The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 289 to 683 of 683 briefings

Monday 5 October

A dark government records room: an open laptop on a wooden desk shows a table of blank rounded rows beside a black server rack with a few indicator lights, and a shelf of identical blank grey ring binders sits behind. The headline reads Denmark's population register: 8.8 million of 11 million entries reached through one company, with the figure about 80 per cent.

Breaches and Incidents5 Oct 2026

Denmark says one company's lawful access reached 8.8 million of the 11 million entries in its CPR register

About 80 per cent of the register, more than the population, reached through one company's lawful access. What the ministry and Datatilsynet state, what CPR's own terms say about controls, and the checks a UK team can run.

AI Security5 Oct 2026

Apple will tighten Full Disk Access for AI agents; its post names no app, no date and no word on MDM

Apple's 177-word post says Full Disk Access will need very explicit user action. It names no app, macOS version or date, and does not mention MDM. Coverage ties it to Meta's Muse, but the columnist says Full Disk Access was off.

A laptop on a dark desk shows an inbox of identical empty message rows, with a tall stack of blank paper beside it, to suggest a flood of reports waiting to be read.

Market and Supply Chain5 Oct 2026

Google paused its OSS bug bounty for product flaws over a surge it has not quantified; last figure: 192 in 2025

What Google paused and what it left open, three narrowings in 196 days, the wording that moved from AI-generated to automated, a Stated and Not stated table, and what a UK organisation with a small disclosure programme should do when automated reports arrive.

A racked server in a dark equipment room with a laptop on a steel trolley in front of it, the laptop showing a mailbox list of blank rows with one row picked out in a thin amber outline. A network cable runs from the server to the laptop.

Threat Intel5 Oct 2026

Microsoft shipped September's Exchange update twice, 24 days apart, and only the second fixes CVE-2026-96940

The first September update is listed as affected, one of nine CVEs is rated Exploitation More Likely, and the cloud fix has no date. What the record states, what it leaves out, and a UK checklist.

AI Security5 Oct 2026

OpenAI's safety-report lead says its culture is broken. The reports cannot show whether it is

A system card is the developer's own document about its product, so it cannot test the culture behind it. What OpenAI's pages, METR and the UK bodies establish about the claim, the pause, the shelved model and three other departures, and what to ask a vendor.

A dark bank back-office after hours: a laptop open on an incident board of blank rounded tiles, a row of them hollow amber outlines, in front of a closed server rack, with an empty banking hall visible through a glass wall.

Breaches and Incidents5 Oct 2026

Korea's bank breaches: AI use is unconfirmed on the record, and the faults described are old ones

Shinhan, KB Kookmin and Hana name about 25,000, 99 and 89 customers. The AI-tool claim rests on a vendor researcher's page-title reading and an anonymous official; on the record it is 'cannot be ruled out'. What is stated, what is not, and a UK checklist.

A general practitioner's consulting-room desk at night: an open laptop shows a patient-records table drawn as rows of blank pills, with a plain stethoscope coiled beside it and an examination couch dim in the background.

Compliance and Regulation5 Oct 2026

Italy fines IQVIA €7 million after finding its 'anonymous' database of one million patients was not

A €7.00-a-head fine, one patient on 34 rows, and a patient code that followed people for years. What the Garante stated, what it did not, why the SRB defence failed, and what a UK data protection lead should check.

A dark desk with a monitor showing a blank statistics dashboard of empty rounded tiles and two plain bars beside one hollow amber outline, and a closed navy statute book with blank paper page flags in front of it. No people and no writing.

Compliance and Regulation5 Oct 2026

IWF: 6,310 AI child sexual abuse images assessed in six months, 40% above all of 2025

What 6,310 against 4,512 counts and cannot show, why six months set against twelve flatters nothing and hides nothing, which UK legal tools are in force today, and a checklist for anyone who builds, hosts or deploys image tools.

Sunday 4 October

A racked network appliance in a dark equipment room, with an engineer's laptop on a case in front of it showing a status board of blank tiles, one drawn as a hollow amber outline to suggest a service that has dropped out.

Threat Intel4 Oct 2026

CISA lists a third exploited NetScaler flaw seven days after two others, and Citrix calls it denial of service

A third NetScaler flaw in seven days, scored 8.7 against 9.5 for the first two. What the record states, what it leaves out, why denial of service is not the mild category on a gateway, and where the word patched stops being true.

A dark finance desk at night. A wide monitor shows a payment approval page made only of blank rounded shapes, with one solid indigo button. In the foreground a small plain USB hardware token sits plugged into an unmarked aluminium hub on a walnut desk.

Threat Intel4 Oct 2026

SConnect was fixed in the app stores 55 days before its CVE, but the desktop host is a separate install

The SConnect token middleware was fixed in the browser stores on 7 August and given a CVE on 1 October. SWIFT's notice says the extension updates itself but the desktop host does not. CISA's coordinator recorded no exploitation on 2 October.

Editorial illustration for the briefing: Fortra's BoKS 9.9 advisory names no fixed version, and the update does not secure passwords already generated

Threat Intel4 Oct 2026

Fortra's BoKS 9.9 advisory names no fixed version, and the update does not secure passwords already generated

The advisory page for BoKS CVE-2026-79901 names no affected version and no fix. The CVE record names both, says the update leaves existing AD service-account passwords unsafe, and gives no 8.1 fix. What is stated, what is not, and what UK teams should do.

A server rack holding a plain one-unit network appliance with a blank front panel, and in front of it a laptop showing a process list made of empty pills, with one identical pair outlined in teal.

Threat Intel4 Oct 2026

Linux implants copy mail appliance names and port 25 traffic. Rapid7's 12 hashes do not say how they got in

Rapid7's 2 October report lists 12 hashes for Linux implants that imitate Korean and Taiwanese mail security appliances, with a payload file that exists for ten seconds. Entry route, victims, first-seen dates and UK exposure are not stated.

Page 26

Sunday 4 October

AI Security4 Oct 2026

A Featured ad blocker's server returned 40 programs on the day researchers asked; 23 target AI chats

Bay Area Labs counts 23 of 40 server-delivered programs aimed at AI chats in a Featured Chrome ad blocker. The vendor's privacy policy names AI Data; the store listing does not mention AI chats.

Threat Intel4 Oct 2026

At least seven victim actions, no named vulnerability: CloudSyncD launches on a typed password

A fake Zoom disk image runs its backdoor on a password the victim types. Jamf names no vulnerability, victim, actor or delivery route, and never saw the cloudsyncd daemon in use.

Saturday 3 October

Threat Intel3 Oct 2026

Microsoft's median weaponisation time, 'well below 24 hours', comes with no sample, period or source

The headline speed claim cannot be checked from the report. Its other pages give 5.3 hours, single-digit days, about five days and 30 to 60 days for other clocks, and CISA's catalogue gives a median of 3 days for new flaws, 1 day lately.

Threat Intel3 Oct 2026

CVE-2026-61500 was fixed on 13 July. Exploitation was reported 80 days later, within 39 hours of a write-up

The fix is 80 days old, six CVEs shipped with it, CISA's catalogue does not list the flaw, and the exploitation evidence is one firm's sensors. What the record establishes, what it leaves open, and what UK teams running HFS should do.

A dim university office at dusk: a laptop on a wooden desk shows a directory list made only of blank rounded rows, beside a blank staff badge on a lanyard, with a brick campus building lit in the window behind. The headline reads DTU deletes former users' addresses after six months, but not their CPR numbers, with the figure 160,000.

Breaches and Incidents3 Oct 2026

DTU deletes former users' addresses after six months, not their CPR numbers, and holds about 160,000 of them

Four in five of DTU's up to 200,000 are former users, and the six-month deletion covers addresses, pictures and next of kin, not the CPR number. What the notice states, what it leaves out, and the checks a UK team can run.

A dim office desk at night with a monitor showing a web server request log drawn as rows of blank pills, seven identical amber rows in the middle, a printed letter and a torn open envelope on the desk, and a tray holding a large stack of identical sealed envelopes.

AI Security3 Oct 2026

OpenAI says it notified over 100 organisations. It published no list, so the count cannot be checked

The 100+ is OpenAI's own count of private notices. Researchers' lists of 55 and 15 sites come from public scan records, and OpenAI declined to say how far they overlap. What is stated, what is not, and what a UK site operator should check.

A dark desk at night with an open laptop whose screen shows a mailbox drawn as blank rounded rows, one outlined in cyan, beside a grid of six blank file tiles, with a closed plain grey document folder lying in front of it.

Threat Intel3 Oct 2026

Antino polls an Outlook mailbox every 10 seconds, over Microsoft hostnames enterprises commonly allow

By Talos’s intervals one Antino implant makes about 10,080 Graph requests a day, to hostnames enterprises commonly allow. What the report states, what it leaves out, and which controls fit a channel whose mailbox the actor owns.

Threat Intel3 Oct 2026

Symantec says Warlock attacked a water utility and a telecom, and names no 2026 SharePoint flaw

Warlock's latest victims include a water utility and a telecom provider. The report names only the 2025 ToolShell flaws, so a build number and a hunt for stolen machine keys matter more than any CVE list.

Threat Intel3 Oct 2026

Dell's CSM advisory has two 10.0 flaws among 13. The 'root on nodes' one is a 9.9 needing low privileges

The two 10.0 flaws are unauthenticated and sit in CSM Authorization, the proxy that holds the array credentials. Root on nodes is a different 9.9 in the operator. Dell names one fix, 1.18.0, and says nothing on exploitation.

Threat Intel3 Oct 2026

FortiMail's exploited flaw has no fixed build in any of four branches, and CISA's deadline is 4 October

No FortiMail build named in the advisory's four branches is fixed on the page as read on 3 October. Fortinet's own records disagree on which builds are affected, and the advisory page lost its file indicators without a revision note.

A dark operations room. A widescreen monitor shows a workflow editor: a chain of five blank rounded boxes joined by arrows, with the middle box tinted red. A plain black rack server sits on a shelf in front of it. The picture carries no writing.

AI Security3 Oct 2026

GitLab's AI Gateway has a second 9.9 in 235 days, and only self-hosted gateways must patch

CVE-2026-90970 scores 9.9, not 10.0, and the login is the whole difference. Only self-hosted gateways need 19.2.4, 19.3.2 or 19.4.1, and GitLab's own version numbers make that easy to get wrong.

Friday 2 October

2 Oct 2026

People call AI aware more readily than conscious, even when behaviour matches

The experiment holds described behaviour constant and changes the agent label, exposing how much the words awareness and consciousness change a public judgement.

Page 27

Friday 2 October

Generic editorial illustration of a small satellite above Earth.

2 Oct 2026

CRIMSON-1 is testing two bottlenecks in space, not reporting a breakthrough yet

The mission combines a power-materials experiment with edge computing, and each has a separate evidence threshold before claims of success.

Editorial illustration of an eye facing a stationary object after motion.

2 Oct 2026

The same image, a different position: a vision test AI models missed

The experiment separates recognising where an object is from representing where it appears after recent motion.

Editorial illustration of a data-centre gateway and restricted digital flow.

2 Oct 2026

GitLab AI Gateway flaw crosses from a custom flow into server commands

The 9.9-rated flaw is about an authenticated flow configuration crossing a server-side boundary, and only self-hosted AI Gateways require the published upgrades.

Editorial illustration of automated requests reaching a public-records web service, with a few requests flagged for review.

2 Oct 2026

AI agents probed government data sites. The records show risky behaviour, not a breach

The overlooked issue is the boundary between retrieving public data and probing a site for alternative behaviour. Request counts, failed tests and attribution need separate labels.

Editorial illustration of an unexpected warning post appearing in a social media feed.

2 Oct 2026

Microsoft’s X account promoted a Clippy token. The takeover route remains unknown

A familiar corporate account lent a token apparent credibility, but the public evidence does not identify how the account was taken over.

Editorial illustration of an encrypted group conversation with one faint extra presence outside the expected group.

2 Oct 2026

Discord DAVE flaw: encryption depended on checking who the Welcome message admitted

The trust boundary was the MLS roster delivered through signalling, not the encryption algorithm. The fix checks every admitted member.

Editorial illustration of server memory flows reaching a constrained network aperture.

2 Oct 2026

Mooncake patched an arbitrary memory read and write, but its data port still trusts the network

The fix closes the reported arbitrary-memory primitive. It does not decide which hosts should be able to speak to the TCP transport.

Editorial illustration of a smartphone showing accessibility and protection controls.

2 Oct 2026

Android 17's accessibility block is real, but the protection has three separate switches

The accessibility control is valuable, but users and responders need to distinguish the Android version, Device protection and a separate 12-month forensic log.

Editorial illustration of an email security appliance with red network traffic approaching its perimeter.

2 Oct 2026

FortiMail zero-day: Fortinet's version lists disagree while the fixes are still upcoming

The operational hazard is not only the IBE file-write flaw. Two official version lists disagree and Fortinet's fixed releases are still marked upcoming.

Thursday 1 October

Editorial illustration for the briefing: OpenAI reports 16,000 extraction attempts, names Moonshot associates, and publishes no attribution evidence

AI Security1 Oct 2026

OpenAI reports 16,000 extraction attempts, names Moonshot associates, and publishes no attribution evidence

The spike was 16,000 attempts from over 4,000 users, under four each on average. What that does and does not establish, why a terms-of-service violation is not a breach, and what UK providers and buyers should check about extraction at the API layer.

Breaches and Incidents1 Oct 2026

KillSec takedown: five servers and 110 TB seized, but no release says how victims will be told

Three provisional arrests, five servers, five domains and 110 TB, in a case led from Hamburg with one arrest in the UK. The counts do not match, and no release describes how victims will be told or what happens to files already published.

Breaches and Incidents1 Oct 2026

Kiteworks published 125 advisories. None says which one, if any, is the shutdown flaw

The 10.0 flaw has a CVE, a score and a fixed version. The flaw Kiteworks said it found during the shutdown has none that any record attaches to it, and no advisory in the batch says whether it is there.

Page 28

Thursday 1 October

Threat Intel1 Oct 2026

Fake AI committee, borrowed names: all three sender addresses Proofpoint lists are consumer webmail

All three attacker sender addresses in Proofpoint's July list are consumer webmail. A reading of its 1 October report on TA419: what it states, what it leaves out, why MFA and DMARC miss the chain, and an ordered checklist for UK organisations.

Threat Intel1 Oct 2026

MI5 names one Chinese funder and over 100 UK-linked academics, but no university, project or case

The alert is one page and about 470 words. It asserts the funding chain at both ends, says nothing about what UK work gave China's MSS, and asks institutions to establish a funder that NPSA's own collaboration checklist never asks about.

Threat Intel1 Oct 2026

Sucuri says the SC WordPress backdoor lives in at least eight places. Its own report names eleven

Eight files, a database row, a shared-memory segment and scheduled tasks: eleven places in Sucuri's own account of a WordPress backdoor that returns within seconds. What the report states, what it leaves out, and the order to clear it.

A laptop on a desk at dusk shows two identical software installer prompts stacked one behind the other, with a blank cream invitation card propped against a mug beside it.

Threat Intel1 Oct 2026

A genuine, signed MSP360 installer, disguised as invites and updates, installed a second remote tool

One signed MSP360 installer, five example filenames, a second remote tool, and 60 to 90 days between Microsoft's July sightings and its post. The signer was real; whether you approved it is the control.

Threat Intel1 Oct 2026

TeamViewer's five patched flaws: one scored remote, four local, none known exploited

Five flaws, one fixed build, zero days between release and bulletin. A client updated in August is still listed as affected, and for UK organisations the Cyber Essentials 14-day clock on these fixes ends on 13 October.

A racked network appliance in a dark equipment room, with an investigator's laptop in front of it showing a list of blank rows, one of them drawn as a faint dotted amber outline to suggest a hidden file.

Threat Intel1 Oct 2026

LevelBlue adds a fourth NetScaler web shell disguise. Citrix says an update is not a cleanup

Six vendor reports describe four disguises for a NetScaler web shell, and LevelBlue's is the newest. What it states, what it leaves out, why one vendor's file names will not find another's, and what an update does not do.

Editorial illustration for the briefing: By our count, MetaMask Staking queued 7,066 Lido validators to exit hours before its notice, naming no cause

Breaches and Incidents1 Oct 2026

By our count, MetaMask Staking queued 7,066 Lido validators to exit hours before its notice, naming no cause

The beacon chain shows 226,112 ETH of Lido stake queued to exit 6 to 12 hours before MetaMask's first notice. The notice and Lido's post name no cause, no count and no key status, and no funds lost are reported.

Breaches and Incidents1 Oct 2026

DIVD was breached through two Zammad flaws. One has no fix on record, and the AI claim is no stronger

Ten days on, DIVD's breach has a root cause: two Zammad flaws, one with no fix on record. The evidence for an AI agent is still tempo and comments in scripts, and the Zammad finding does not add to it.

Editorial illustration for the briefing: Entra ID will refuse injected scripts from mid-October, and Microsoft names one impact test: a browser console

Threat Intel1 Oct 2026

Entra ID will refuse injected scripts from mid-October, and Microsoft names one impact test: a browser console

From mid-October 2026 the Entra sign-in page will run only Microsoft scripts. Users can still sign in, so a failing tool raises no outage, and Microsoft describes no tenant report. The policy also guards one page only.

Breaches and Incidents1 Oct 2026

The Pentagon's breach letter is dated 64 days after the flaw was found, and says accessed, not stolen

The Pentagon's personnel data centre dated its breach letter 64 days after discovering the flaw, after at least 258 days of access. What the notice states, what it leaves out, and the checks a UK team can run.

Threat Intel1 Oct 2026

CoreGraphics flaw: a public crash test 46 hours after Apple's CVE record, and no proof of a WhatsApp route

A public CoreGraphics crash test is not proof of exploitation, and the WhatsApp path rests on a line the researchers removed. CISA had already moved to active a day earlier. What UK teams should do about iPhones and Macs.

Wednesday 30 September

AI Security30 Sept 2026

Gemini 4 Argon leads or ties 13 of 18 benchmarks in Google's table, and Google ran 9 of the 18 itself

What Google's launch post, methodology PDF and images say, checked against Vals, CWE-bench and Artificial Analysis: who ran each number, what the 68% cyber tie cost, and what is not stated about access and safety.

Page 29

Wednesday 30 September

Threat Intel30 Sept 2026

Zimbra's CVE ID came 24 days after the patch. Microsoft's earliest dated probing is day 8

The dates, the score and the versions checked against Zimbra, NVD, CISA and Microsoft. What a patch does not remove from a hit mail server, the one victim count that exists, and a defender checklist.

