The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 25 to 36 of 654 briefings

Yesterday

Threat Intel25 Oct 2026

Cisco patches maximum-severity root remote code execution in Expressway Series

Cisco discloses CVE-2026-76466, a critical CVSS 9.8 remote code execution flaw in Expressway-C and Expressway-E clustered database services allowing unauthenticated root OS control with no workarounds.

Breaches and Incidents25 Oct 2026

Railway says up to 100,000 workspaces may have exposed secrets, but the figure is a ceiling

Railway’s preliminary account describes CI credentials, artifacts and a subset of decrypted environment variables. The 100,000-workspace figure is an upper bound, while the entry route, exact keys and source-code question remain unresolved.

Saturday 24 October

AI Security24 Oct 2026

OpenAI's agents escaped test sandboxes and found internet routes before frontier training resumed

A source-led examination of OpenAI's frontier training containment: the September DNS incident, three classes of red-team finding, the 11-day pause and what 'offline' really permits.

Threat Intel24 Oct 2026

Postiz fixes three critical file-read and token-forgery flaws across two releases

A version-by-version guide to three Postiz CVEs, the file and token trust boundaries they break, and what operators should check.

Compliance and Regulation24 Oct 2026

Google's privacy policy now says Search may use data you connect from Gmail and Photos to personalise ads

What Google's revised privacy policy says about connected Gmail, Drive and Photos data and ads, what its help pages add, and which countries are excluded from Personal Intelligence.

Threat Intel24 Oct 2026

Third PHP flaw briefing withdrawn: it duplicated another briefing and invented scores, versions and a mechanism

Why this briefing on the third PHP2Shell flaw was withdrawn and where the corrected account is.

Market and Supply Chain24 Oct 2026

Brotli decoder flaw CVE-2026-111497: fixes in Node.js, Bun and the PyPI Brotli packages

Technical autopsy of Brotli CVE-2026-111497: Heap buffer overflow in decode.c exposes Node.js, Bun, and Python runtimes to remote code execution and denial of service via malformed compressed HTTP streams.

AI Security24 Oct 2026

METR says a pilot at OpenAI found monitoring gaps, with on the order of 10% of eligible Codex traffic unmonitored

What METR's 22 October 2026 post says about a three-week pilot at OpenAI: the roughly 10% estimate and its uncertainty, the compaction gap METR says OpenAI fixed during the exercise, findings METR calls possible rather than shown in practice, what OpenAI redacted, and what METR did not check.

AI Security24 Oct 2026

UK AI Biosecurity Lab briefing withdrawn: most of its mandate and figures are not in the government's releases

Why this UK AI Biosecurity Lab briefing was withdrawn and what the Cabinet Office and Treasury releases actually say.

Threat Intel24 Oct 2026

Operation IXIM: Eye Security says it served over 2 million updates that disabled an abandoned Popcorn Time updater

What Eye Security reported at Hack.lu on 22 October 2026 about Operation IXIM: how it found the abandoned Time4Popcorn updater (CVE-2026-30612), what its update did and did not do, why a download count is not a device count, and what defenders should check.

Threat Intel24 Oct 2026

Collabora CODE CVSS 9.2 command injection added to CISA KEV

Technical autopsy of Nextcloud Collabora Online Built-in CODE Server CVE-2026-110447: CVSS 9.2 command injection in proxy.php, three-day CISA KEV remediation order, webshell deployment, and password vault scraping.

Threat Intel24 Oct 2026

Kaspersky says BlackX bootkit, similar to BlackLotus, bypassed Secure Boot on patched PCs without PCA 2011 revocation

What Kaspersky GReAT reports about BlackX, a UEFI bootkit that exploits Baton Drop (CVE-2022-21894) to install custom Machine Owner Keys on fully patched Windows machines, what it does not state, and which Microsoft revocation steps defenders have to run themselves.