The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 373 to 384 of 658 briefings

Sunday 27 September

27 Sept 2026

Nine hours offline, zero confirmed breaches: why Kiteworks told customers to shut down

What Kiteworks disclosed, what it did not disclose, and why a planned outage can be a rational security control when the expected attack window matters more than service continuity.

Saturday 26 September

Threat Intel26 Sept 2026

Nothing on the machine was locked. Five documented browser features, all working exactly as specified, made it look that way

There is no malware in this chain and nothing on the computer is affected. The product being manufactured is panic, and the delivery is ordinary paid advertising through uncompromised publishers.

Market and Supply Chain26 Sept 2026

Microsoft is withdrawing the role that serves PXE. Its own documentation for the replacement says the protocol is not secure

A deprecation withdraws a product. It does not move a trust boundary. The hands-free scenarios were switched off by default 160 days before the notice arrived, which is the part your change process probably missed.

Threat Intel26 Sept 2026

The marketplace listed 321,372 products to 18,000 users. In nine years it made 7,600 sales and $232,000

A listing is not a sale and a registered account is not a customer. The Rydox court record contains both measures, and the gap between them is the story that the word marketplace hides.

Threat Intel26 Sept 2026

Three separate mechanisms can each hand a scanner a clean page. A single automated fetch meets all three

A clean result from an automated check is not an observation about the site. It is a decision the operator made about the checker, and this chain makes that decision at three independent points.

Breaches and Incidents26 Sept 2026

Revolut stopped sending customer data to this provider up to 33 months ago. The records were still there

Migrating away from a processor removes the future risk and leaves the historic risk exactly where it was. Storage limitation is a legal duty, and it is also the only thing that would have helped here.

Compliance and Regulation26 Sept 2026

Eleven days from identifying the incident to telling anyone. The 72 hour clock is a different clock

The reassurance is about the public, whose data the force says shows no evidence of compromise. The exposure under investigation is staff data, and for a police force that is not ordinary employee information.

Threat Intel26 Sept 2026

Every link in this chain is a legitimate paid service. The only malicious artefact is a configuration

The impersonated products do not exist: none of the three payroll platforms ships a desktop app. Allure Security counted 291 downloads and said plainly that some of them were researchers.

Threat Intel26 Sept 2026

Reported on the day it shipped, fixed two days later, and two million sites took the flawed version anyway

Nobody in this story was slow. The flaw is a CSRF check that skips validation whenever a literal string appears anywhere in the request URI, and the query string is written by whoever composes the link.

Threat Intel26 Sept 2026

The only version listed as fixed was a beta of the next major release. The branch everyone runs got nothing

What eventually forced the backport was a ransomware gang's leak site being defaced. Grav shipped a 1.7 fix the day after the details became public, 144 days after the advisory.

AI Security26 Sept 2026

Anthropic published three numbers for overseeing its own agents, and named a fourth it did not publish

A blocked rate is not an error rate and not a danger rate. It is the rate at which one company's classifiers stopped its own agents, and without a catch rate there is no way to read it in either direction.

Threat Intel26 Sept 2026

Seventeen flaws, two official scores each. Six cross a severity band, and every one of them crosses upward

The flaw that gains the most, 8.1 to 9.2, is a firmware verification weakness on a dashcam with no fix, from a vendor that has not responded to CISA. A robot vacuum is filed under Information Technology.