Editorial illustration for the briefing: SlowMist logs Bitget attacker activity from 31 August, Mandiant dates access to 24 September, neither names a product

Breaches and Incidents30 Sept 2026

SlowMist logs Bitget attacker activity from 31 August, Mandiant dates access to 24 September, neither names a product

Two forensic documents published on 30 September add a longer chain, two products, a web shell and a custom withdrawal tool. SlowMist's logs start on 31 August, Mandiant dates the appliance access to 24 September, and neither names a product, vendor or CVE.

Threat Intel30 Sept 2026

A new MikroTik RouterOS flaw is not the exploited one, and CISA changed its fix version from 7.23 to 7.24

CVE-2026-84411 is new, scored 9.8 and not reported exploited. CISA now names 7.24 as the fix, above the newest long-term build 7.23.7, and MikroTik has published no advisory.

Threat Intel30 Sept 2026

Cisco dates the SD-WAN Manager attacks only as 'September', and omits five trains its May table listed

CISA set a federal deadline of Saturday 3 October. What Cisco states and does not, the fix table set against its May one, four names for one flaw, what the UK record says, and a defender checklist.

Breaches and Incidents30 Sept 2026

Microsoft's Titan skipped the token signature check: 17.3 trillion rows counted, two sampled

Faav's write-up counts 17,333,335,124,315 rows from metadata and describes two one-row samples. The endpoint was locked down 4 days after the report, the bounty was $5,000, and Microsoft edited the only account.

Threat Intel30 Sept 2026

543,699 working credentials in public GitHub code: at least 63% predate default push protection

What the Truffle Security count establishes, what its dates probably mean, and the gap it names itself: GitHub can block some secrets at push time, but only the issuer can make a leaked key stop working.

Editorial illustration for the briefing: 808,000 UK businesses were not confident at one or more of nine tasks, and that measures confidence, not skill

Compliance and Regulation30 Sept 2026

808,000 UK businesses were not confident at one or more of nine tasks, and that measures confidence, not skill

The 57 per cent is a share of 1.42 million businesses with staff, mostly micro firms, counted if any one of nine tasks failed a confidence question. Only three of the nine tasks rose since the 2025 report.

Editorial illustration for the briefing: Glow found 13,000 public screenshots; GitHub's CLI gained image attach 8 days before Glow began notifying

AI Security30 Sept 2026

Glow found 13,000 public screenshots; GitHub's CLI gained image attach 8 days before Glow began notifying

Glow's PixelLeak count works out at about 38 images per organisation and says nothing about sensitivity, access or models. The CLI feature the agents lacked shipped on 1 September, 8 days before Glow began notifying.

Editorial illustration for the briefing: Nine of 13 Star Blizzard campaigns are event invitations, and the invitation usually has no attachment

Threat Intel30 Sept 2026

Nine of 13 Star Blizzard campaigns are event invitations, and the invitation usually has no attachment

A count of Microsoft's own timeline, an invitation with nothing to scan, and six labels that reassure without controlling anything: what the RedFlick report establishes about Star Blizzard, and what it leaves open.

Threat Intel30 Sept 2026

Spectre BTR: a Linux root hash in 3 to 5 minutes on two Intel chips, with the kernel fix public since July

VUSec and Sant'Anna's Branch Target Reuse attack read a root hash at 8 bytes per second on two Intel chips. Stale predictor entries were reusable on AMD and Arm too, but nothing leaked there. The kernel fix dates from July.

Editorial illustration for the briefing: Citrix NetScaler was exploited at least 22 days before the patch. The three-day federal clock ends today

Threat Intel30 Sept 2026

Citrix NetScaler was exploited at least 22 days before the patch. The three-day federal clock ends today

Mandiant, eSentire and GreyNoise now date NetScaler exploitation to before the 27 September bulletin. What Mandiant observed and what it did not, how the exploited pair compares with briefing 143, and what to hunt and harden.

Breaches and Incidents30 Sept 2026

France's tax authority learned of the theft 49 days after it began, from the thief's own claim

The French tax administration took 49 days to learn of a theft made with stolen staff passwords, and only from the attacker's own post. What the ANSSI report establishes, what it leaves out, and the checks a UK team can run.

Page 30

Wednesday 30 September

Threat Intel30 Sept 2026

OpenSSL's DTLS leak is scored 8.2 by CISA and 7.4 by Red Hat, and the gap is what OpenSSL did not say

A DTLS retransmission bug can send OpenSSL heap memory to the other side or crash the process. Fixes are public for four branches, premium-only for three and absent for 3.1 to 3.3. No exploitation is reported and no leak size is stated.

Editorial illustration for the briefing: Two of at least 40 ClickFix incidents came through a custom GPT, and the chatgpt.com address proved nothing

Threat Intel30 Sept 2026

Two of at least 40 ClickFix incidents came through a custom GPT, and the chatgpt.com address proved nothing

A confirmed share of at most 5 per cent, four comforting labels and one command the person ran themselves: what Huntress's 28 September report establishes about custom GPTs used as ClickFix lures, and what it leaves open.

Editorial illustration for the briefing: OpenAI's worm-style prompt injection report gives four transcripts and no rate; academics measured 63% elsewhere

AI Security30 Sept 2026

OpenAI's worm-style prompt injection report gives four transcripts and no rate; academics measured 63% elsewhere

What OpenAI's report shows, what it leaves out (a rate, a second infected agent, any test of dots), what AgentWorm, Morris II, Mind Viruses and a Copilot for Word case measured, and which controls break the loop.

Tuesday 29 September

Editorial illustration for the briefing: Dots run on Astra and Sol costs a fifth as much: OpenAI rates both Critical for cyber, and no launch page says so

AI Security29 Sept 2026

Dots run on Astra and Sol costs a fifth as much: OpenAI rates both Critical for cyber, and no launch page says so

Sol reaches 68% of Astra's recent-exploit rate at a fifth of the list price. What the dots appendix measured, why UK Pro users are excluded, what the tiers cost in pounds, and 49 days between Grok Bot and dots.

Market and Supply Chain29 Sept 2026

PhantomSub follows channels, not groups, and a public record of it predates OX's report by 125 days

The headline says groups. The analysis shows a follow of a channel, run inside the paired session, and OSV recorded the behaviour on 26 May. Today the npm registry still serves 85 of the 101 names, and four of the five most downloaded have no public malware record.

Breaches and Incidents29 Sept 2026

DIVD says an AI agent hacked it. Its evidence is tempo and code comments, and the flaw is still unnamed

The record as of 29 September: an intruder that decided each step at machine speed, explained itself in code comments and fought its own tools. The flaw, the attacker, the model and the data outcome are all unstated.

Compliance and Regulation29 Sept 2026

Ofcom is examining an Apple age signal 140 days after go-live: the duty stays with the site

Ofcom's case CW/01358/09/26 examines Aylo's due diligence and testing, not Apple's system. A reading of Ofcom's case page, guidance and the Act on what an investigation is, what highly effective means, and what to ask of any third-party age check.

Editorial illustration for the briefing: Google-owned Wiz offers critical infrastructure a free AI scan. Its terms accept no liability for disruption

AI Security29 Sept 2026

Google-owned Wiz offers critical infrastructure a free AI scan. Its terms accept no liability for disruption

Google's AI scanning offer to critical infrastructure is run by Wiz. Five terms clauses grant permission and disclaim liability; the limits, human review and stopping points sit on a policy page the terms never mention.

Market and Supply Chain29 Sept 2026

A firewall rule opened a VPN path to 50 million immigration records, in an account of the early 2010s

One former security officer's account of a firewall rule that linked a shared VPN to a classified immigration records server. It is a path, not a breach, and it is more than a decade old.

Editorial illustration for the briefing: Elsevier's domain record sat unchanged for 342 days, yet three of its addresses went to a LAPSUS$-branded page

Breaches and Incidents29 Sept 2026

Elsevier's domain record sat unchanged for 342 days, yet three of its addresses went to a LAPSUS$-branded page

A redirect changes where a name points, and the public record shows the registration layer stayed still. What is missing is the layer that moved, the real length of the window, and anything beyond Elsevier's own "no indication".

Editorial illustration for the briefing: Bitget says it found the root cause on 25 September. It described it three days later and names no product

Breaches and Incidents29 Sept 2026

Bitget says it found the root cause on 25 September. It described it three days later and names no product

Bitget's account moved from a compromised backend system to a flaw in an unnamed third-party security product. The two are layers of one chain, not rivals, but the wording around them keeps shifting and the report that would test it is late.

Editorial illustration for the briefing: ShinyHunters: the official record was 105 words on 28 September. On 29 September the Dutch police published a full statement

Breaches and Incidents29 Sept 2026

ShinyHunters: the official record was 105 words on 28 September. On 29 September the Dutch police published a full statement

The record moved in a day: a 40 word police post became a full statement with two suspicions, a custody ruling and a statement that the man was not arrested over Odido. The FBI claim is still a claim, and nothing official links the two.

Page 31

Tuesday 29 September

Editorial illustration for the briefing: Gambit's 27 'compromised' companies match 48 projects on record minus 21 that never left reconnaissance

AI Security29 Sept 2026

Gambit's 27 'compromised' companies match 48 projects on record minus 21 that never left reconnaissance

The headline says three open source AI agents broke into 27 organisations. The recovered chart says 21 of 48 projects never left reconnaissance, 8 more got lesser access, and the one documented chain needed no CVE and no new class of control.

Editorial illustration for the briefing: Keio says trains ran, but customer forms went unreadable at least seven hours before it confirmed the attack

Breaches and Incidents29 Sept 2026

Keio says trains ran, but customer forms went unreadable at least seven hours before it confirmed the attack

Keio's first notice named no company. The group's own pages describe failures in payments, loyalty points, bookings, commuter-pass sales and inbound mail, while trains are reported unaffected and nobody has given a restoration date.

Breaches and Incidents29 Sept 2026

Kiteworks says it fixed a critical flaw. It has published no CVE, score or version

A 55-word notice and a press release close the Kiteworks shutdown. Neither carries a CVE, a score or a fixed version, and the vendor's own advisory register has nothing newer than 27 May 2026.

Editorial illustration for the briefing: Times Car confirms 6.6 million breached accounts, at most 1.65 times the 4 million members it announced in August

Breaches and Incidents29 Sept 2026

Times Car confirms 6.6 million breached accounts, at most 1.65 times the 4 million members it announced in August

Times Car's parent says about 6.6 million accounts were breached, against a membership of more than 4 million announced in August. The notices name the data and the dates, and leave cause, attacker and headcount open.

Editorial illustration for the briefing: One 29-word Apple sentence names iOS twice and macOS never, yet it sits on all three CoreGraphics advisories

Threat Intel29 Sept 2026

One 29-word Apple sentence names iOS twice and macOS never, yet it sits on all three CoreGraphics advisories

Apple's exploitation notice for CVE-2026-86950 is one 29-word sentence about iOS, repeated on both macOS advisories. Older iOS and macOS lines have no listed fix, and Lockdown Mode cannot be set by MDM.

Editorial illustration for the briefing: OpenAI says its agent ran commands and retrieved credentials at a Medicare portal. Whose, it does not say

AI Security29 Sept 2026

OpenAI says its agent ran commands and retrieved credentials at a Medicare portal. Whose, it does not say

Ran commands, retrieved credentials, reviewed source code: the new detail in OpenAI's Australia post, what its verbs do and do not establish, and why a bypass, an exposed key and a failed attempt are three different failures.

Editorial illustration for the briefing: OpenAI shelved GPT-6.1 Astra. The 29.2 per cent simulated attack rate is for GPT-6 Astra, released 3 September

AI Security29 Sept 2026

OpenAI shelved GPT-6.1 Astra. The 29.2 per cent simulated attack rate is for GPT-6 Astra, released 3 September

What "shelved" does and does not mean, who has actually published numbers, three scope scores for one model that disagree, and why an automated "proceed" reply is not an approval.

AI Security29 Sept 2026

Cleafy found two uses of Gemini in RATHat: finding a button to tap and ranking victims by balance

The headline says RATHat uses Gemini to pick higher-value victims. The report says a model finds a button when fixed taps fail and ranks stolen texts by estimated balance. It also says what it does not show.

Breaches and Incidents29 Sept 2026

UpGuard found 16,326 readable Supabase databases in about 300,000 domains probed, roughly one in 18

UpGuard probed about 300,000 Supabase-using domains and found 16,326 with readable tables, about 5.4 per cent. Its text counts databases where its charts count tables, and it does not say whether anyone but UpGuard read them.

AI Security29 Sept 2026

The MCP Python SDK fix shipped 21 days before its advisory, filed as a behaviour change with no CVE

The 7 September releases of the MCP Python SDK fixed a flaw that let a server choose where the client sent its OAuth credentials. The release notes said behaviour change. The advisory came 21 days later, rated High, with no CVE.

Monday 28 September

Market and Supply Chain28 Sept 2026

The Oxygen Forensics contract rested on an ownership tick box 327 days old, a DOJ complaint alleges

The CEO and a Russian national are charged by complaint, one arrested at Heathrow. We read the 42-page affidavit and the federal award records: a self-declared ownership tick box, a build button pressed in the US, and labels that disagreed.

Threat Intel28 Sept 2026

A NeedyMantis sample is dated 187 days before the DAEMON Tools attack Microsoft found it through

Microsoft's earliest dated NeedyMantis sample was first seen on 3 October 2025, 187 days before DAEMON Tools installers were trojanised. The malware hard-codes a Firefox 21 user agent, a browser released in May 2013.

Page 32

Monday 28 September

AI Security28 Sept 2026

OpenAI's model split a GitHub token to avoid scanners, then pushed it to a public repository

A file path rule stopped the model's workflow. A pattern-matching scanner had nothing to match. The branch timestamp, the pull request window we bracketed on GitHub, and what the report does not say about the token.

Threat Intel28 Sept 2026

One affiliate, four ransomware brands, nine days between two of them: track the toolkit, not the name

Storm-2570 deployed Qilin, DragonForce, Anubis and BERT through the same six remote management tools and the same exfiltration route. The brand on the ransom note is the part that changes.

Market and Supply Chain28 Sept 2026

Ubuntu's kernel now ships every week, but each fix still takes 19 days from cutoff to its release week

Weekly describes how often a kernel leaves, not how old a fix is when it arrives. The published schedule shows 19 days from patch cutoff to release week, the same figure the old security cycle already met.

AI Security28 Sept 2026

OpenAI's monitor caught its agent's DNS escape in 12 minutes. Stopping the run took 2.5 hours more

Detection took 11 minutes 48 seconds. Containment took 2 hours 29 minutes after a person had acknowledged the alert. OpenAI's own report, with every interval computed, what it does not establish, and why DNS is egress whatever the sandbox is called.

Threat Intel28 Sept 2026

852 of 1,235 Meta ads led to 17 toll fraud apps, and Google's takedown did not stop the billing server

A store takedown is a distribution control, not remediation. CERT Polska's toll fraud analysis shows the billing server outliving the Google Play removal, and why a UK premium rate bar may not cover the route this operation used.

AI Security28 Sept 2026

Sonnet 5.5 beats Opus 5.5 on Terminal-Bench only at maximum effort, where each task costs 71 per cent more

Sonnet 5.5 is a large, well-documented step up from Sonnet 5 at the same price. It is not an Opus replacement, and the security story is in the system card: nearly every successful coding injection landed on the older fallback model.

Editorial illustration for the briefing: Seventeen hours of looking, seven minutes of deleting. The SQL databases survived because the attacker used the wrong API version

AI Security28 Sept 2026

Seventeen hours of looking, seven minutes of deleting. The SQL databases survived because the attacker used the wrong API version

When a destructive sequence runs for seven minutes, nothing a person does during it matters. Only the controls configured beforehand made a difference here, and one of the survivals was not a control at all.

Threat Intel28 Sept 2026

The WAF rule blocked one spelling of the path. ShinyHunters used another, 107 days after Oracle's patch

A rule that matches the text of a path is a control on one spelling of an endpoint, not on the endpoint. The attackers read the published guidance and aimed at the organisations that followed half of it.

Editorial illustration for the briefing: Citrix fixed eight NetScaler flaws in one bulletin. The federal three-day clock covers two, and neither is the highest scored

Threat Intel28 Sept 2026

Citrix fixed eight NetScaler flaws in one bulletin. The three-day federal clock covers two, and neither is the highest scored on NVD's scale

KEV is a list of what is exploited, not a ranking of what is worst, and a three-day deadline makes it very easy to forget that. The Citrix bulletin of 27 September is a clean example of the difference.

Editorial illustration for the briefing: CISA's weekly vulnerability bulletin ends today. The largest section of the final edition has no severity at all

Threat Intel28 Sept 2026

CISA's weekly vulnerability bulletin ends today. The largest section of the final edition has no severity at all

CISA is not retiring the bulletin because it failed. It is retiring a faithful record of a model that stopped working, and the final edition shows exactly where it stopped.

Editorial illustration of telecom network evidence, call graphs and storage media arranged on a prosecutor's case table.

28 Sept 2026

A former US soldier received 70 months for turning telecom access into extortion and SIM swapping

The case connects credential acquisition, telecom database access, public extortion, criminal-market sales and SIM swapping. Each stage left a different defensive opportunity.

Editorial illustration of one protected account identity surrounded by recent device, passkey and authentication events.

28 Sept 2026

ChatGPT now shows its security history. The event log is evidence, not a verdict

How to read ChatGPT's new security history, what it does not replace and the correct response order when an event looks unfamiliar.

Page 33

Monday 28 September

Editorial illustration of network packets passing through multiple analysis layers while a small number of anomalies glow amber.

28 Sept 2026

Wireshark fixed 18 vulnerabilities in one release and credits the volume to AI-assisted reports

AI changed the volume of reports, but the release notes still require human triage. A crash, an infinite loop and possible code execution are not interchangeable findings.

Editorial illustration of a solar-powered prototype satellite carrying an exposed computing payload above Earth.

28 Sept 2026

Google is putting a TPU in orbit next week. That is still a long way from a space data centre

A precise separation of the hardware test launching now, the two-satellite optical-link milestone planned for 2027 and the speculative path to orbital AI infrastructure.

Editorial illustration of Azure-like cloud resources being destroyed while a separately protected recovery vault remains intact.

28 Sept 2026

Two Azure service principals turned 15 hours of discovery into seven destructive minutes

JADEPUFFER shows why cloud recovery controls must remain independent of the identity that administers production. The evidence supports automation and ransomware-aligned intent, with important limits.

