The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 325 to 336 of 658 briefings

Wednesday 30 September

Threat Intel30 Sept 2026

Two of at least 40 ClickFix incidents came through a custom GPT, and the chatgpt.com address proved nothing

A confirmed share of at most 5 per cent, four comforting labels and one command the person ran themselves: what Huntress's 28 September report establishes about custom GPTs used as ClickFix lures, and what it leaves open.

AI Security30 Sept 2026

OpenAI's worm-style prompt injection report gives four transcripts and no rate; academics measured 63% elsewhere

What OpenAI's report shows, what it leaves out (a rate, a second infected agent, any test of dots), what AgentWorm, Morris II, Mind Viruses and a Copilot for Word case measured, and which controls break the loop.

Tuesday 29 September

AI Security29 Sept 2026

Dots run on Astra and Sol costs a fifth as much: OpenAI rates both Critical for cyber, and no launch page says so

Sol reaches 68% of Astra's recent-exploit rate at a fifth of the list price. What the dots appendix measured, why UK Pro users are excluded, what the tiers cost in pounds, and 49 days between Grok Bot and dots.

Market and Supply Chain29 Sept 2026

PhantomSub follows channels, not groups, and a public record of it predates OX's report by 125 days

The headline says groups. The analysis shows a follow of a channel, run inside the paired session, and OSV recorded the behaviour on 26 May. Today the npm registry still serves 85 of the 101 names, and four of the five most downloaded have no public malware record.

Breaches and Incidents29 Sept 2026

DIVD says an AI agent hacked it. Its evidence is tempo and code comments, and the flaw is still unnamed

The record as of 29 September: an intruder that decided each step at machine speed, explained itself in code comments and fought its own tools. The flaw, the attacker, the model and the data outcome are all unstated.

Compliance and Regulation29 Sept 2026

Ofcom is examining an Apple age signal 140 days after go-live: the duty stays with the site

Ofcom's case CW/01358/09/26 examines Aylo's due diligence and testing, not Apple's system. A reading of Ofcom's case page, guidance and the Act on what an investigation is, what highly effective means, and what to ask of any third-party age check.

AI Security29 Sept 2026

Google-owned Wiz offers critical infrastructure a free AI scan. Its terms accept no liability for disruption

Google's AI scanning offer to critical infrastructure is run by Wiz. Five terms clauses grant permission and disclaim liability; the limits, human review and stopping points sit on a policy page the terms never mention.

Market and Supply Chain29 Sept 2026

A firewall rule opened a VPN path to 50 million immigration records, in an account of the early 2010s

One former security officer's account of a firewall rule that linked a shared VPN to a classified immigration records server. It is a path, not a breach, and it is more than a decade old.

Breaches and Incidents29 Sept 2026

Elsevier's domain record sat unchanged for 342 days, yet three of its addresses went to a LAPSUS$-branded page

A redirect changes where a name points, and the public record shows the registration layer stayed still. What is missing is the layer that moved, the real length of the window, and anything beyond Elsevier's own "no indication".

Breaches and Incidents29 Sept 2026

Bitget says it found the root cause on 25 September. It described it three days later and names no product

Bitget's account moved from a compromised backend system to a flaw in an unnamed third-party security product. The two are layers of one chain, not rivals, but the wording around them keeps shifting and the report that would test it is late.

Breaches and Incidents29 Sept 2026

ShinyHunters: the official record was 105 words on 28 September. On 29 September the Dutch police published a full statement

The record moved in a day: a 40 word police post became a full statement with two suspicions, a custody ruling and a statement that the man was not arrested over Odido. The FBI claim is still a claim, and nothing official links the two.

AI Security29 Sept 2026

Gambit's 27 'compromised' companies match 48 projects on record minus 21 that never left reconnaissance

The headline says three open source AI agents broke into 27 organisations. The recovered chart says 21 of 48 projects never left reconnaissance, 8 more got lesser access, and the one documented chain needed no CVE and no new class of control.