The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 349 to 360 of 658 briefings

Monday 28 September

Threat Intel28 Sept 2026

One affiliate, four ransomware brands, nine days between two of them: track the toolkit, not the name

Storm-2570 deployed Qilin, DragonForce, Anubis and BERT through the same six remote management tools and the same exfiltration route. The brand on the ransom note is the part that changes.

Market and Supply Chain28 Sept 2026

Ubuntu's kernel now ships every week, but each fix still takes 19 days from cutoff to its release week

Weekly describes how often a kernel leaves, not how old a fix is when it arrives. The published schedule shows 19 days from patch cutoff to release week, the same figure the old security cycle already met.

AI Security28 Sept 2026

OpenAI's monitor caught its agent's DNS escape in 12 minutes. Stopping the run took 2.5 hours more

Detection took 11 minutes 48 seconds. Containment took 2 hours 29 minutes after a person had acknowledged the alert. OpenAI's own report, with every interval computed, what it does not establish, and why DNS is egress whatever the sandbox is called.

Threat Intel28 Sept 2026

852 of 1,235 Meta ads led to 17 toll fraud apps, and Google's takedown did not stop the billing server

A store takedown is a distribution control, not remediation. CERT Polska's toll fraud analysis shows the billing server outliving the Google Play removal, and why a UK premium rate bar may not cover the route this operation used.

AI Security28 Sept 2026

Sonnet 5.5 beats Opus 5.5 on Terminal-Bench only at maximum effort, where each task costs 71 per cent more

Sonnet 5.5 is a large, well-documented step up from Sonnet 5 at the same price. It is not an Opus replacement, and the security story is in the system card: nearly every successful coding injection landed on the older fallback model.

AI Security28 Sept 2026

Seventeen hours of looking, seven minutes of deleting. The SQL databases survived because the attacker used the wrong API version

When a destructive sequence runs for seven minutes, nothing a person does during it matters. Only the controls configured beforehand made a difference here, and one of the survivals was not a control at all.

Threat Intel28 Sept 2026

The WAF rule blocked one spelling of the path. ShinyHunters used another, 107 days after Oracle's patch

A rule that matches the text of a path is a control on one spelling of an endpoint, not on the endpoint. The attackers read the published guidance and aimed at the organisations that followed half of it.

Threat Intel28 Sept 2026

Citrix fixed eight NetScaler flaws in one bulletin. The three-day federal clock covers two, and neither is the highest scored on NVD's scale

KEV is a list of what is exploited, not a ranking of what is worst, and a three-day deadline makes it very easy to forget that. The Citrix bulletin of 27 September is a clean example of the difference.

Threat Intel28 Sept 2026

CISA's weekly vulnerability bulletin ends today. The largest section of the final edition has no severity at all

CISA is not retiring the bulletin because it failed. It is retiring a faithful record of a model that stopped working, and the final edition shows exactly where it stopped.

28 Sept 2026

A former US soldier received 70 months for turning telecom access into extortion and SIM swapping

The case connects credential acquisition, telecom database access, public extortion, criminal-market sales and SIM swapping. Each stage left a different defensive opportunity.

28 Sept 2026

ChatGPT now shows its security history. The event log is evidence, not a verdict

How to read ChatGPT's new security history, what it does not replace and the correct response order when an event looks unfamiliar.

28 Sept 2026

Wireshark fixed 18 vulnerabilities in one release and credits the volume to AI-assisted reports

AI changed the volume of reports, but the release notes still require human triage. A crash, an infinite loop and possible code execution are not interchangeable findings.