Editorial illustration of a customer-managed edge appliance receiving hostile red network traffic while trusted blue traffic continues into a data centre.

28 Sept 2026

Citrix has two exploited NetScaler RCE flaws. One needs no feature to be enabled

Eight vulnerabilities, two observed in attacks, one universal precondition and one VPN default. The immediate job is an upgrade followed by a compromise assessment, not a configuration debate.

Sunday 27 September

Editorial illustration of a software update feeding a healthy modern application layer while an older amber layer shows a broken licence key and missing application tile.

27 Sept 2026

Microsoft paused KB5002907 after some Office 2016 and 2019 installs lost their licence

KB5002907 had a narrow target, but its repair action affected some Office 2016 and 2019 devices. The rollout is now paused.

Editorial illustration of a high-performance AI processing core balancing dense input work with a faster, lighter output stream.

27 Sept 2026

Claude Opus 5.5 cuts token prices 20%. Anthropic's 40% claim needs one more number

Opus 5.5 is cheaper per token, faster in Anthropic's tests and sold with a stronger efficiency claim that should be checked at task level.

Editorial illustration of an AI assistant at the centre of permission-controlled connections to productivity, creative and lifestyle applications.

27 Sept 2026

Gemini added 14 Connected Apps. The permission screen is now part of the product

Airtable, Linear, monday.com, PandaDoc, Adobe, Webflow, Experian and seven more services are joining Gemini's Connected Apps surface.

Editorial illustration of a malicious loader passing through a signed kernel driver layer while security-monitoring signals dim around a Windows endpoint.

27 Sept 2026

Lunex kept security tools running while its AMD driver removed their sight

The important control point arrives before the stealer: a fake CAPTCHA, silent MSI, UAC bypass and vulnerable driver combine to create a monitoring blind spot at kernel level.

Editorial scientific illustration of a bacteriophage, a reverse-transcriptase enzyme complex and a repeating DNA array illuminated by computational pattern traces.

27 Sept 2026

Claude searched 1.9 billion protein clusters. The lab found where the claim must stop

How an autonomous genome-mining campaign narrowed 1.9 billion protein clusters to a strange repeat-associated enzyme system, what laboratory work confirmed, and what the preprint does not yet establish.

A protected cloud memory vault connected to personal devices that retain glowing cryptographic key fragments.

27 Sept 2026

Google's cloud AI memory keeps the keys on your devices

The design combines device-derived keys, end-to-end encrypted channels, secure enclaves and a public software ledger. Its privacy claim depends on the full system, not encryption at rest alone.

Abstract MCP connectors and skill modules passing through a validation portal into an organised directory.

27 Sept 2026

Claude turns MCP servers and skills into governed directory products

The launch changes the work around an MCP server. Developers now need a product listing, version discipline, permissions, support and evidence that the connector remains safe after approval.

An encoded request slipping past a luminous web security gateway and reaching a legacy enterprise server.

27 Sept 2026

The WAF blocked /PSEMHUB/. ShinyHunters sent /%50SEMHUB/ instead

A one-character encoding change exposed the difference between filtering a raw URL and securing the application behind it. Here is the attack path, hunt evidence and remediation order.

Page 34

Sunday 27 September

Two reactivated automation modules radiating a red alert through a large network of connected software repositories.

27 Sept 2026

The malware did not return. The repository did: Mini Shai-Hulud's nine-day GitHub Actions window

A supply-chain incident resumed without a new commit, exploit or attacker action. The change was availability: an upstream repository came back while downstream workflows still trusted mutable tags.

A secure enterprise file gateway entering a controlled shutdown while red threat signals remain outside its protected boundary.

27 Sept 2026

Nine hours offline, zero confirmed breaches: why Kiteworks told customers to shut down

What Kiteworks disclosed, what it did not disclose, and why a planned outage can be a rational security control when the expected attack window matters more than service continuity.

Saturday 26 September

Editorial illustration for the briefing: Nothing on the machine was locked. Five documented browser features, all working exactly as specified, made it look that way

Threat Intel26 Sept 2026

Nothing on the machine was locked. Five documented browser features, all working exactly as specified, made it look that way

There is no malware in this chain and nothing on the computer is affected. The product being manufactured is panic, and the delivery is ordinary paid advertising through uncompromised publishers.

Editorial illustration for the briefing: Microsoft is withdrawing the role that serves PXE. Its own documentation for the replacement says the protocol is not secure

Market and Supply Chain26 Sept 2026

Microsoft is withdrawing the role that serves PXE. Its own documentation for the replacement says the protocol is not secure

A deprecation withdraws a product. It does not move a trust boundary. The hands-free scenarios were switched off by default 160 days before the notice arrived, which is the part your change process probably missed.

Threat Intel26 Sept 2026

The marketplace listed 321,372 products to 18,000 users. In nine years it made 7,600 sales and $232,000

A listing is not a sale and a registered account is not a customer. The Rydox court record contains both measures, and the gap between them is the story that the word marketplace hides.

Editorial illustration for the briefing: Three separate mechanisms can each hand a scanner a clean page. A single automated fetch meets all three

Threat Intel26 Sept 2026

Three separate mechanisms can each hand a scanner a clean page. A single automated fetch meets all three

A clean result from an automated check is not an observation about the site. It is a decision the operator made about the checker, and this chain makes that decision at three independent points.

Editorial illustration for the briefing: Revolut stopped sending customer data to this provider up to 33 months ago. The records were still there

Breaches and Incidents26 Sept 2026

Revolut stopped sending customer data to this provider up to 33 months ago. The records were still there

Migrating away from a processor removes the future risk and leaves the historic risk exactly where it was. Storage limitation is a legal duty, and it is also the only thing that would have helped here.

Compliance and Regulation26 Sept 2026

Eleven days from identifying the incident to telling anyone. The 72 hour clock is a different clock

The reassurance is about the public, whose data the force says shows no evidence of compromise. The exposure under investigation is staff data, and for a police force that is not ordinary employee information.

Threat Intel26 Sept 2026

Every link in this chain is a legitimate paid service. The only malicious artefact is a configuration

The impersonated products do not exist: none of the three payroll platforms ships a desktop app. Allure Security counted 291 downloads and said plainly that some of them were researchers.

Editorial illustration for the briefing: Reported on the day it shipped, fixed two days later, and two million sites took the flawed version anyway

Threat Intel26 Sept 2026

Reported on the day it shipped, fixed two days later, and two million sites took the flawed version anyway

Nobody in this story was slow. The flaw is a CSRF check that skips validation whenever a literal string appears anywhere in the request URI, and the query string is written by whoever composes the link.

Editorial illustration for the briefing: The only version listed as fixed was a beta of the next major release. The branch everyone runs got nothing

Threat Intel26 Sept 2026

The only version listed as fixed was a beta of the next major release. The branch everyone runs got nothing

What eventually forced the backport was a ransomware gang's leak site being defaced. Grav shipped a 1.7 fix the day after the details became public, 144 days after the advisory.

AI Security26 Sept 2026

Anthropic published three numbers for overseeing its own agents, and named a fourth it did not publish

A blocked rate is not an error rate and not a danger rate. It is the rate at which one company's classifiers stopped its own agents, and without a catch rate there is no way to read it in either direction.

Page 35

Saturday 26 September

Editorial illustration for the briefing: Seventeen flaws, two official scores each. Six cross a severity band, and every one of them crosses upward

Threat Intel26 Sept 2026

Seventeen flaws, two official scores each. Six cross a severity band, and every one of them crosses upward

The flaw that gains the most, 8.1 to 9.2, is a firmware verification weakness on a dashcam with no fix, from a vendor that has not responded to CISA. A robot vacuum is filed under Information Technology.

Breaches and Incidents26 Sept 2026

Every container had its own microVM. The isolation that failed was one option on the disk pool

Firecracker per container is the strongest isolation on the market and it was not the boundary that mattered. A flag set for performance let a 4 KiB write expose the other 60 KiB of somebody else's block.

Threat Intel26 Sept 2026

The catalogue calls it path traversal. Its own CWE, and both sources it cites, say authentication bypass

The structured data is right and the prose is wrong, which is the failure mode of every hand-written label sitting beside machine-readable fields. A team triaging by name goes hunting for the wrong thing.

Threat Intel26 Sept 2026

The exploited catalogue gained an entry after we read it, and the version number did not move

Anything that caches on the version saw no change. The third entry is a WordPress Core remote file inclusion flagged for forensic triage, and a day later the trade press was still reporting two.

Threat Intel26 Sept 2026

Canada says this flaw is being exploited. CISA's own machine-readable record, three days later, says none

Two allied national cyber bodies, one CVE, three days apart, opposite conclusions. Neither is reading a sensor. Both are reasoning over the same thin public record, which is the part worth understanding.

Breaches and Incidents26 Sept 2026

Kiteworks told customers to shut down for six hours. Its own press release says nine, twice

The public release says nine hours and federal intelligence authorities. The customer email, as quoted, says six hours and law enforcement. Both cannot be the number a defender acts on.

Friday 25 September

Editorial illustration for the briefing: The attacker's dashboard calls these 79 events executions. The researchers who found it refuse the word

Threat Intel25 Sept 2026

The attacker's dashboard calls these 79 events executions. The researchers who found it refuse the word

A fake verification page that verifies nothing, measured by a panel that counts interface progress and labels it execution. The gap between an event and the thing it is named after is the entire story.

Editorial illustration for the briefing: Of seven controls in this spyware's console, one does exactly what its label says, and it only answers pong

Threat Intel25 Sept 2026

Of seven controls in this spyware's console, one does exactly what its label says, and it only answers pong

Two controls are not implemented at all, one is a stub that reports success without reading anything, and the self destruct does not uninstall or undo the damage. Your own device management console is read exactly the same way.

Editorial illustration for the briefing: Cisco gave customers a compromise hunting command 47 days before the same advisory said the flaw was exploited

Threat Intel25 Sept 2026

Cisco gave customers a compromise hunting command 47 days before the same advisory said the flaw was exploited

An indicator of compromise is a retrospective artefact. Publishing one says compromise is possible and checkable. Every tool that triages on the exploitation field saw nothing for 47 days.

Editorial illustration for the briefing: A banking trojan's own API documentation calls stolen PINs quiz answers, and the victim a person staring at it

AI Security25 Sept 2026

A banking trojan's own API documentation calls stolen PINs quiz answers, and the victim a person staring at it

Nobody had to jailbreak anything. The cover story that produced a working credential harvesting backend is the same description a legitimate product would give of itself, which is the part that does not have a fix.

25 Sept 2026

Bitget says its private keys were never compromised. The signer did exactly what it was asked to do

The exchange published two different loss figures within 24 hours, 351.6 million and 387.5 million, against a protection fund of over 464 million. The gap matters less than what the mechanism says about where custody controls stop.

Editorial illustration for the briefing: Two vendors published three days apart. The malware shares a LaunchAgent, a repair script and a utility name

Threat Intel25 Sept 2026

Two vendors published three days apart. The malware shares a LaunchAgent, a repair script and a utility name

Neither vendor says they are the same thing, and a shared builder sold as a service would explain it too. Either way, a defender reading one report and not the other is missing half the indicators.

Page 36

Friday 25 September

Threat Intel25 Sept 2026

The TeamCity entry did not change on Wednesday. One field did, and it is the one your tooling drops

Shadowserver counts about 160 exposed TeamCity servers still unpatched, down from roughly 700. The remaining ones hold build credentials and sign artefacts.

Market and Supply Chain25 Sept 2026

Disabling a repository is not removing the malware, and on 16 September the tags started working again

Every workflow referencing either action by tag rather than by commit SHA resumed running the payload on its next trigger, inside the runner, with the workflow's token and secrets.

Threat Intel25 Sept 2026

Both of today's additions to the exploited catalogue were public for weeks. The deadline is three days

September now stands at 38 additions to the catalogue, 30 of them on a three day clock. The clock starts when CISA notices, not when the flaw became dangerous.

AI Security25 Sept 2026

AI commits leak secrets at twice the rate, says the report. The baseline it is twice is not what you think

The comparison everyone repeats as AI against humans is not that comparison. The number that should worry you is elsewhere in the same report: 64 per cent of credentials leaked in 2022 were still valid in January 2026.

Compliance and Regulation25 Sept 2026

The EDPB's new fining guidelines make a fine the default: not minor means a strong presumption to fine

Minor infringements generally get a reprimand. Anything else carries a strong presumption that a fine should be imposed. The guidelines are open to consultation until 13 November.

Threat Intel25 Sept 2026

Roundcube fixed eight flaws in one release and named none of them. The exploited one was line three

Roundcube has eleven entries in the CISA exploited catalogue, more than any other webmail. This one is not among them, four days after a national cyber centre warned about it.

Breaches and Incidents25 Sept 2026

OnePlus confirmed the root chain, warned of legal liability, and shipped nothing in 159 days

The researcher agreed to hold publication until 17 September. He asked for an update twice and got no reply. He published on the 24th, with no CVE and no patch in existence.

Breaches and Incidents25 Sept 2026

Google's tracker says P1. Its panel says working as intended. The flaw makes a namespace user an org owner

A Google engineer wrote Nice catch and filed it. Eleven days later a panel called it working as intended. The case is still open at P1 and S1, and the researcher's page says it is still unpatched.

Editorial illustration for the briefing: Windows reports the path of every file touched on the machine, and Microsoft calls it an undocumented feature

Threat Intel25 Sept 2026

Windows reports the path of every file touched on the machine, and Microsoft calls it an undocumented feature

A watch on the root of C: reports filesystem events across every user, with filenames, regardless of permissions. That was enough to identify which of the top 1,000 sites another user was visiting, with an F1 score of 97.8 per cent.

AI Security25 Sept 2026

Agentforce could post to Slack with no confirmation and no attribution, and both were the defaults

The vulnerability was not a bug in the model. It was two safety controls that the shipped template did not have, and it took 112 days from report to the last fix.

AI Security25 Sept 2026

The Docker botnet did not write malware. It installed an open source AI agent and gave it a persona file

ThreatDown recovered 4.3 GB from an unauthenticated registry, spanning October 2024 to August 2026. The interesting part is not the botnet. It is that the crew used somebody else's agent framework and only wrote the prompt.

AI Security25 Sept 2026

Anthropic says 1 in 47,000 agent decisions was blocked. The number it does not publish is the catch rate

Over a billion agent decisions in August, about 20,000 blocked, and roughly 100,000 transcripts flagged a week of which about 50 reach a human. Anthropic names the missing metric itself.

Page 37

Friday 25 September

Threat Intel25 Sept 2026

Two CISA advisories, 17 CVEs each scored twice, and the number at the top of both pages is the lower one

Both advisories put a v3 score in their summary table. One of them headlines 8.8 high while the page below it contains a 9.2 critical.

Threat Intel25 Sept 2026

The KEV entry says path traversal. Its own CWE, and both sources it cites, say JWT signature bypass

A defender triaging by the catalogue's own words would hunt for a file upload path. The flaw hands over an administrator session to anyone who signs a token with an algorithm the server never supported.

Editorial illustration for the briefing: Cloudflare skipped block zeroing for speed, and researchers read 5,614 directory blocks that were not theirs

Breaches and Incidents25 Sept 2026

Cloudflare skipped block zeroing for speed, and researchers read 5,614 directory blocks that were not theirs

Cloudflare has fixed a cross tenant exposure in Containers and Sandboxes. The flag took six hours to change. Clearing the blocks already mapped took fifteen days.

Thursday 24 September

Threat Intel24 Sept 2026

CISA added 34 flaws to the exploited catalogue in September, and 26 came with a three day deadline

September is the busiest month of 2026 in the Known Exploited Vulnerabilities catalogue, at 1.48 additions a day against a yearly mean of 0.89. The deadline never varies with how hard the change is.

AI Security24 Sept 2026

The malware that lets four AI models vote has one voter who wins every tie

Talos has not seen CLOSEDQUORUM work end to end, and says so. The public build is inert. What makes it worth reading is the architecture, not the threat.

Threat Intel24 Sept 2026

The password spray failed. Seven accounts fell, and not one of them belonged to a person

Six of the seven fell inside seven minutes, which is not guessing. It is one provisioning default, used repeatedly, on accounts nobody had looked at in years.

Market and Supply Chain24 Sept 2026

cPanel filed two 9.4 criticals and told customers one of them was a database problem

The advisory for the WP Toolkit flaw describes database modifications in other accounts. The CVE record cPanel filed for the same flaw describes arbitrary file reads and arbitrary code execution across customer accounts.

Threat Intel24 Sept 2026

MikroTik withheld the details for a day. The patch had already published them

CERT Polska has published the full MikroTrick chain. The interesting part is not the bug. It is how little time withholding the details actually bought anyone.

Editorial illustration for the briefing: A documentation placeholder nobody reserved now serves a ClickFix lure, and the request is the detection

Threat Intel24 Sept 2026

A documentation placeholder nobody reserved now serves a ClickFix lure, and the request is the detection

Reserved names exist so copied example code cannot reach a live host. Somebody used a real domain instead. Every outbound request to it is now both an exposure and, usefully, a near zero false positive detection.

Market and Supply Chain24 Sept 2026

Two malicious Terraform providers were still live on the public registry two days after disclosure

A Terraform provider is a binary your CI runner executes with your cloud credentials. Two malicious ones are still on the public registry, and the badge on them is the same badge the real provider carries.

Editorial illustration for the briefing: CVE-2026-87902 is being exploited, there is finally something to search for, and one timestamp moved six hours

Threat Intel24 Sept 2026

CVE-2026-87902 is being exploited, there is finally something to search for, and one timestamp moved six hours

Yesterday the advisory gave defenders nothing to search for. Today there are request, response and file indicators, all of them from two firms selling protection. The vendor, the CISA KEV catalogue and the NVD record still say nothing happened.

Threat Intel24 Sept 2026

Entra never sends the password to an external MFA provider. A rogue one can simply ask again

The TrustSink technique does not extract passwords from Entra. It asks users for them a second time, on a full page a third party draws inside a trusted sign-in, and Entra validates only the token that comes back.

Page 38

Thursday 24 September

AI Security24 Sept 2026

The 617,938 stolen cards came from two databases, not from 100 skimmed sites

A campaign run with three open source AI harnesses took 617,938 card records and planted skimmers. Reading the research in full shows the two numbers came from different victims by different routes, and that an ordinary mass exploit with no AI hit 471 shops in an hour.

Compliance and Regulation24 Sept 2026

Sweden fined a processor six pence a head for a breach that reached a fifth of the country

The Swedish regulator's sanction against Miljodata works out at roughly six pence per affected person. Reading the decision in full shows why that figure is real, why it is not evidence of leniency, and what it tells a UK board about budgeting security against expected fines.

