber.

Threat Intel5 Oct 2026

Cache key injection has a 2020 name, four 2026 lab demonstrations, no CVE and no named victim

A research technique, not an exploited flaw: what the write-up states, how Kettle's 2020 paper named the same bug class, what five vendors' documents say about how keys are joined, and a UK checklist for cached personalised pages.

Breaches and Incidents5 Oct 2026

Frontline's breach letters were first reported 48 days after it found the flaw, and name no software

A supplier to US school districts found a flaw on 14 August and was first reported notifying districts on 1 October, 48 days later. Staff Social Security numbers were taken; the product, the counts and the actor are not stated.

A dark government records room: an open laptop on a wooden desk shows a table of blank rounded rows beside a black server rack with a few indicator lights, and a shelf of identical blank grey ring binders sits behind. The headline reads Denmark's population register: 8.8 million of 11 million entries reached through one company, with the figure about 80 per cent.

Breaches and Incidents5 Oct 2026

Denmark says one company's lawful access reached 8.8 million of the 11 million entries in its CPR register

About 80 per cent of the register, more than the population, reached through one company's lawful access. What the ministry and Datatilsynet state, what CPR's own terms say about controls, and the checks a UK team can run.

Page 23

Monday 5 October

AI Security5 Oct 2026

Apple will tighten Full Disk Access for AI agents; its post names no app, no date and no word on MDM

Apple's 177-word post says Full Disk Access will need very explicit user action. It names no app, macOS version or date, and does not mention MDM. Coverage ties it to Meta's Muse, but the columnist says Full Disk Access was off.

A laptop on a dark desk shows an inbox of identical empty message rows, with a tall stack of blank paper beside it, to suggest a flood of reports waiting to be read.

Market and Supply Chain5 Oct 2026

Google paused its OSS bug bounty for product flaws over a surge it has not quantified; last figure: 192 in 2025

What Google paused and what it left open, three narrowings in 196 days, the wording that moved from AI-generated to automated, a Stated and Not stated table, and what a UK organisation with a small disclosure programme should do when automated reports arrive.

A racked server in a dark equipment room with a laptop on a steel trolley in front of it, the laptop showing a mailbox list of blank rows with one row picked out in a thin amber outline. A network cable runs from the server to the laptop.

Threat Intel5 Oct 2026

Microsoft shipped September's Exchange update twice, 24 days apart, and only the second fixes CVE-2026-96940

The first September update is listed as affected, one of nine CVEs is rated Exploitation More Likely, and the cloud fix has no date. What the record states, what it leaves out, and a UK checklist.

AI Security5 Oct 2026

OpenAI's safety-report lead says its culture is broken. The reports cannot show whether it is

A system card is the developer's own document about its product, so it cannot test the culture behind it. What OpenAI's pages, METR and the UK bodies establish about the claim, the pause, the shelved model and three other departures, and what to ask a vendor.

A dark bank back-office after hours: a laptop open on an incident board of blank rounded tiles, a row of them hollow amber outlines, in front of a closed server rack, with an empty banking hall visible through a glass wall.

Breaches and Incidents5 Oct 2026

Korea's bank breaches: AI use is unconfirmed on the record, and the faults described are old ones

Shinhan, KB Kookmin and Hana name about 25,000, 99 and 89 customers. The AI-tool claim rests on a vendor researcher's page-title reading and an anonymous official; on the record it is 'cannot be ruled out'. What is stated, what is not, and a UK checklist.

A general practitioner's consulting-room desk at night: an open laptop shows a patient-records table drawn as rows of blank pills, with a plain stethoscope coiled beside it and an examination couch dim in the background.

Compliance and Regulation5 Oct 2026

Italy fines IQVIA €7 million after finding its 'anonymous' database of one million patients was not

A €7.00-a-head fine, one patient on 34 rows, and a patient code that followed people for years. What the Garante stated, what it did not, why the SRB defence failed, and what a UK data protection lead should check.

A dark desk with a monitor showing a blank statistics dashboard of empty rounded tiles and two plain bars beside one hollow amber outline, and a closed navy statute book with blank paper page flags in front of it. No people and no writing.

Compliance and Regulation5 Oct 2026

IWF: 6,310 AI child sexual abuse images assessed in six months, 40% above all of 2025

What 6,310 against 4,512 counts and cannot show, why six months set against twelve flatters nothing and hides nothing, which UK legal tools are in force today, and a checklist for anyone who builds, hosts or deploys image tools.

Sunday 4 October

A racked network appliance in a dark equipment room, with an engineer's laptop on a case in front of it showing a status board of blank tiles, one drawn as a hollow amber outline to suggest a service that has dropped out.

Threat Intel4 Oct 2026

CISA lists a third exploited NetScaler flaw seven days after two others, and Citrix calls it denial of service

A third NetScaler flaw in seven days, scored 8.7 against 9.5 for the first two. What the record states, what it leaves out, why denial of service is not the mild category on a gateway, and where the word patched stops being true.

A dark finance desk at night. A wide monitor shows a payment approval page made only of blank rounded shapes, with one solid indigo button. In the foreground a small plain USB hardware token sits plugged into an unmarked aluminium hub on a walnut desk.

Threat Intel4 Oct 2026

SConnect was fixed in the app stores 55 days before its CVE, but the desktop host is a separate install

The SConnect token middleware was fixed in the browser stores on 7 August and given a CVE on 1 October. SWIFT's notice says the extension updates itself but the desktop host does not. CISA's coordinator recorded no exploitation on 2 October.

Editorial illustration for the briefing: Fortra's BoKS 9.9 advisory names no fixed version, and the update does not secure passwords already generated

Threat Intel4 Oct 2026

Fortra's BoKS 9.9 advisory names no fixed version, and the update does not secure passwords already generated

The advisory page for BoKS CVE-2026-79901 names no affected version and no fix. The CVE record names both, says the update leaves existing AD service-account passwords unsafe, and gives no 8.1 fix. What is stated, what is not, and what UK teams should do.

A server rack holding a plain one-unit network appliance with a blank front panel, and in front of it a laptop showing a process list made of empty pills, with one identical pair outlined in teal.

Threat Intel4 Oct 2026

Linux implants copy mail appliance names and port 25 traffic. Rapid7's 12 hashes do not say how they got in

Rapid7's 2 October report lists 12 hashes for Linux implants that imitate Korean and Taiwanese mail security appliances, with a payload file that exists for ten seconds. Entry route, victims, first-seen dates and UK exposure are not stated.

AI Security4 Oct 2026

A Featured ad blocker's server returned 40 programs on the day researchers asked; 23 target AI chats

Bay Area Labs counts 23 of 40 server-delivered programs aimed at AI chats in a Featured Chrome ad blocker. The vendor's privacy policy names AI Data; the store listing does not mention AI chats.

Show 12 more