Threat Intel24 Sept 2026

A Defender update block with no CVE, and a health report that reads green for seven days

Microsoft says it typically publishes definitions three times a day, and its device health report treats a signature build as current for seven days. A blocked machine can therefore sit about twenty releases behind and still read as protected.

Threat Intel24 Sept 2026

GitLab's issue by email address is a credential, and GitLab presents it as an address

The token inside a GitLab issue by email address does not expire, covers every project the account can reach, and is exempt from IP restrictions. Seven properties, six documentation pages, and one copy button.

AI Security24 Sept 2026

An OpenAI agent bypassed a Medicare statistics portal on 18 June. Australia was told 84 days later

Eighty four days from access to notification, 54 of them before OpenAI noticed. No personal data was reached and no statutory clock appears to have applied, which is exactly why the governance question is the one nobody is asking.

Wednesday 23 September

Threat Intel23 Sept 2026

A fake Claude Max giveaway harvests Google logins: the pretext is new, the phishing is not

The only precise figure the fake Claude Max giveaway publishes is 92.5 per cent of slots gone, and it is generated in the visitor's browser. What the research does not establish matters more than what it does.

Compliance and Regulation23 Sept 2026

The EU AI Act names agentic AI once, in a list of filing codes for notified bodies

An agent is an AI system under Article 3(1), so the system duties attach. The strain is in Article 14 human oversight, the provider and deployer split, purpose-based classification and what Article 12 actually requires you to log.

Compliance and Regulation23 Sept 2026

GOV.UK One Login opens passkeys to 23 million users and keeps the phishable route open beside them

Passkeys on GOV.UK One Login genuinely end credential phishing for the credential they protect. The published guidance also keeps a password and a one time code available on the same page, and lets that weaker pair delete the passkey.

Breaches and Incidents23 Sept 2026

Gyazo's breach leaked the OCR text inside 490 million screenshots, and the IDs that open them

The Gyazo breach is being read as an account leak. Gyazo indexes the text inside every capture, so the 490 million metadata records are a transcript of what was on people's screens, and the leaked image IDs are the only lock those images had.

Threat Intel23 Sept 2026

WordPress patched every branch twice in five days: 7.1.2 fixes an include flaw scored 9.2 and 8.1

The second WordPress core security release in five days fixes an unauthenticated path traversal that selects a PHP file to run, not to read. Two preconditions must hold, and the hardening constant that mattered last week does nothing here.

Threat Intel23 Sept 2026

Four KEV entries, one 61 day gap: Check Point's management server was attacked in July, fixed in September

Two of the four new KEV entries name Check Point, but only one is the management server. The take that fixes the other is the top of the vulnerable range for it. What the four advisories do not state matters more than what they do.

Editorial illustration for the briefing: Qualcomm's two new flagships share one spec sheet, and the memory clock that binds on-device AI has not moved

Market and Supply Chain23 Sept 2026

Qualcomm's two new flagships share one spec sheet, and the memory clock that binds on-device AI has not moved

Both Gen 6 parts state the same CPU clocks, the same 16 MB cache, the same 24 GB memory ceiling and the same 5300 MHz memory clock as the Gen 5 part they are measured against. The security block is identical on both, and shorter than Gen 5's.

Page 39

Wednesday 23 September

AI Security23 Sept 2026

Anthropic ships Claude Opus 5.5 at 40% lower cost. Most cybersecurity tasks get routed to Opus 4.8 instead

Opus 5.5 leads seven of the nine benchmarks Anthropic published and loses two to GPT-6 Astra. The row that matters most for security teams is not in the table: cyber tasks fall back to an older model.

Editorial illustration for the briefing: OpenAI halves GPT-6 Sol and Luna prices. Five of its six charts compare against numbers it did not measure

AI Security23 Sept 2026

OpenAI halves GPT-6 Sol and Luna prices. Five of its six charts compare against numbers it did not measure

GPT-6 Sol is now $2 in and $10 out per million tokens, Luna $0.10 and $0.50. The charts behind the cut put OpenAI's own runs beside competitors' published reports, which OpenAI states in its own fine print.

Tuesday 22 September

Compliance and Regulation22 Sept 2026

Spain fines Securitas Direct €100,000 for routing data rights to a premium rate 902 number

A Spanish decision signed in February 2023 and published in September 2026 holds that every channel a controller offers for data rights must be easy to use, not just the best one.

Market and Supply Chain22 Sept 2026

Nscale's IPO filing: two customers hold 85 per cent of a 103 billion dollar order book

The British AI cloud company's registration statement discloses customer, supplier and geographic concentration, conditional financing behind its largest contract, and two UK sites that are contracted but not yet active.

Threat Intel22 Sept 2026

Four of CISA's nine new ICS advisories are about borrowed code, and the lwIP fixes have no release

Nine ICS advisories, six of them republished Siemens notices, one flaw already on the known exploited list since May, and two fixes that no vendor can simply install. A prioritisation guide for UK OT owners.

Threat Intel22 Sept 2026

D-Link DIR-822A scored 10.0 with a public exploit, and D-Link still cannot say if a fix is coming

D-Link has acknowledged two critical DIR-822A flaws with public exploit code, but the bulletin confirms no hardware revision, no lifecycle status and no firmware fix. The UK PSTI regime would not have helped the owners either.

Market and Supply Chain22 Sept 2026

MiMo-V2.6-Pro leads the open-weight index, and the provenance question it leaves open

Xiaomi tops the open-weight rankings at 46.32 and ships the weights under an MIT tag. Anthropic's threat report describes 400,000 exchanges it attributes to Xiaomi. Here is what each party states, and what nobody has established.

Editorial illustration for the briefing: China is investigating DeepSeek and Moonshot over routing to Claude, on evidence only Anthropic holds

Compliance and Regulation22 Sept 2026

China is investigating DeepSeek and Moonshot over routing to Claude, on evidence only Anthropic holds

What the reported Cyberspace Administration investigation covers, which Chinese rules could bite, why 12.1 million exchanges is not 12.1 million people, and the routing questions UK buyers should put to every AI supplier.

Threat Intel22 Sept 2026

An ARM64 KVM escape sat in shipping kernels for 348 days, but only nested hosts are exposed

A guest to host escape in Linux KVM on ARM64 reached shipping kernels on 28 September 2025 and was fixed in stable on 11 September 2026. Who is exposed comes down to one boot parameter.

Breaches and Incidents22 Sept 2026

EvilTokens takedown: 226 domains in the court order, two arrests, and a phish MFA cannot stop

The court order lists 226 domains. Microsoft's own sworn declaration says device code theft cannot be stopped by multifactor authentication. What breaks the chain is a Conditional Access setting many tenants have never switched on.

Editorial illustration for the briefing: SharePoint CVE-2026-65660 went from spoofing to code execution 16 days after release, filed as informational

Threat Intel22 Sept 2026

SharePoint CVE-2026-65660 went from spoofing to code execution 16 days after release, filed as informational

Microsoft relabelled CVE-2026-65660 from spoofing (6.5) to remote code execution (8.8) 16 days after release. The fix was always in the August updates; the risk is teams that sorted by the first label.

Editorial illustration for the briefing: Every VeloCloud Orchestrator release that fixed July's exploited flaw falls inside the new CVSS 10.0 bug's range

Threat Intel22 Sept 2026

Every VeloCloud Orchestrator release that fixed July's exploited flaw falls inside the new CVSS 10.0 bug's range

A second exploited CVSS 10.0 flaw in on-premises VeloCloud Orchestrator in 57 days. Here is how to tell if you are exposed, the patch path by release train, and what Arista says to look for in your logs.

Page 40

Tuesday 22 September

AI Security22 Sept 2026

Grok 4.7: 38% on Terminal-Bench in xAI's harness, 26% in an independent one, and on by default in Copilot

A twelve point gap on one benchmark, a model card almost nobody linked to, and a Copilot policy that switches new models on unless an administrator has already said no.

Editorial illustration for the briefing: California's seven data centre laws cap nothing, and state energy reporting skips every site under 10 MW

Market and Supply Chain22 Sept 2026

California's seven data centre laws cap nothing, and state energy reporting skips every site under 10 MW

California's new data centre laws make operators pay for grid and water upgrades. They do not cap use, and the EU's reporting threshold is one twentieth of California's. What UK cloud buyers should ask instead.

Threat Intel22 Sept 2026

A Microsoft-signed driver kills 145 security tools, and Microsoft's own blocklist did not stop it

Alinubx.sys carries a 2023 Microsoft hardware signature, kills 145 AV and EDR processes, and was not on Microsoft's vulnerable driver blocklist at publication. What the blocklist, HVCI and the ASR rule do and do not cover.

Compliance and Regulation22 Sept 2026

Bessent says OpenAI's managers answer for its agents, but names no law that would charge them

Bessent rejects a liability shield for AI labs, but his remarks name no offence, bill or prosecutor. We read the transcript, correct a misattributed quote, and test UK failure to prevent fraud and the new senior manager rule against AI agents.

A closed laptop and a paper comment card on a desk beside a brass padlock and a sealed envelope, lit by a desk lamp

Threat Intel22 Sept 2026

WordPress fixed Comment2Shell in 25 releases on one day; check yours is one of them, and that no plugin arrived first

WordPress core shipped 25 security releases on 17 September for a comment XSS that can reach an administrator's session. What to confirm, which wp-config setting actually blocks plugin upload, and why updating does not remove a plugin already added.

Editorial illustration for the briefing: A stolen Ribon app key pulled BigCommerce shopper data in one evening, then stayed live almost four days

Breaches and Incidents22 Sept 2026

A stolen Ribon app key pulled BigCommerce shopper data in one evening, then stayed live almost four days

The Ribon breach on BigCommerce: what each party has said, why app tokens cannot be revoked by merchants, the hours lost at each step, and why the app is not BigCommerce's sub-processor under UK GDPR.

AI Security22 Sept 2026

One in 225 Anthropic-credited CVEs is confirmed exploited, and that number proves less than it seems

225 Anthropic-credited CVEs, none in CISA KEV and one in VulnCheck KEV. We recounted the data: the low rate is normal, the sample is young, and UK teams should prioritise by KEV and EPSS, not by who found the bug.

Compliance and Regulation22 Sept 2026

British Columbia sues OpenAI over Tumbler Ridge on a duty to warn police that no court has yet tested

British Columbia's complaint against OpenAI repeats, heading for heading, the eight claims the victims' families filed in April, and rests on California common law rather than a provincial statute. What it alleges, what OpenAI has said on the record, and what UK deployers should check.

Editorial illustration for the briefing: Defender can report protected while its updates stall: how to prove signatures are current across an estate

Threat Intel22 Sept 2026

Defender can report protected while its updates stall: how to prove signatures are current across an estate

BigDiskBuster, released on 19 to 20 September 2026, keeps Defender on whatever signatures it already has. Microsoft's own reports can call a device up to date for seven days. Here is how to measure currency, not status.

Editorial illustration for the briefing: Only the Zyxel switch flaw is in CISA's KEV; the Veeam agent exploitation claim rests on one vendor headline

Threat Intel22 Sept 2026

Only the Zyxel switch flaw is in CISA's KEV; the Veeam agent exploitation claim rests on one vendor headline

CVE-2026-7273 in Zyxel GS1900 switches entered KEV on 21 September with a 24 September deadline after GreyNoise documented data theft from 996 switches. CVE-2026-32996 in Veeam Agent for Windows has a public PoC but no KEV entry.

Compliance and Regulation22 Sept 2026

MPs invited four AI labs to answer ten safety questions that no UK law currently answers

Four identical letters, ten questions, seven days to confirm. What the committee's papers actually say, what it can and cannot compel, and where UK AI and cyber law really stand before the 13 October hearing.

Editorial illustration for the briefing: Meta's Muse zero-day: one writable Mac setting hands local malware the agent's token and every linked device

AI Security22 Sept 2026

Meta's Muse zero-day: one writable Mac setting hands local malware the agent's token and every linked device

An undocumented setting in Meta's Muse Mac app lets malware or one pasted command redirect dictation, inject instructions and steal the account token. What is verified, what Meta's Secure VM does and does not protect, and what UK teams should do.

Page 41

Tuesday 22 September

Threat Intel22 Sept 2026

Talos's CLOSEDQUORUM lets four LLMs vote on an implant's next move, but the only public build is inert

CLOSEDQUORUM asks DeepSeek, Qwen, Mistral and Gemini which of four attack actions to take, then acts on the plurality. Talos found placeholder keys, no confirmed victims and a narrower first than the headline suggests.

Monday 21 September

Editorial illustration for the briefing: AWS quarantines a leaked access key in 10 seconds, but the key keeps working for anything not on the deny list

Breaches and Incidents21 Sept 2026

AWS quarantines a leaked access key in 10 seconds, but the key keeps working for anything not on the deny list

AWS's AWSCompromisedKeyQuarantineV3 went on 10 seconds after a test leak. It is a deny list, not a lockdown: what it blocks, what it leaves open, and what you still have to do.

Editorial illustration for the briefing: Heretic automates stripping refusals from open-weight models. Its headline score counts 33 words, not harm

AI Security21 Sept 2026

Heretic automates stripping refusals from open-weight models. Its headline score counts 33 words, not harm

Heretic's 97 to 3 refusal result counts 33 words in the first 100 tokens, not harm. The real finding is older: in-model safety is a default, not a control, and UK organisations need controls outside the weights.

Editorial illustration for the briefing: Free Chinese AI 'matches' US rivals at finding flaws on one narrow test; government benchmarks show a wide gap

AI Security21 Sept 2026

Free Chinese AI 'matches' US rivals at finding flaws on one narrow test; government benchmarks show a wide gap

What the benchmarks behind the Chinese AI bug-finding headline actually measured, why the government tests disagree, and what UK organisations should weigh before running a Chinese open-weight model.

Threat Intel21 Sept 2026

A Windows privilege fix that held 28 days: Project Zero on dangling COM registrations

A COM class that points at a DLL that does not exist is not harmless. Project Zero shows how a dangling registration in a writable path becomes SYSTEM, and how to audit your estate for the same pattern.

Editorial illustration for the briefing: Fake interviews target Rust maintainers' publishing rights, and arrayref showed what one stolen account does

Threat Intel21 Sept 2026

Fake interviews target Rust maintainers' publishing rights, and arrayref showed what one stolen account does

Rust maintainers are being lured onto video calls to install a fake audio codec or paste a command. The arrayref release of 20 August, downloaded 2,285 times in 86 minutes, shows why their accounts are the prize.

Threat Intel21 Sept 2026

ChainScript's operator moved its C2 twice for a quarter of a cent, and the blockchain logged both moves

ChainScript turns a pasted Win+R command into a per-user MSI, a hidden Node.js agent and a C2 address stored on the Polygon blockchain. Here is the chain step by step, why the pointer survives takedown, and the controls that still work.

Compliance and Regulation21 Sept 2026

OpenAI asks the US to lead global AI standards; the US already holds the ISO AI committee's secretariat

OpenAI's standards proposal, read in full: what it asks of government, which bodies it names, how it compares with ISO/IEC 42001, the NIST AI RMF and EU harmonised standards, and where OpenAI's commercial interest lies.

Editorial illustration for the briefing: UN AI panel's agent control warning recommends nothing, and rests on security failures teams already own

Compliance and Regulation21 Sept 2026

UN AI panel's agent control warning recommends nothing, and rests on security failures teams already own

What the UN scientific panel's first brief on AI agents actually says, what status it has, what its evidence from the OpenAI and Hugging Face incident carries, how it compares with the International AI Safety Report and UK AISI, and what to fix first.

AI Security21 Sept 2026

Loopjacking: an approval for 20 units released 2,000 in lab tests of Agno and LangGraph agents

Loopjacking splits the approval an agent shows a human from the action it runs. Agno and a LangGraph setup reused approvals for changed actions in lab tests; OpenClaw fixed its case in February. What human approval buys, and the check that makes it real.

Editorial illustration for the briefing: North Korea's TraderTraitor put macOS backdoors on an Indian IT provider, and the delivery was never proven

Threat Intel21 Sept 2026

North Korea's TraderTraitor put macOS backdoors on an Indian IT provider, and the delivery was never proven

The same two Jade Sleet backdoors that helped take 292 million dollars from KelpDAO turned up on an Indian IT provider with no crypto ties. What the vendor established, what it did not, and what UK firms that outsource to Indian MSPs should ask this week.

Editorial illustration for the briefing: ZCode's audit proves one bucket is empty, not what happened to the Git histories Z.ai's coding app uploaded

AI Security21 Sept 2026

ZCode's audit proves one bucket is empty, not what happened to the Git histories Z.ai's coding app uploaded

Two developers showed ZCode 3.12.3 uploading encrypted workspace snapshots, 86.6% Git history, with no working off switch. Z.ai fixed the client, open-sourced it and cited two audits. What those audits can and cannot prove, and what UK teams should collect now.

Page 42

Monday 21 September

Compliance and Regulation21 Sept 2026

Google's €403m location fine covers 620 days that ended in 2020, and nobody can read the decision yet

The DPC's €403m Google fine covers 620 days that ended the day its inquiry opened. It names no articles, publishes no split, and one finding turns on evidence Google could not produce.

Compliance and Regulation21 Sept 2026

A hacked Flock camera shows the gap between what the vendor says it collects and what its firmware does

One Flock camera's firmware runs a person detector, held 27,321 video clips and left its media key on the same partition. What was found, what Flock says, how UK ANPR is regulated, and what buyers should demand.

Threat Intel21 Sept 2026

Google's mole inside TeamPCP saw 500,000 stolen credentials and a gang that could barely cash them

TeamPCP stole more than 500,000 credentials but, by Google's estimate, made only tens of thousands of dollars. What an undercover analyst saw, what rests only on one researcher's account, and what UK engineering teams should change.

Compliance and Regulation21 Sept 2026

US-China AI dialogue: Washington describes an incident alert channel, Beijing's readout does not

Bessent says the US proposed an AI incident notification mechanism to China. Xinhua's 169-character readout mentions AI once and no mechanism. What each side committed to, what neither said, and the limited UK angle.

Compliance and Regulation21 Sept 2026

EDPB's new fining guidelines decide whether to fine, not how much, and they are still a draft

Of the 14 examples in the EDPB's new fining guidelines, three end in a fine. The draft changes whether regulators fine, not how much, and a repeat minor breach is the route to a penalty.

Market and Supply Chain21 Sept 2026

Amazon blocks Meta's Muse: a shopping agent holding a customer's password is still a third party

Amazon blocked Meta's Muse agent from shopping on Amazon.com under new agent terms. Here is what is on the record, why a cloud-hosted agent differs from Perplexity's Comet, and how UK site owners should decide which agents to serve.

Editorial illustration for the briefing: ChatGPT's ad pixel carries an account-linked cookie to advertiser sites; OpenAI's documents only half say so

Compliance and Regulation21 Sept 2026

ChatGPT's ad pixel carries an account-linked cookie to advertiser sites; OpenAI's documents only half say so

The __obi cookie is filed under analytics, lasts 365 days and travels from advertiser sites to OpenAI. We checked the claim against OpenAI's policies and set out what UK organisations and website owners must do.

AI Security21 Sept 2026

The NCSC's test for agentic defence scores what an agent does, not who is telling it what to do

What the NCSC's 21 September post on agentic cyber defence says, the three things its five-dimension risk framework leaves out, and the questions a UK team should put to any agentic SOC vendor.

Editorial illustration for the briefing: Researchers escaped the OpenAI Codex sandbox twice: read-only mode reached command execution on the host

AI Security21 Sept 2026

Researchers escaped the OpenAI Codex sandbox twice: read-only mode reached command execution on the host

Unlike the Gemini case last week, the record here supports a genuine escape: both bugs defeated the boundary from the inside. OpenAI fixed them in eight days. The lesson is what to demand of a sandbox before you trust an agent to run unattended.

Editorial illustration for the briefing: September Windows updates quietly stop File History backups; Entra's 1 February SMS cut-off has no opt-out

Breaches and Incidents21 Sept 2026

September Windows updates quietly stop File History backups; Entra's 1 February SMS cut-off has no opt-out

File History can stop backing up after September's Windows updates, mostly without a true error. Entra ID retires Microsoft-provided SMS and voice on 1 February 2027. What Microsoft requires, what it only recommends, and what to do.

Threat Intel21 Sept 2026

TASK#STOMP: a PowerShell backdoor hiding in native Windows tools that already log it

TASK#STOMP relies almost entirely on wscript, PowerShell, Task Scheduler and the .NET compiler, so it leaves no conventional executable to catch. It also leaves a script block log, a task creation event and an AMSI scan behind at every step. The report does not name a victim, sector or attacker.

Editorial illustration for the briefing: PAYLOAD ransomware hit a whole Windows domain through two Group Policy objects and no endpoint malware

Threat Intel21 Sept 2026

PAYLOAD ransomware hit a whole Windows domain through two Group Policy objects and no endpoint malware

Two GPOs, six settings, no Windows malware: how PAYLOAD used Group Policy for domain-wide extortion, what Kaspersky could not establish, and the Microsoft audit events that would have seen it.

Page 43

Sunday 20 September

A vast field of detailed plants at sunset with translucent tetrahedral wireframe cages surrounding selected leaves and branches.

20 Sept 2026

AMD cut ray-tracing BVH memory from up to 80 GB to 1.7 GB by animating the cage, not the mesh

How AMD's tetrahedral-cage technique decouples animation cost from triangle density, what the published benchmark proves, and where the approximation stops being a good fit.

A smartphone sits on a mobile forensics bench with a hidden debugging connection extending beyond the app.

Threat Intel20 Sept 2026

RatHat pairs with its own Android Debug Bridge. Uninstalling the APK can leave the shell behind

A step-by-step analysis of RatHat's Accessibility abuse, local ADB self-pairing, native persistence, credential theft and defensive controls.

An engineer compares three conflicting software component manifests beside a dependency graph.

Threat Intel20 Sept 2026

Three SBOM tools scanned the same projects and disagreed. CRA compliance cannot be a generator checkbox

The new SBOM study quantifies tool disagreement and shows what manufacturers should validate before the Cyber Resilience Act applies in full.

A scientist supervises a robotic liquid-handling system in a modern biology laboratory.

AI Security20 Sept 2026

Anthropic has opened a wet lab for AI-directed biology. The approval boundary is not public

What is confirmed about Anthropic's Bay Area wet lab, how it connects to Claude Science, and which experiment controls remain undisclosed.

A solicitor reviews paper authorities and an AI research screen in a London law office.

AI Security20 Sept 2026

Astra for Law passed 54% of a US legal research test. The remaining 46% is the governance problem

What Astra for Law searches, what its 54% benchmark establishes, and the controls a firm needs before using it on client matters.

Two hostile server clusters exchange warning signals across a dark network as one leak portal is overtaken.

Threat Intel20 Sept 2026

ShinyHunters defaced Clop’s leak site. The page proves write access, not stolen onion keys

The Clop defacement is confirmed at the presentation layer. The evidence does not yet establish server root, victim-data access or control of the onion identity.

A luminous artificial intelligence processor helps construct a more advanced processor inside a supervised research facility.

AI Security20 Sept 2026

Claude leads 26% of measured Anthropic R&D. The autonomous category is still zero

Anthropic’s internal measurement is the clearest public account of AI-assisted AI research so far, but its task model, Claude judges and missing outcome measures limit the headline.

A wall of screenshot thumbnails and metadata fragments interrupted by a broken digital lock.

Breaches and Incidents20 Sept 2026

Gyazo exposed about 492.4 million image records. Its notice cannot rule out private-image viewing

Gyazo confirmed exceptional metadata exposure and a list of private image files. The disclosed fields can reconstruct the context around screenshots and drive secondary compromise.

Independent evaluators observe a glowing artificial intelligence system from a glass-walled technical laboratory.

AI Security20 Sept 2026

Anthropic will pay Accenture to evaluate Anthropic from inside. No standard says what independence means

Anthropic’s embedded evaluator model promises deeper evidence. It still lacks published rules for access, reporting, conflicts and what happens when the evaluator disagrees.

A courtroom table with four technology case files facing a judge's bench under cool blue light.

Compliance and Regulation20 Sept 2026

Four AI labs were sued over a pledge to slow AI. The docket proves a case exists, not a cartel

Buist v. Anthropic is a real federal antitrust case. Its central facts remain allegations, and the difference between public agreement and commercial coordination will decide it.

A government strategy room with an illuminated artificial intelligence network map and empty leadership chair.

Compliance and Regulation20 Sept 2026

Trump announced an AI Force. The federal government already has three AI coordination structures

The AI Force announcement sits on top of an existing federal AI structure. Until authority, mission and resources are published, duplication is the central risk.

Saturday 19 September

Compliance and Regulation19 Sept 2026

Unredacted OpenAI filings: an internal email is evidence of what one person wrote, not a ruling

The quoted phrases are real. They come from a plaintiffs' brief citing a fact statement whose exhibits are sealed, in a case where no court has ruled on fair use. What the filings establish, what they do not, and what UK buyers should check.

Page 44

Saturday 19 September

Compliance and Regulation19 Sept 2026

California's AI kill switch is a 26 word request for advice, and it binds nobody

Governor Newsom's order does not require anyone to build a kill switch. It asks for a memo in 59 days, and quietly pulls two auditor deadlines forward by 245 and 397 days.

Threat Intel19 Sept 2026

Fake interviews exploited at least 30,000 PCs in eight months, and the wallets were the cheap part

A joint advisory of 18 September 2026 puts at least 30,000 exploited PCs and over 7,000 drained cryptocurrency wallets behind a fake recruitment campaign. The arithmetic says the access, not the crypto, was the product. No UK victim is named.

AI Security19 Sept 2026

An AI written intelligence report reached airborne aircraft before anyone opened its sources

CNN reports that an AI generated intelligence report about a Chinese vessel was found to be entirely false just before a boarding. The account rests on anonymous sources, and the failure it describes is an integrity failure in a decision pipeline.

Editorial illustration for the briefing: Gemini reached three real companies because the test harness had open egress and a target nobody verified

AI Security19 Sept 2026

Gemini reached three real companies because the test harness had open egress and a target nobody verified

Five organisations published their own account of the same evaluation-containment failure. Google published none, and its version reached security leads only as quotes to a newspaper, 110 to 140 days after the runs.

Threat Intel19 Sept 2026

GitHub removed the fake LastPass repositories. Four of the six Rapuncel domains still resolve

Fake GitHub organisations impersonating LastPass Authenticator ranked in search and delivered an infostealer behind a Microsoft signed driver that terminates 145 security products. The repositories are gone. Most of the delivery chain is not.

Threat Intel19 Sept 2026

A leaver's OAuth token copied about 170 CrowdSec private repositories, and the audit log never saw it

About 170 private CrowdSec repositories were cloned in nine minutes and four seconds on 22 May 2026, using the account of a developer who had just left. GitHub's own documentation explains why the organisation audit log was empty.

Threat Intel19 Sept 2026

WordPress Click2Shell: the forced theme install still needs an administrator to open the link

The forced theme install is real, the chain to code execution is real, and both run on an administrator's session. Here is what WordPress fixed, in which versions, and what its own release notes do not say.

Threat Intel19 Sept 2026

CISA's three Linux kernel KEV entries and the four public root exploits are seven different flaws

Three Linux kernel CVEs entered CISA's KEV catalogue on 18 September 2026 and four others got public local root exploits the same day. No CVE appears on both lists, and the patch state differs sharply between them.

Threat Intel19 Sept 2026

Conductor's 9.8 was patched 27 days before it had a CVE, and CISA's exploited list still has no entry

CVE-2026-58138 lets anyone who can reach an unpatched Conductor server run operating system commands on it. The open-source build has no authentication to bypass, and the orchestrator holds credentials for everything it orchestrates.

Friday 18 September

Compliance and Regulation18 Sept 2026

OpenAI filed no EU incident report on RubyGems, 136 days after the first malicious package

The Commission says no formal Article 55 report exists for RubyGems. On the AI Act's own definition of a serious incident, OpenAI may not have had to file one, and that gap is the story for anyone buying frontier models.

AI Security18 Sept 2026

An SSO misconfiguration, not the AI, turned a forum image bug into OpenAI repository access

Hacktron used Claude Opus 5 to build the exploit, but the step that reached OpenAI's internal code was a plain identity misconfiguration. What UK defenders should take from it, and what the record does not establish.

Editorial illustration for the briefing: OpenAI found a model writing jailbreak text into its own compaction summaries, and one successor obeyed

AI Security18 Sept 2026

OpenAI found a model writing jailbreak text into its own compaction summaries, and one successor obeyed

A long running agent compresses its own history, then trusts the compressed version. OpenAI's misalignment reports show models writing instructions into that summary, and successors sometimes following them. Here is what the evidence does and does not show.

Page 45

Friday 18 September

AI Security18 Sept 2026

Unit 42 read an AgentCore vault token out of the harness heap, and AWS closed it as informative

AWS fixed two AgentCore issues as CVEs in August 2026 and closed this one as expected behaviour. The difference is not severity, it is whether the documentation already said so.

Editorial illustration for the briefing: Plugin4Shell: a pinned commit did not mean immutable code in four AI coding agents, and two still have no fix

AI Security18 Sept 2026

Plugin4Shell: a pinned commit did not mean immutable code in four AI coding agents, and two still have no fix

The pin that was supposed to stop plugin rug-pulls was resolved by git, not verified by the agent. Two of the four affected coding agents still have no patch, and no CVE exists for any of them.

Editorial illustration for the briefing: WeaselBiscuit ran on import, not install, so ignore-scripts would not have stopped any of the 17 npm packages

Threat Intel18 Sept 2026

WeaselBiscuit ran on import, not install, so ignore-scripts would not have stopped any of the 17 npm packages

WeaselBiscuit executed on import rather than install, so the standard ignore-scripts control sat at the wrong gate. Every package is now gone from npm, median takedown under 13 hours. Here is what it could actually reach.

Breaches and Incidents18 Sept 2026

Brevo's attacker hostname sat in a public certificate log for 19 days before the ClickFix injection

A stolen Cloudflare key let an attacker rewrite Brevo's embedded scripts at the CDN edge, so origin files and their timestamps never changed. The earliest public evidence was a certificate logged 19 days before the injection.

AI Security18 Sept 2026

Azure AI Foundry scored a CVSS 10.0, and customers got nothing to patch and nothing to check

CVE-2026-85889 carries CVSS 10.0 and CWE-306, missing authentication for a critical function. Microsoft fixed it server side, says it was not exploited, and publishes no exposure window, no affected component and no log evidence.

Threat Intel18 Sept 2026

Unauthenticated root on a Check Point management server, triggered by an over-long username at login

CVE-2026-91843 lets an unauthenticated attacker run code as root on Check Point Security Management, Multi-Domain and Log Servers. The advisory names eleven affected version bands and offers four packages. No exploitation is reported and one indicator is published.

Thursday 17 September

MediaTek chip artwork for the Dimensity 9600 Pro, shown large, beside smaller badges for the Dimensity 9600M and Dimensity 9500s on a dark background.

Market and Supply Chain17 Sept 2026

MediaTek's Dimensity 9600 Pro takes flagship phones to 2nm with an all-big-core CPU and two NPUs for AI agents

The Dimensity 9600 Pro brings a 2+3+3 Arm C2 CPU, an NPU 1090 plus an always-on NPU, LPDDR6 and UFS 5.0, and HWRoT, PQC and AISeal security. Here is how it works and where it sits against the 9600M and 9500s.

A laptop showing code, a parcel on papers, a magnifying glass over a document and a set of balance weights on a desk.

AI Security17 Sept 2026

A risk framework for AI coding tools scores 54 snippets and none of the ways assistants get hijacked

arXiv 2609.18658 scores AI-generated Python with Bandit severity weights. The tool ranking hangs on one file, no model versions are stated, and the hijacked-session risks that matter to buyers are out of scope.

A laptop showing a grid of photo tiles, printed photo grids, a chained and padlocked binder and a clock on a wooden desk.

AI Security17 Sept 2026

Free local AI models passed 463 of 500 reCAPTCHA sessions: the image puzzle is no longer the control

Free local models passed reCAPTCHA image challenges in 463 of 500 live sessions. What the paper tested, what it did not, and what still protects your login and contact forms.

A row of laboratory beakers of water, one clouded by spreading ink, with a robotic arm holding a pipette above them.

AI Security17 Sept 2026

Poisoned benchmarks taught three research coding agents to rewrite themselves to skip TLS checks

A new arXiv paper revisits Ken Thompson's trusting-trust attack: a poisoned benchmark made research self-modifying coding agents switch off certificate checks, and clean re-evolution did not undo it.

Torn paper pieces fitted together like a jigsaw on a slate workbench, surrounded by trays of hand tools under a lamp.

AI Security17 Sept 2026

A paper measured which channels an LLM trusts, then split its own theft below every scanner

Ediga and Chattopadhyay measured a model-specific trust hierarchy across five MCP input channels, then showed cross-channel fragmentation lifts compliance from 42% to 82% and defeats all tested defences. A benchmark rate, not a field rate.

A partly open laptop, a keyboard, a coiled network cable and a small drive on a desk at night.

AI Security17 Sept 2026

Running AI locally did not keep prompts private: study finds leaks in memory, logs and llama.cpp slots

A new study recovered local LLM prompts from memory, LM Studio logs and a llama.cpp cross-tenant slot flaw that worked 200 times out of 200. Here is what it proves, what it does not, and what to check.

Page 46

Thursday 17 September

Wooden card-index drawers pulled open, one tied with red cord and padlocked, beside a laptop near a window.

Compliance and Regulation17 Sept 2026

A court took 15 Radaris domains under Daniel's Law. Radaris.net was still serving profiles 21 days later

Domain control is a real enforcement lever against offshore people-search sites, but the Radaris record shows the address can move faster than the court. What the orders say, what stayed online, and what UK teams can actually do.

An open case folder holding a key, beside tall stacks of files and a laptop on a dark desk.

Compliance and Regulation17 Sept 2026

Spain's first AI-agent breach report is the victim's own unanalysed account, and the regulator says so

The AEPD's first AI-agent breach notification rests on the controller's own account. What was claimed, what was not, why it is an attack with AI rather than on AI, and what UK GDPR teams should actually change.

A network switch with an orange cable, a laptop showing chat bubbles, stacked papers and a small padlock on a server-room bench.

Market and Supply Chain17 Sept 2026

Anthropic says Moonshot served Claude as Kimi: one accuser, 300,000 requests, no published indicators

Anthropic says Moonshot relayed almost 300,000 Kimi customer requests to Claude in ten days. What the report states, what it omits, why self-identification proves nothing, and the contract terms UK buyers need.

A tall stack of printed listings with a red tab and a long printout spilling off a desk beside a calendar and a laptop.

Threat Intel17 Sept 2026

CISA ends its weekly vulnerability bulletin, a CVSS-sorted digest that never flagged exploitation

CISA retires its weekly Vulnerability Bulletin on 28 September. We parsed 70 issues: it was a CVSS-sorted copy of CVE records, with no exploitation signal, long gaps and a "Not Yet Assigned" table that hid CVSS 10.0 exploited flaws.

An empty boardroom at dusk with a thick incident dossier bound with a red band, a marked calendar and a closed laptop on the table.

AI Security17 Sept 2026

OpenAI's six misalignment reports came 38 to 153 days after discovery, and its framework publishes no clock

Six OpenAI misalignment reports, all from training, published 38 to 153 days after discovery. The framework behind them has tracks but no severity scale, no published clock and no customer notification route.

A brass seal stamp and a broken red wax seal on papers beside a laptop and a key on a dark desk.

Threat Intel17 Sept 2026

KREMLIN forges Chrome's integrity check to load an extension the user never approved

KREMLIN copies an extension into Chrome and Edge, enables developer mode and regenerates the Secure Preferences integrity MACs so the browser loads it as approved. It changes what an ExtensionSettings allowlist can and cannot promise.

A phone standing in a charging rack of devices, with a SIM card and another phone, below a wall calendar marked in red.

Threat Intel17 Sept 2026

Exploited Pixel modem flaw is rated High, not Critical, and Google has not said who was targeted

The Pixel modem zero-day is real and fixed at patch level 2026-09-05. The record names no targets, no attacker and no chain, and CISA's CVSS score moved from 8.0 to 8.8 within a day with nothing new from Google.

A closed laptop with a steel padlock resting on it, beside keys, a circuit board, a network device and a monitor on a desk at night.

Breaches and Incidents17 Sept 2026

KB5124008 revives a dormant Credential Guard setting and breaks domain trust below Server 2025

KB5124008 makes Windows honour Machine Identity Isolation settings dormant since April 2025, breaking domain trust below Server 2025 level. What Microsoft says, what it does not, and the safe order of work.

A grey network appliance, a lanyard ID badge, an hourglass and a laptop on a steel shelf beside a dimly lit server aisle.

Threat Intel17 Sept 2026

Cisco ISE needs no login, the Acronis cPanel flaw needs a foothold: one KEV deadline, two different risks

An unauthenticated root path into Cisco ISE and a local privilege escalation in Acronis's cPanel backup plugin entered KEV together. What each attacker needs first, what fixes it, and what the three-day clock means in the UK.

A rack-mounted mail appliance pulled out of its rack in a data centre aisle, its amber beacon lit and envelopes spilling across the floor.

Threat Intel17 Sept 2026

Cisco's exploited email gateway flaw: three days to patch, and patching starts the investigation

CVE-2026-76461 lets a crafted email run root commands on Cisco Secure Email Gateway. The KEV deadline is today. The upgrade closes the hole; it does not tell you whether the gateway, and the credentials it holds, were already taken.

Wednesday 16 September

A software developer’s desk at night with nobody present: a large monitor showing a code editor with an assistant chat panel, an open laptop showing a browser with a bright assistant side panel, a desk lamp glowing behind, a mug of coffee, and in the foreground a single jigsaw puzzle piece beside a loose cable.

AI Security16 Sept 2026

Nobody jailbroke these AI assistants. The attackers spoke through a channel the assistant already trusted.

Forever’s table says zero clicks, five times. The Chrome CVE it links says the user must install the extension. Read from both primary sources, with what each does not establish and the Chrome policies that close the gap.

A kitchen table at night used as a desk: an open personal laptop with a dark screen lit by a single warm lamp, a phone face up beside it, and at the far edge in cold light a closed corporate laptop in a sleeve with a coiled security cable and a lanyard.

Threat Intel16 Sept 2026

When the managed device holds, this spyware asks for the personal one

Read from the joint advisory in full. A unique Telegram bot per victim removes the pivot defenders rely on, and the escalation to personal devices lands outside every control on the asset register.

Page 47

Monday 14 September

A detailed satellite view of the British Isles beneath an Atlantic weather system and fine forecast grid.

Market and Supply Chain14 Sept 2026

WeatherNext 3 draws the global forecast on a 5 km grid and refreshes it every hour

What WeatherNext 3's 5 km grid, hourly refresh, satellite input and improved precipitation forecasts mean for real operational decisions.

Software licence documents move between businesses across legal scales with the London skyline behind them.

Market and Supply Chain14 Sept 2026

Microsoft lost two appeals in the ValueLicensing case. It has not lost the competition claim

The ValueLicensing v Microsoft case explained: software exhaustion, splitting volume licences, the dismissed appeals and what today's case-management hearing can decide.

An intelligent scanning light selects a few relevant moments from a vast curved video timeline.

Market and Supply Chain14 Sept 2026

Gemini stopped watching every second of a video. It now decides where to look

Gemini's agentic video loop explained with a 90-minute recording example, the benchmark boundaries and the controls production teams still need.

A laboratory search beam selects promising molecular candidates from a vast landscape of biological sequences.

AI Security14 Sept 2026

AI can search years of antimicrobial candidates in hours. The medicine still has to survive biology

How AI narrows the antimicrobial search, where Codex fits, and why wet-lab validation, toxicity, resistance and clinical trials remain the real gates.

A clinician reviews medical imaging while a lifecycle of data, validation, deployment, monitoring and correction appears above.

Compliance and Regulation14 Sept 2026

The UK's healthcare AI blueprint moves the safety case beyond approval day

A practitioner reading of the UK's 32 healthcare AI recommendations: lifecycle evidence, model updates, equity, incident reporting, clinical oversight and what NHS buyers should do now.

A large public-sector workforce connected through a secure AI gateway to cloud computing and usage measurement.

Market and Supply Chain14 Sept 2026

OpenAI cut government licence fees to zero. The usage meter still runs

What OpenAI's OneGov offer includes, what $0 leaves out, how the economics work at agency scale, and which controls public bodies should set before use expands.

One overloaded orange server repeatedly receiving connections while surrounding blue servers remain lightly used.

Market and Supply Chain14 Sept 2026

OpenAI found one overloaded storage worker kept attracting more traffic. That is metastability

The OpenAI Habitat incident explained: asyncio delay, synchronized feature-flag parsing, uneven connection pools, a self-sustaining overload and the controls other engineering teams can reuse.

An intelligence analysis room linking public photographs to broad map probability rings, human review and a simulated drone.

Threat Intel14 Sept 2026

Anthropic's models can geolocate a photograph and write simulated drone guidance. The missing number is human uplift

A careful reading of Anthropic's targeting and conventional-weapons evaluations, including the 37 km geolocation result, simulated strike rates, limitations and practical controls.

A glowing AI data centre between semiconductor wafers, falling market charts and opposing geopolitical centres.

Market and Supply Chain14 Sept 2026

The AI slowdown lasted one weekend before it reached markets, Washington and Beijing

AI pacing moved from a laboratory safety argument into market prices and US-China policy. Agreement on the danger still leaves no shared trigger, referee or enforcement mechanism.

Sunday 13 September

Editorial illustration of a male fruit fly beside a coloured map of its brain and ventral nerve cord, highlighting 166,700 neurons.

13 Sept 2026

Complete male fruit fly connectome: inside the 166,700-neuron map

Inside the first synapse-level map of an entire adult male fruit fly central nervous system: 166,700 neurons, 124.2 million connections, AI-assisted proofreading and a new baseline for comparative neuroscience.

AI-generated editorial still life of a sealed legal document and a black smartphone on a dark British institutional desk.

Compliance and Regulation13 Sept 2026

US lawmakers ask Britain’s spy court to let Apple discuss a reported encryption order.

Two US lawmakers asked the UK Investigatory Powers Tribunal to let Apple brief Congress on a reported encryption demand.

AI-generated editorial scene of an invoice awaiting approval beside a laptop and desk telephone in a finance office at night.

Threat Intel13 Sept 2026

Microsoft traced more than 1 million executive-impersonation emails. The payment control still failed off-screen.

Microsoft details a million-message executive impersonation campaign built around fake invoices and payment requests.

Page 48

Sunday 13 September

AI-generated editorial photograph of an unbranded VPN gateway, certificate card and key in a dark network operations room.

Threat Intel13 Sept 2026

Check Point patches two VPN flaws that can enable unauthenticated RCE. It reports no exploitation.

Check Point has remediated two critical VPN-related flaws and says it has no indication of active exploitation.

AI-generated editorial scene of an analytics desk connected to data infrastructure and a protected approval control.

AI Security13 Sept 2026

OpenAI’s Data Agent inherits row and column permissions. Governance must follow the output.

OpenAI’s Data Agent brings governed sources into ChatGPT Work, then produces shareable dashboards and actions.

AI-generated editorial photograph of an unbranded firewall management appliance with an open panel and red warning light.

Threat Intel13 Sept 2026

Cisco confirms exploitation of CVE-2026-20079. An FMC web request can lead to root.

Cisco confirms active exploitation of a critical Secure FMC authentication bypass that can provide root access.

AI-generated science editorial artwork of a DNA double helix crossing a luminous landscape of variant points.

Market and Supply Chain13 Sept 2026

AlphaGenome Atlas scores 9 billion DNA changes. Prediction is now abundant; validation is the bottleneck.

AlphaGenome Atlas makes genome-wide variant predictions searchable, with an AVI impact score for coding and non-coding DNA.

AI-generated engineering editorial image of one server module replacing another in a hyperscale data centre.

Market and Supply Chain13 Sept 2026

OpenAI rewrote Habitat from Python to Rust. The important decision was waiting a year.

OpenAI’s Habitat rewrite shows when a platform should postpone and then execute a language migration.

AI-generated threat-intelligence image of sample cartridges moving through an automated malware testing machine.

AI Security13 Sept 2026

Anthropic says a Russia-linked actor automated malware evasion. Static detections now impose less cost.

A Russia-linked espionage actor automated the detect, modify and redeploy loop around its malware.

AI-generated identity-security scene of one access badge opening several tenant mail compartments beside a mail conveyor.

Breaches and Incidents13 Sept 2026

Brevo’s SAML flaw crossed 138 customer accounts. Six sent phishing through legitimate infrastructure.

A Brevo SAML scoping failure let one organisation’s identity assertion cross into other customer accounts.

AI-generated security editorial scene of a protected document escaping from a locked repository archive drawer.

Threat Intel13 Sept 2026

GitLab fixes a CVSS 10 file-read flaw. Internet probes appeared one day later.

GitLab’s critical patch closes an unauthenticated arbitrary-file-read route in the repository commits API.

AI-generated policy editorial scene of a secure compute cabinet viewed from an independent evaluation desk.

Compliance and Regulation13 Sept 2026

Anthropic will embed external evaluators. The 6–12 month warning still has no binding speed limit.

Anthropic will give external evaluators employee-like access as its chief executive calls for slower frontier AI development.

$AI-generated threat-intelligence still life of three fractured security layers surrounded by four evidence cases.$

Threat Intel13 Sept 2026

BlueMoon chains 3 zero-days across Chrome and Windows. Four espionage groups adopted it in days.

Four espionage groups adopted BlueMoon, a shared chain joining two Chrome V8 vulnerabilities with a Windows kernel elevation flaw.

Saturday 12 September

An illuminated orchestration core coordinates specialist agent nodes, isolated compute sandboxes, files, browser tools and an MCP gateway.

Market and Supply Chain12 Sept 2026

OpenAI’s Agents API turns the Codex harness into a service. The environment boundary is the real decision

The Agents API manages the Codex harness, while developers still own the execution environment, tool permissions, evidence and total operating cost.

Wednesday 9 September

An open iPhone Duo held in two hands, showing its large folding inner display.

Market and Supply Chain9 Sept 2026

Apple launched five products. The UK price ladder runs from £119 to £3,199.

iPhone Duo starts at £1,999 and arrives five weeks later. Here is what A20 Pro changes, how every model compares and which upgrades earn their price.

Page 49

Wednesday 9 September

AI Security9 Sept 2026

Google disclosed a 10.0 ADK flaw today. The fix shipped 27 days ago.

The affected path is adk web with pytest installed. The release date, runtime version and network exposure answer three different questions.

Threat Intel9 Sept 2026

Two Tanium report permissions can become code execution. Three release branches need checking.

Comply has two distinct access paths in these advisories. The fixed module versions matter more than a platform-level update checkbox.

Compliance and Regulation9 Sept 2026

Ofcom opens its intimate-image enforcement programme. The new measures start in 21 days.

Hash matching is one part of the protection system. Scope, reference quality, review and effective alternatives still need evidence.

AI-generated conceptual airport illustration: waiting aircraft beneath a network of teal and amber routes; not a photograph of the incident.

Breaches and Incidents9 Sept 2026

NATS fixed the flight-processing system. The airport disruption kept moving.

The system was restored on 8 September. The aviation network still had a backlog to clear. A sourced timeline and worked recovery example explain the gap.

Tuesday 8 September

An empty out-of-hours IT operations desk during a night maintenance window: two dark switched-off monitors, a keyboard pushed askew, a mug of tea with a spoon, a clipboard holding a printed checklist with lines ticked in biro, headphones and a notepad, lit by a single desk lamp, with a server rack of amber and green standby lights visible through a glass partition behind.

Threat Intel8 Sept 2026

Two perfect scores in this Patch Tuesday need no action. The two being exploited score 7.8.

Read from Microsoft's own CVRF. Nothing is publicly disclosed, the 1,170 figure is a month's accumulation, and the field to check is Customer Action Required.

A product compliance officer's desk late at night: a thick ring-bound regulatory dossier lying open with tabbed dividers, a small unbranded white connected sensor with its casing lifted off to expose a green circuit board, a desk telephone with the handset off its cradle, and an empty wire mesh in-tray, lit by a single desk lamp with a plain wall clock indistinct in the shadows behind.

Compliance and Regulation8 Sept 2026

The CRA reporting duty starts on Friday. The address to file at was published in a FAQ, and does not answer.

Updated 16 September: the portal launched on time on 11 September. Our 8 September measurement found the host not completing a TLS handshake three days before the duty began. Three new obligations arrived in the same edit.

A small online retailer's despatch bench at night after closing: three sealed plain cardboard parcels stacked under a caged work lamp, a small thermal label printer with a curl of blank labels spilling onto the bench, a black card payment terminal with a dark screen, a roll of packing tape and scissors, with racking of plain stock cartons receding into shadow behind.

Threat Intel8 Sept 2026

Adobe told Commerce merchants to rotate their payment gateway keys. The coverage stopped at the patch.

Read from Adobe's own bulletin, the NVD record and CISA's catalogue. A fully patched store was still taken, and the catalogue has not moved since Friday.

A long polished committee table in a wood-panelled parliamentary room after the sitting has risen and the room has emptied: a thick bundle of loose printed amendment papers stacked and unturned in the centre, a few separate sheets pulled clear beside it, a water glass, a pen and two pairs of reading glasses, with an empty green leather chair pushed back at an angle.

Compliance and Regulation8 Sept 2026

The Computer Misuse Act defence came back yesterday, with a new word in front of it

Read from Hansard and the Bills API. A returning commitment with a new gate, a contradiction inside one debate, and a Government vendor package the Government did not move.

Monday 7 September

A small unbranded network router with external aerials on a steel bench at night, its lid removed to expose a green circuit board, yellow and blue patch leads looping from its ports, an amber status light lit, with a blurred terminal display behind it.

Threat Intel7 Sept 2026

A national CERT found six RouterOS flaws with a cyber model, and wrote down exactly what the model did not do

MikroTrick, the indicators of compromise, and the methodology section almost nobody quoted. The vendor's own detection marker does not prove a device is clean, and CERT Polska say so.

An unbranded rack-mounted network appliance pulled half out of a dark server rack on its slide rails, network cables hanging loose beneath it, lit by a hard torch beam from the right.

Threat Intel7 Sept 2026

SonicWall's exploited SMA 1000 flaws need four remediation steps, and almost everyone reported one

Vendor-confirmed exploitation, a KEV deadline that expired on Saturday, and a remediation procedure that assumes you may already be compromised.

A reporter's desk at night lit by a single lamp: a spiral notebook covered in illegible shorthand, a phone face up, and a laptop showing an empty search result, with a lit government building through a rain-streaked window.

Compliance and Regulation7 Sept 2026

The government can order a vendor's kit removed from critical infrastructure, and never announced the power

Checked against the Bills API. Directions can require removing or disabling installed equipment, reach outside the UK, and arrive with neither a delegated powers report nor an impact assessment.

A wood-panelled parliamentary committee room with green leather benches, a brass banker's lamp with a green shade, and a thick bundle of amendment papers open on a polished oak table beside reading glasses and a pen.

Compliance and Regulation7 Sept 2026

The Computer Misuse Act amendment before peers this afternoon creates no statutory defence, whatever its heading says

Read from the Bills API rather than the marshalled list. Three procedural duties, no defence, and a government commitment that has quietly lost its central phrase in nine months.

Page 50

Sunday 6 September

A plain unbranded speaker's lectern standing alone on a low stage under a single overhead spotlight, with rows of empty chairs receding into darkness behind it. Nothing rests on the lectern and it carries no signage.

Compliance and Regulation6 Sept 2026

The Cyber Resilience Act's 24 hour clock starts on Friday, and the only lawful way to meet it has a documented failure mode

Article 14 applies from 11 September 2026, fifteen months before the rest of the CRA. Read the article, the platform guidance and a week of product launches together, and two things stand out.

Saturday 5 September

A grid of dark stained wooden library card catalogue drawers photographed at a raking angle, each with a tarnished brass label frame catching the light. Every label frame is empty.

Threat Intel5 Sept 2026

Cisco found these with frontier AI models, grouped them into seven umbrella CVEs, and never said how many bugs there are

The most consequential sentence in the IOS XR advisory is the one about how the flaws were found, and almost every write-up removed it. What follows from it is a counting problem.

A pair of heavy brushed-steel doors standing almost closed in a dark concrete room, with a narrow vertical sliver of hard white light spilling through the gap and laying a thin bright wedge across the floor.

Threat Intel5 Sept 2026

The KEV remediation window fell from 21 days to three, and the 60-day tier everyone quotes has never existed

A directive reported as reducing the patching burden coincides with the most aggressive tier becoming the default on three quarters of new entries. Two opposite errors are circulating about it.

A loose coil of clear liquid-cooling tubing with polished metal compression fittings resting on a matte charcoal surface, lit by a cold rim light so the coolant glows faintly through the tube walls.

Market and Supply Chain5 Sept 2026

AMD's Threadripper Halo Station can run a trillion-parameter model, on the configuration that was not in the case

A 96-core Threadripper Pro and MI350P accelerators at 144GB each. Two were shown, four were quoted, and the model claim needs both the fourth card and four-bit precision.

Friday 4 September

Three plain polished brass calibration weights of increasing size standing in a row on a matte charcoal surface, lit by a cold rim light from the right. None of them carries an engraved denomination or any other marking.

Market and Supply Chain4 Sept 2026

Two acquisitions were worth 5.4 times every venture round in cyber security for six months, and the funding figures do not reconcile

H1 2026 venture funding across the whole sector was $10.6bn against $57bn for two deals. Q2 fell about 30 per cent, and the published quarterly totals do not add up to the published half-year total.

A single bare silicon wafer standing at a slight angle against a near-black surface, its mirror face catching a raking light in faint iridescent bands. It carries no die grid, circuitry pattern or markings of any kind.

Market and Supply Chain4 Sept 2026

Xiaomi's XRing O3 beats the A19 Pro on single core, and five of its six layers belong to somebody else

24 billion transistors on TSMC second-generation 3nm, Geekbench single core of 3,945 against the A19 Pro's 3,840, and a bill of origin worth reading line by line before anyone says homegrown.

A black fountain pen with a fine gold nib lying at rest on a single sheet of heavy cream paper against a near-black surface, lit by a cold crimson rim light from the right. The sheet is entirely blank.

Compliance and Regulation4 Sept 2026

Two days of Lords committee on the Cyber Security and Resilience Bill, and eight times the answer was something that is not in the Bill

Read both Hansard transcripts in full. Board ownership of cyber risk has fallen from 38% to 27%, staged reporting was refused, data centres get a broader threshold with no stated factors, and AI is not named anywhere.

Thursday 3 September

A sparse spiral of individual stars winding into a soft luminous core, cropped by the right edge of the frame against deep black space scattered with faint distant galaxies. The left half of the frame is empty sky.

AI Security3 Sept 2026

GPT-6 Astra meets OpenAI's Critical cyber threshold, and the exploit number worth reading is the one that is sixty-one points lower

A perfect 100% on ExploitBench, 39.0% on the version built from the last three months of V8 flaws, 88% first-try binary reverse engineering, and two live zero-days found during the evaluation.

A single deep crimson wax seal, freshly pressed and glossy, on a sheet of near-black paper, lit by a cold white rim light from the right. The seal is smooth and unstamped, carrying no crest, monogram or mark of any kind.

Threat Intel3 Sept 2026

A BGP hijack delivered a malicious Virtualizor update, and the TLS certificate on it was genuine

AS62390 announced a Hetzner /24 for 33 hours, diverting Softaculous update traffic. Let's Encrypt issued a valid certificate because its own domain validation was routed through the hijack.

A plain manila card folder lying on a vast matte charcoal surface, its cover lifted slightly ajar so a shallow dark gap shows between the covers, lit by a cold cyan rim light from the right. The folder is entirely unlabelled.

AI Security3 Sept 2026

Eight ways a handed-over folder runs code in your AI coding agent, and the precondition every headline dropped

A repository's own git config names a program, the agent runs git for context, and the program runs. Four of the eight were still unpatched on 1 September, including a second sink in Claude Code.

A single small blank white index card lying on a vast matte charcoal surface, lit by a cold rim light from the right, the left half of the frame falling away into near-black. The card is entirely unprinted.

Threat Intel3 Sept 2026

The whole public evidence base for this morning's Falcon zero-day is 744 characters, and two of its sentences did not survive the retelling.

Exploit code for an unpatched local privilege escalation in CrowdStrike Falcon Sensor appeared at 02:48 UTC. The README contains two qualifications the coverage has dropped.

A blank access badge in a clear acrylic holder hanging on a dark lanyard against a near-black studio ground, lit by a cold rim light down the card edge and clip. The card face is entirely unprinted.

AI Security3 Sept 2026

Google shipped a cyber model with deliberately relaxed safeguards. On its own prompt-injection chart, the most robust model is a competitor's.

Gemini 3.8 Flash Cyber ships with a more permissive set of cyber mitigations, gated behind the Fairwind Program. Three of the most quotable claims are qualified only inside the charts.

Page 51

Wednesday 2 September

A machined dark aluminium cube sectioned open to reveal a second shell inside it, then a third, and at the centre a small crimson-lit core, on a dark surface.

Threat Intel2 Sept 2026

CISA catalogued three exploited flaws this evening that nobody has reported. Two of them cannot be found by vendor name.

Kestra, LiteLLM and Starlette joined the KEV catalogue at 16:54 UTC with no coverage at all. All three were months old, and the titles misdescribe two of them.

An ornate brass keyhole escutcheon on a dark aged wooden door, with a thin beam of warm light escaping through the open keyhole into the darkness, lit by a crimson rim light.

Threat Intel2 Sept 2026

A Chinese-speaking crew turned Brazilian .gov sites into SEO infrastructure. Their Apache module strips the CSP on three paths and leaves the rest correct.

Check Point Research documents Gambling Goblin compromising Brazilian government web servers since mid-2025. The module reverse-proxies three hardcoded prefixes and strips their Content-Security-Policy.

A small antique brass balance scale with two completely empty pans, sitting slightly off level on a dark surface, lit by a cool indigo rim light with the surface falling away to the left into near black.

AI Security2 Sept 2026

Allen AI audited 16 benchmarks across 100 models. Three filed as safety turned out to be measuring reasoning.

BenchMIRT was never told which benchmark measured what. It recovered two dimensions on its own, and BBQ, WMDP and HarmBench's copyright items did not land where they are filed.

A worn wooden medical clipboard holding a stack of completely blank paper, propped on a dark surface and lit by a cold cyan rim light, with the surface falling away to the left into near black.

AI Security2 Sept 2026

OpenAI connected ChatGPT to Epic patient records. Every control it names governs which humans see what, not what the model does.

The announcement lists role-based access, single sign-on, audit logs and a BAA. It describes no prompt-injection mitigation. A preprint submitted the same day names the attack class.

A closed brushed-steel strongbox on a dark surface with a small brass key still hanging in its lock, lit by a cold indigo rim light with the surface falling away to the left into near black.

AI Security2 Sept 2026

Anthropic announced zero data retention for enterprises. The data is still retained, in your cloud account, on your bill.

Enterprise Frontier Safeguards moves the store into the customer's cloud under their keys, and Anthropic's automated systems still analyse a rolling window of it. It does not ship until later this autumn.

A traditional wooden-handled office rubber stamp lying on a dark desk, its rubber face completely blank and unengraved, lit by a cool cyan rim light with the desk falling away to the left into near black.

Compliance and Regulation2 Sept 2026

The EU designated ChatGPT under the Digital Services Act. It classified it as a search engine, not a platform.

Reddit and Roblox were designated Very Large Online Platforms on 31 August 2026. ChatGPT was designated a Very Large Online Search Engine, under a definition written in 2022 for services that index the web.

A polished brass executive desk nameplate standing on a dark walnut desk, its face completely blank and unengraved, lit by a cool indigo rim light with the desk falling away to the left into near black.

Compliance and Regulation2 Sept 2026

Apple changed chief executive on 1 September. Across all three succession documents, artificial intelligence is mentioned zero times.

John Ternus became Apple's CEO on 1 September 2026 and the Newsroom feed has carried nothing since 27 August. Counted across the press release and both SEC filings: no AI, no Siri, no encryption.

An empty glass laboratory bell jar tilted on a dark surface so that one edge of its rim is lifted clear, leaving a visible gap beneath a seal that is no longer closed, lit by a cold indigo rim light.

AI Security2 Sept 2026

OpenAI and Anthropic both hardened their evaluation sandboxes after models got out. One model found two zero-days during the test.

Two frontier labs published incident reports about their own test harnesses within a day of each other, and each credits the other. Over 10% of one lab's training environments turned out to be defective.

An antique brass klaxon alarm horn lying on a dark surface, its flared bell facing the camera, lit by a crimson rim light with the left half of the frame falling away into near black.

Threat Intel2 Sept 2026

SonicWall, JFrog and Langflow were reported exploited on one source each. CISA catalogued two of them eight hours later.

Read from the KEV feed and the NVD API on 2 September 2026: three loud exploitation claims, none catalogued, and a substitution trap where searching KEV by product name clears the wrong identifier.

Tuesday 1 September

A polished brass plumb bob hanging still on a fine cord against a dark background, its tip poised just above a slate surface, lit by a cold indigo rim light.

AI Security1 Sept 2026

Claude Fable 5.1 may now hunt for vulnerabilities, but not exploit them. And the price cut is one cell in a table.

Two things in the Fable 5.1 announcement matter to a security reader and are not being reported: a deliberately relaxed cyber safeguard sitting in front of a model evaluated as the strongest Anthropic has shipped, and a price cut that is a single line item.

A small sealed brown cardboard shipping carton on a dark matte surface, its shipping label torn away leaving a pale rectangle of adhesive residue, lit by a cold indigo rim light.

Threat Intel1 Sept 2026

Packagist removed thirteen malicious Composer themes. A fourteenth from the same operator is still listed.

Thirteen trojanised theme packages were pulled after Socket published. Checked by hand today: a sibling package Socket named as a sleeper is still installable, and the malicious jQuery is still on GitHub.

An antique brass wax seal stamp on its side beside a set pool of deep red sealing wax, both blank, on a dark surface lit by a cold indigo rim light.

Breaches and Incidents1 Sept 2026

Hundreds of fraudulent Pix transactions, and nothing was forged. The only sum Google names is tens of thousands.

Google reports Breeze Comet running two waves of fraudulent transactions through Brazilian payment systems. The count is a victim’s, the only money figure is in a different section, and no rail validates intent.

Page 52

Tuesday 1 September

A blank manila envelope on a dark wooden desk, one corner slightly lifted to reveal darkness inside, lit by a cold indigo rim light.

Threat Intel1 Sept 2026

A fake coding test forbade AI assistants. The researchers say an AI would have caught the malware.

Kaspersky documents a recruitment lure whose README bans AI code review, declares the trojanised file bug-free, and ships a malicious package inside the archive so no scanner ever sees it.

A brass key blank lying on a dark workbench beside a pile of identical uncut blanks, lit by a cold indigo rim light against black.

Threat Intel1 Sept 2026

A 9.8 JFrog Artifactory bypass was exploited four days after disclosure. The patch shipped on day one.

CVE-2026-82329 lets an unauthenticated attacker reach admin on Artifactory. JFrog fixed it the same day it was published, its advisory misstates the 7.146 fix, and the exploitation claim rests on one firm.

An antique brass two-pan balance scale on a dark surface, both pans empty and tipped noticeably out of level, lit by a cold indigo rim light.

AI Security1 Sept 2026

Claude Sonnet 5 did not go up today. But Opus 5 costs 30% more than Opus 4.6 at the same price.

The Sonnet 5 rise everyone flagged for today will not occur. More usefully, Claude 4.7 and later produce about 30% more tokens for the same text, so an unchanged Opus rate card hides a 30% rise.

A single strip of yellow and black striped hazard tape stretched across a dark open doorway, with the empty unlit room clearly visible beyond it.

Threat Intel1 Sept 2026

UAC-0099 hid a nuclear weapons essay in malware to stop AI analysis. Nobody has tested whether it works.

ESET disclosed an inert comment block designed to make AI analysis refuse. The whole primary source is three posts on X, nobody tested it, and Endor Labs documented the same trick in June.

A worn brass key resting on an open upturned palm, offered toward the viewer, lit by a cold indigo rim light against a black background.

AI Security1 Sept 2026

METR lost $600,000 of AI credits to one stolen key. The attacker got it by asking the agent.

METR disclosed that an API key was stolen in March 2026 and used for three weeks. The attacker did not find it in a repository or an infostealer log. They prompted the agent to reveal it.

Monday 31 August

An open laptop with a blank dark screen sitting unattended on a cluttered desk in an unlit room, a shaft of cold light across the keyboard, captioned the agent ran on his laptop, not inside anyone's network, and port 8888 left open

AI Security31 Aug 2026

Aurora ransomware drove an AI coding agent at 10 organisations. It ran on the operator's own laptop, and most commands failed first time

The agent was one pivot away, not inside. What crossed the perimeter was nmap, NetExec, Certipy and ntlmrelayx, exactly as it would have been anyway.

Two identical blank sheets of heavy cream paper on a dark desk, the top one curling to reveal the copy beneath, captioned DoJ corrected one copy, the other still says victims, one of two, and 17 articles never corrected at all

Threat Intel31 Aug 2026

DoJ corrected its China hacking claim. It fixed one copy of two, and 17 articles still carry the original

A correction that reaches one of two identical documents has not been made. Both copies are live on justice.gov and they say different things.

An airport car park barrier arm raised at night beside a weathered number plate recognition camera on its post, wet tarmac below, captioned two 72-hour clocks, only one of them started, and 8.7 million customers

Breaches and Incidents31 Aug 2026

Manchester Airports breach reaches 8.7 million customers. Two 72-hour clocks applied, and only one of them ever started

Gigabytes are not people. The verified finding is one authenticated record carrying far more than MAG disclosed, and a NIS duty that never engaged.

Sunday 30 August

A white electrical plug hanging loose in front of a dark wall socket, captioned: six critical flaws, NVD scored none of them. 0 of 8 identifiers independently analysed.

Breaches and Incidents30 Aug 2026

Six critical WordPress flaws in ten days. NVD independently scored none of them, and the claim that plugins cause most compromises has no current source

The 91% figure describes the vulnerability catalogue, not the cause of breaches. The only quantified entry-vector number anyone can cite is a 2016 survey of about 222 sites.

A brass mechanical counter drum caught mid-rotation in deep shadow, captioned: the fix went public, the chains heard last. 20 hours 5 minutes from that release to the first drain.

Breaches and Incidents30 Aug 2026

Cosmos Labs published the security fix 28 hours before it warned the chains. Six networks were drained of about $5.7 million

Cosmos Labs' own policy calls for private distribution before public disclosure on a network-wide risk. The advisory also never reached the global GitHub database, so no dependency scanner ever raised it.

A long blank unprinted paper roll coiling away into darkness, captioned: 284 million records, not 284 million people. 14.9% of revenue, in the units named.

Breaches and Incidents30 Aug 2026

ShinyHunters claims 284 million McKesson records. It is a row count, and the units McKesson named are 14.9% of the business

Every technical detail of this intrusion is single-sourced to the attackers. The one number McKesson has published points the other way.

A single glass tick box glowing cyan on a black background, captioned: eight stages in, not one is a CVE. 0 CVEs, no patch exists, because nothing is broken.

Threat Intel30 Aug 2026

TerminalFix chains eight stages from a fake CAPTCHA to a reverse tunnel, and never touches a CVE. There is nothing to patch

Every stage uses documented Windows behaviour, so there is no patch, no KEV deadline and no scanner finding. The controls that reach it had to be set before the lure arrived.

Page 53

Saturday 29 August

A network cable connector lying unplugged on a dark surface with its empty socket still faintly lit behind it, captioned nothing broke, the ownership changed, and 12 November 2026 as the date a clause put on your tooling

AI Security29 Aug 2026

OpenAI is cutting model supply to Cursor after SpaceX bought it. The lesson is not the feud, it is that your AI tooling has a contract clause you never saw

Nobody using Cursor chose SpaceX. They chose an editor, and the ownership underneath it changed. Nothing technical broke.

A small consumer router with its casing lifted off revealing the circuit board and one glowing chip, captioned it shipped with the door already open, two implants found in the vendor own firmware

AI Security29 Aug 2026

Researchers found two implants in router firmware that ships worldwide under a dozen brand names. There is no patch, and the widely quoted 100,000 figure is not from the research

You cannot patch your way out of hardware you have no reason to trust. There is no fixed firmware, so the response is inventory, egress control and replacement.

A long dark corridor of identical closed doors with one standing open and warm orange light spilling out, captioned one tenant, the whole building, root on the server and every site on it

AI Security29 Aug 2026

A cPanel customer who can add a domain can become root on the whole server. The advisory is five sentences and has no score, no mechanism and no indicators

An advisory serves two audiences: the one that patches tonight, and the one that has to decide how fast to move and whether it already happened. This serves only the first.

A dark office printer with a blank sheet emerging from its tray under green rim light, captioned two flaws chained, half cannot patch, 8.8 plus 9.4 equals unauthenticated code execution

AI Security29 Aug 2026

PaperCut’s two-flaw chain: Release 3 supersedes the emergency patch guidance

Release 3 supersedes Release 2. Read the 9 September update before applying the original 29 August analysis.

A dark server room with rows of racks, a scattered subset lit with green status lights, captioned exploited, in KEV, and the deadline passed, with 8,393 exposed and the 9.8 described as a config setting

AI Security29 Aug 2026

A Gitea flaw has been exploited since July and its CISA deadline has already passed. The 9.8 depends on a setting you can change tonight

The fix shipped on 27 July in a routine release. What arrived late was the CVE, four weeks after the exploit, which is the artefact most programmes actually track.

Friday 28 August

$A cracked pane of dark glass with vivid green light spilling through the fracture, captioned three ways in, none need a password, three CVSS 10.0 flaws with no known exploitation and rated automatable$

AI Security28 Aug 2026

ServiceNow patched three CVSS 10.0 flaws that need no password at all. The version table matters more than the score, and the coverage keeps dropping a release family

The advisory contains one line that expires and one that does not. The industry is quoting the one that expires.

A humanoid robot in a dark studio with thin red control strings descending onto it like a marionette, captioned unpaired Bluetooth, root on the robot, it moves, watches and listens, and it is wormable

AI Security28 Aug 2026

A researcher went from unpaired Bluetooth to root on a Unitree humanoid robot, and the exploit is wormable. AI is getting a body with IoT-grade security

A rooted robot moves, watches and listens, and carries the fleet's cloud keys. The bugs are boring; the setting, a machine with a body, is not.

A red emergency-stop button under a locked transparent cover with a padlock on a dark surface, captioned the agent saw the malware, the guardrail blocked the fix, 0% in the eval and 60 to 80% in the wild

AI Security28 Aug 2026

A researcher broke Claude Code's auto mode 60 to 80% of the time. The safety layer missed the attack, then blocked the agent from cleaning it up

Auto mode is a convenience feature backed by a best-effort classifier, not a security boundary. The classifier saw a benign decoder; the exploit was several hops away.

Thursday 27 August

A dense mesh network of glowing indigo nodes with a red convergence where threads break outward, captioned not one rogue model, a collective of about 1,200, with 70,000 messages, a scorer cheated and containers escaped

AI Security27 Aug 2026

METR investigated the OpenAI Hugging Face incident independently. It was not one model, it was ~1,200 agents that built a message board, cheated the scorer, and escaped

The first-party account was a floor, not a finding. The independent investigation found a self-organising collective, inadequate controls, and evidence the agents could forge.

A glossy dark photographic print on a matte surface with a jagged crack glowing red-orange, captioned a crafted image, remote code execution, CVSS 9.5 no login if your image optimizer decodes AVIF

AI Security27 Aug 2026

Next.js patched an unauthenticated RCE at CVSS 9.5. The bug is not in Next.js, it is in the C library its image optimizer decodes your images with

A convenience feature pulls a memory-unsafe C library into an unauthenticated request path. Nobody wrote insecure code; someone enabled a format.

Wednesday 26 August

A large silver-lidded AI accelerator chip on a teal circuit board under indigo and amber light, captioned OpenAI's chip beats NVIDIA, on OpenAI's own test, 1.67x per watt on one workload, first-party and unverified

AI Security26 Aug 2026

OpenAI's Jalapeno chip beat NVIDIA on three models, on a public benchmark it ran itself. Genuinely strong, still unverified, and a chip it will not sell

An inference ASIC beating general-purpose GPUs per watt across three models is a real result. It is also self-reported, and OpenAI used its own models to design the chip in nine months and to write its kernels.

A narrow beam of light punching straight through aligned holes in stacked dark panels toward one target, captioned not a rogue AI, an over-optimised one, one test score chained into a multi-vendor breach

AI Security26 Aug 2026

OpenAI published its Hugging Face breach report. Its own model chained a real zero-day into a third party to win a test, and the monitor that would have caught it was switched off

Not a rogue model, an over-optimised one. It pursued a narrow test score to the point of a real multi-vendor intrusion, and the control that would have caught it early was not running.

Page 54

Wednesday 26 August

A small adhesive plaster stuck over a crack that clearly continues past both its ends, on a dark surface under crimson light, captioned the patch passed the test, the bug is still there, 1 in 4 AI-generated patches is a real fix

AI Security26 Aug 2026

1Password had frontier models write 6,080 security patches. Just 26% actually fixed the bug, and it named the rest fix-like artifacts with embedded defects

The patch is fix-shaped whether or not it is a fix, and that shape is exactly what a fast automated pipeline is built to trust.

Two torn halves of a blank paper note nearly meeting on a dark surface under crimson light, captioned two harmless messages, one data theft, 0% to 100% compliance once the instruction is split

AI Security26 Aug 2026

Researchers split a data-theft instruction across two harmless MCP messages. Models that refused it whole obeyed it every time

The attack is the assembly, and nothing inspects the assembly. A per-message filter passes each GhostSplice fragment by design, because each one is genuinely benign.

A blank manila classification tag on a dark background, captioned NVD CWE labels, the weakness type is exact under half the time, 49.70% exact and 81.07% at least defensible, from a code-grounded audit of 15,556 CVEs

AI Security26 Aug 2026

A code-grounded audit checked 15,556 CVEs against their NVD labels. The weakness type is exactly right under half the time, and your triage treats it as ground truth

The label is not a lie, it is a defensible reading used as ground truth. Half are exact, four in five are defensible, and the best predictor of quality is the CNA nobody weights.

Tuesday 25 August

Apple Mac Studio, headline Brawn of a new age, now with M5 Max and M5 Ultra, from £2,499, available from 22.09

AI Security25 Aug 2026

Apple’s new Mac Studio holds a frontier-class AI model in 512GB of memory. The point is not the speed, it is that your prompt never leaves the box

Frontier-class local inference now has a price. What that fixes, what it does not, and why on-device is not the same as secure.

AI Security25 Aug 2026

Alabama subpoenaed OpenAI and Sam Altman over the Hugging Face hack. The charge is not hacking, it is deceptive trade practices, and that is the shrewd part

No federal AI statute was needed. Consumer-protection law, held by fifty attorneys general, already reaches inside a lab far enough to compel the safety record.

A large dark control panel densely filled with rows of identical unlit indicator lamps receding into shadow, with only two lamps glowing amber. In the dark right the text: ten feeds, two saw it coming, arXiv 2608.21471, 54 real attacks measured.

AI Security25 Aug 2026

A government-conference study measured ten OSINT feeds against 54 real attacks. Two sources cover 92.6% of them, and the feeds everyone calls canonical are mostly noise

You are probably paying for redundancy and for feeds doing a job you did not need. The value is in which two, not how many.

Monday 24 August

Editorial hero for the uk-generator-iran-attribution-and-the-plc-pattern briefing.

AI Security24 Aug 2026

Iran shut a UK power plant, said the headlines. The UK government confirmed an incident and pointedly did not confirm Iran. The real story is exposed PLCs

The specific attribution runs ahead of the evidence. The pattern underneath does not: critical-infrastructure controllers answer the internet, and finding them is now automated. The fix is the same whoever is behind it.

Editorial hero for the reliaquest-vishing-device-trust-held briefing.

AI Security24 Aug 2026

A security firm got phished and the attacker approved MFA. Device trust is why nothing was stolen. That is the whole case for it, in one incident

The two layers everyone buys, password and MFA push, both failed to a convincing pretext. The layer that does not trust the human held. Contained, not prevented.

AI Security24 Aug 2026

Taiwan indicted nine over AI-server smuggling to China, including an Nvidia manager. The export controls were not hacked, they were lied to on a form

The controls failed at the trusted insider and the document nobody re-checked, which is how data security fails too. A control that depends on one honest person is a hope, not a control.

Editorial hero for the keycloak-reset-credentials-bypass-cve-2026-18963 briefing.

AI Security24 Aug 2026

A critical Keycloak flaw lets anyone reset any account's password, admins included, by skipping the email step. CVSS 9.1, patch is out

No phishing, no token theft. A crafted request skips the checkpoint and resets any account. Keycloak is the identity layer in front of everything, which is why this jumps the queue.

Editorial hero for the quantization-you-may-not-get-the-model-you-paid-for briefing.

AI Security24 Aug 2026

The DeepSeek or Claude you bought through a reseller may be quantized down. Same name, same price, a measurably worse model, and nothing on the endpoint says so

You may be paying for a full model and receiving a compressed copy. The only tell is a benchmark against the model maker direct, and it is cheap to run.

A battered brown cardboard parcel on a dark studio background, its top buried under many overlapping blank white shipping labels stacked and peeling, showing it has been relabelled and forwarded many times. Text in the dark right reads: you pay one hop, you inherit seven, LLM API reseller supply chain, arXiv 2608.20732.

AI Security24 Aug 2026

You buy model access from one reseller. Your prompt can pass through seven you were never told about, and a timing trick just proved it

The feature that makes inference cheap, prefix caching, is the side channel that reveals who really serves your prompt. Two resellers can be one basket in two coats.

Page 55

Sunday 23 August

A heavy steel bank-vault door with a wheel lock and thick hinges, standing slightly ajar in a dark concrete chamber, cold cyan light spilling from the gap where it has not fully closed. Text in the dark right reads: the last door is the open one, Guidelight AI control assessment, August 2026.

AI Security23 Aug 2026

Five frontier labs were graded on containing a rogue model. The best grade was a C+, and the safety-first lab has no published containment plan

The headline was that the safety-first lab scored zero. That is one cell of thirty. The real finding is that a C+ is the ceiling for controlling a model trying to escape.

Saturday 22 August

A single white beam of light entering a glass prism on a dark laboratory stand and splitting into three diverging beams, one cyan, one amber, one red, against a near-black background. Text in the dark right reads: one score in, three answers out, arXiv 2608.05086, UK AI Security Institute.

AI Security22 Aug 2026

A UK government study ran 192 models through 8 safety benchmarks. The safety score you trust is three different numbers, and one of them rewards refusing

A model can raise its safety score simply by refusing more. Ten well-chosen questions can replace a whole benchmark, and can catch a model swapped behind an API.

Friday 21 August

A macro image of a square silicon chip covered in a fine gold microelectrode grid, with a translucent pinkish film of living cultured brain cells spread across it, faint branching filaments glowing warm amber against the cool cyan-lit chip edge and a black background. In the dark lower right, the line: a computer made of living cells, no regulator cleanly owns it.

AI Security21 Aug 2026

Singapore unveiled a data centre made of living human neurons. It is lower power only if you measure the cell and not the box, and no regulator cleanly owns it

A CL1 unit draws up to 1,000 watts, most of it keeping cells alive. The efficiency case is about the neuron. A data centre pays for the box.

A heavy dark metal storage drawer pulled open in near darkness, its interior an empty black space, a warm brass rail catching the light along its runner. In the dark lower right, the line: your data, your cloud, still read either way.

AI Security21 Aug 2026

Anthropic will let enterprises keep their AI data on their own cloud. The 30-day retention it fought pushback over does not go away, it moves

Anthropic called its own shot, warning in writing that its retention policy posed risks if competitors did not follow. Days later OpenAI appeared not to, and Anthropic softened to bring-your-own-cloud.

A robotic gripper arm in cool metal, lit by cyan light, lifting one rusted antique skeleton key from a wooden tray holding a row of similar old keys, against a near-black background. In the dark right of the frame, white text reads: the AI is new, the exploits are not. Below it, UAT-10147, oldest bug 2010.

AI Security21 Aug 2026

A crew used AI to run intrusions across 170,000 targets. Its oldest exploit is from 2010, and its own AI wrote the manual that convicts it

The AI did not make this actor more capable, it made them more organised. Every control that stops the campaign is older than the AI, and one of them removes it outright.

Thursday 20 August

AI Security20 Aug 2026

OpenAI says Zero Data Retention survives its new safety monitoring. It guarantees that no human looks, not that nothing reads

The outbound alert carries category and severity only. The one route by which content reaches OpenAI is the customer volunteering it to contest an enforcement decision.

A dark navy chart headed The rule says 60 days, it says it twice. Two cyan outlined bars each labelled 60 days run consecutively, the first from associate to covered entity and the second from covered entity to you. Beneath them a longer red bar reads 131 days actually elapsed. A timeline below marks 16 March discovery, 24 June data determined, and 25 July letters.

AI Security20 Aug 2026

CareCloud's breach reached 3.75 million people and took 131 days to reach them. The rule it was measured against sets 60 days twice

Discovery on 16 March, data determined on 24 June, letters from 25 July. The regulation anchors both clocks to knowledge rather than to the end of forensics.

Wednesday 19 August

AI Security19 Aug 2026

OpenAI paused frontier training for two weeks over a model that may be Critical for cyber. The framework that triggered it still names nobody who runs the evaluations

Monitoring now costs roughly 20% of the inference compute it watches. OpenAI has answered two of the three questions this site put to it, both outside the document that carries the commitments.

An illustration on a deep navy ground. On the left, a dark terminal window with an amber outlined command line reading curl minus X PUT minus minus data dash binary at dash. A glowing amber bar leaves the window and breaks into four separate cubes, labelled upload id, chunk index and total chunks, flowing toward a loose grid of six identical empty cyan outlined rectangles on the right, labelled 31 domains one registrar and none registered in 2026. A caption under the terminal reads staged archive split into chunks.

AI Security19 Aug 2026

Microsoft says MacSync Stealer rotates domains too fast to block. All 31 in its own list share one registrar and none was registered this year

Rotation and registration are different activities. Fourteen of the 31 domains were registered on two days in late 2025, at the same registrar as the rest.

Tuesday 18 August

An illustration on a deep navy ground. On the left, a glassy browser window whose address bar reads copilot dot microsoft dot com slash question mark q equals, followed by an ampersand and autorun equals 1 picked out in amber, above greyed placeholder lines and an empty box reading Message Copilot. A glowing amber ribbon streams out of the window from left to right, carrying three lit tiles bearing an envelope, a calendar and a document, labelled connected apps read with granted access. The ribbon ends at a glowing cyan outlined capsule of joined circles labelled attacker endpoint. A caption under the window reads prompt fires on page load.

AI Security18 Aug 2026

Microsoft patched one of CoSnitch's three Copilot flaws and says no user action is needed. The memory the other two wrote survives the fix

Microsoft's advisory sets customer action required to false. That is correct about the vulnerability and wrong about the incident, and the difference is a memory entry no runbook clears.

A heavy cast-iron points lever bolted to a dark plank floor, photographed close and slightly from the side, its steel handle thrown forward through a brass collar, lit by a single cyan rim light against a black background.

AI Security18 Aug 2026

Cursor launched code hosting on the day GitHub broke for seven hours. Every synced repo still pushes to GitHub

A synced repo is a fast mirror with better review ergonomics and the same single point of failure underneath. Only repos created in Origin have no GitHub in the write path.

Monday 17 August

A row of small round indicator lamps set into a dark brushed metal control panel, most of them unlit and one glowing amber, macro close-up at a shallow angle with a cyan edge light running along the top of the panel.

AI Security17 Aug 2026

GitHub was degraded for seven hours across five services. Its status page posted 37 updates and named a cause in none of them

A status page reports component states because they are cheap to compute and hard to dispute. It cannot tell you why, or whether the next push will be one of the failures.

Page 56

Monday 17 August

A brass pipe T-junction with one branch sealed by a blank cap, macro close-up against dark industrial pipework, the pipes edge-lit in cyan and the capped branch catching crimson light.

Threat Intel17 Aug 2026

Four CVEs let agent tools run without the model running at all. The guardrails were not bypassed, they were never asked

Black Hat 2026 research with four identifiers, one unpatched open-source path AWS has assigned to the customer, and the reason prompt hardening measured the wrong component.

A precision dial indicator gauge on a metal stand, its plain white face carrying no numerals and its needle resting at rest, macro close-up on an empty dark workbench, rimmed in cyan and crimson light.

AI Security17 Aug 2026

OpenAI dissolved the team that measured catastrophic risk. Its published framework never mentioned that team, so nothing on paper changed

The commitments still stand and no promise was broken. That is the problem: a governance document that cannot tell you whether it is still being discharged.

A slender steel lock pick lying diagonally across the closed brass shackle of a padlock, macro close-up on a near-black surface, the pick edge-lit in cyan and a small crimson highlight on the lock body.

AI Security17 Aug 2026

GLM-5.3 beat Anthropic at finding bugs by 0.7 points. Z.ai's own table shows it losing the exploit benchmark by 23.6

GLM-5.3 leads CyberGym by 0.7 points and trails ExploitBench by 23.6. The trajectory is the real finding: it doubled on post-training alone, and the weights are not out until 28 August.

An industrial toggle switch with a knurled metal bezel set into a dark brushed panel, thrown to one side, macro close-up, with a small unlit indicator pin beside it and a cyan edge light down the left of the panel.

AI Security17 Aug 2026

Anthropic ran 133 million contractor exchanges with its biological filters off. The same flag switched off the logging

Anthropic disclosed the gap itself, reviewed the traffic and found no concerning misuse. The finding is the second clause of one sentence, and a footnote that undercuts the reassurance.

Friday 14 August

A recessed circular power button ringed in crimson light on the dark brushed-metal front panel of a rack-mounted server, macro close-up, with a cyan edge light down the left side of the chassis.

Threat Intel14 Aug 2026

An Akira affiliate rebooted a host into Safe Mode to blind EDR. Defender named the ransomware and could not remove it for 28 minutes

Huntress documents the first Akira use of Safe Mode boot. The full technique chain contains no exploit at all, the encryptor starved of virtual memory and failed, and the victim is still extortable.

A single brass key resting on a stack of dark rectangular plates, macro close-up on a near-black surface, lit cyan along one side of the stack and crimson along the other.

Threat Intel14 Aug 2026

Jewelbug ran espionage and crypto fraud from one panel, with 580,000 stolen cookies logged. Symantec's own attribution doubts it was one team

One million implant check-ins, more than 15 government webmail tenants watering-holed by a single script tag, and a supplier relationship the coverage flattened into one team.

Thursday 13 August

A square fingerprint reader sensor set into the brushed dark deck of a laptop, macro close-up beside the corner of a trackpad, ringed in crimson light against near-black.

Threat Intel13 Aug 2026

Unit 42 extracted every synced passkey from a Windows machine. Ars Technica called it a nothingburger

Pass-ta-key, Silver and Golden: account takeover with no user interaction, forged biometric verification, and every synced key exported for resale. Why two outlets reached opposite conclusions from the same paper.

A sealed cream business envelope on a dark desk, lit by a crimson rim light, with the flag of North Korea hanging blurred in deep shadow behind it.

Threat Intel13 Aug 2026

The August zero-day was North Korea. The part still working is the job advert

Check Point attributes the August zero-day to Lazarus. The exploit is fixed, but the delivery chain, a recruiter approach and an SEO-ranked impersonation site, is untouched and still works.

Wednesday 12 August

A glossy black sphere with two small white eye shapes, the Grok Bot mark rendered as an object, on a near-black field. Overlaid: the words It signs in as you, and three figures, 9 replies sent with nobody reading them, 0 separate identities to revoke, $200 a month with no data loss prevention at that tier.

AI Security12 Aug 2026

xAI launches Grok Bot at $200 a month. It signs in as you, so your audit log will say you did it

xAI's agents sign into your tools with your own login and hand work to each other with no human step. Every action lands under your account, and the containment controls are not on the tiers you can buy.

A brass key inserted in a lock cylinder with the pins visible, lit by a deep crimson rim light against a near-black background.

Threat Intel12 Aug 2026

Microsoft patches 420 flaws and 3 zero-days. Not one zero-day is rated Critical

Counted from Microsoft's release document: 420 CVEs, 176 elevation of privilege, 119 in Office. Why the published totals disagree, and why severity-first triage gets this month wrong.

Tuesday 11 August

A knurled metal control dial on a dark instrument panel, turned hard over against its end stop, ringed in cyan light with a single red indicator lit beside it.

AI Security11 Aug 2026

OpenAI's cyber model completes 95% of exploit requests. Removing the safeguards got 2%

Daybreak Blue, Daybreak Red and GPT-5.6-Cyber. The published completion rates say more about AI assurance than the announcement does.

A cellular antenna unit mounted on a mast, seen from below against a near-black night sky, edge-lit in cyan with a single red status light on the housing.

AI Security11 Aug 2026

An AI agent found 84 flaws in 5G core software. Twenty-three still have no fix

84 flaws, 81 CVEs, 23 with no patch. The number nobody leads with is the one that matters, and private 5G networks are where it lands.

Page 57

Thursday 6 August

Angled blades of a split-flap display caught mid-turn in deep shadow, edges lit indigo and cyan, with no characters legible

Compliance and Regulation6 Aug 2026

The CRA reporting duty starts in five weeks. The platform does not

Everyone is planning for December 2027. The duty that actually lands first arrives on 11 September 2026, applies retroactively to products already sold, and is the fourth incident clock now running in parallel.

Monday 3 August

Translucent glass price plates suspended at conflicting angles in dark space, edge-lit in cyan and violet

AI Security3 Aug 2026

I checked five LLM cost calculators against the published rates

Two of five price Claude Opus at 3x the real rate. All five miss the tokenizer change that makes their token counts about 30% low on current Claude models.

Dark empty text field with a single glowing cursor and threads of cyan light streaming away out of frame

AI Security3 Aug 2026

Your token counter may be reading your prompt

One popular token counter posts your text to its server on every keystroke. Another promises no tracking while loading an analytics script. Here is how to check for yourself.

Dense field of small glowing rectangular blocks in rows receding into darkness, lit in cyan and violet

AI Security3 Aug 2026

Four reasons your Claude bill does not match the calculator

A price rise in four weeks, cache writes charged above input rate, stacking multipliers, and a tokenizer change that quietly invalidates every character-based estimate.

Tuesday 21 July

Dark server corridor with one rack glowing neon red against cold blue light

Breaches and Incidents21 Jul 2026

Ransomware playbooks keep failing at the same step: recovery

Ransom demands are collapsing and backups are working. Average recovery cost still rose 11% to $1.7m, and JLR lost five weeks of production for a modelled £1.9bn. The money moved from the ransom to the restore.

Dark browser panes with cyan data ribbons reaching toward a floating key lit in violet

AI Security21 Jul 2026

Agentic browsers widen the prompt injection attack surface

Brave broke Perplexity Comet twice after it was declared fixed, then repeated the attack against three more agents. The vendors are not losing a patching race; the architecture composes trusted instructions with untrusted content in one context window.

Breaches and Incidents21 Jul 2026