The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 373 to 396 of 667 briefings

Sunday 27 September

27 Sept 2026

Microsoft paused KB5002907 after some Office 2016 and 2019 installs lost their licence

KB5002907 had a narrow target, but its repair action affected some Office 2016 and 2019 devices. The rollout is now paused.

27 Sept 2026

Claude Opus 5.5 cuts token prices 20%. Anthropic's 40% claim needs one more number

Opus 5.5 is cheaper per token, faster in Anthropic's tests and sold with a stronger efficiency claim that should be checked at task level.

27 Sept 2026

Gemini added 14 Connected Apps. The permission screen is now part of the product

Airtable, Linear, monday.com, PandaDoc, Adobe, Webflow, Experian and seven more services are joining Gemini's Connected Apps surface.

27 Sept 2026

Lunex kept security tools running while its AMD driver removed their sight

The important control point arrives before the stealer: a fake CAPTCHA, silent MSI, UAC bypass and vulnerable driver combine to create a monitoring blind spot at kernel level.

27 Sept 2026

Claude searched 1.9 billion protein clusters. The lab found where the claim must stop

How an autonomous genome-mining campaign narrowed 1.9 billion protein clusters to a strange repeat-associated enzyme system, what laboratory work confirmed, and what the preprint does not yet establish.

27 Sept 2026

Google's cloud AI memory keeps the keys on your devices

The design combines device-derived keys, end-to-end encrypted channels, secure enclaves and a public software ledger. Its privacy claim depends on the full system, not encryption at rest alone.

27 Sept 2026

Claude turns MCP servers and skills into governed directory products

The launch changes the work around an MCP server. Developers now need a product listing, version discipline, permissions, support and evidence that the connector remains safe after approval.

27 Sept 2026

The WAF blocked /PSEMHUB/. ShinyHunters sent /%50SEMHUB/ instead

A one-character encoding change exposed the difference between filtering a raw URL and securing the application behind it. Here is the attack path, hunt evidence and remediation order.

27 Sept 2026

The malware did not return. The repository did: Mini Shai-Hulud's nine-day GitHub Actions window

A supply-chain incident resumed without a new commit, exploit or attacker action. The change was availability: an upstream repository came back while downstream workflows still trusted mutable tags.

27 Sept 2026

Nine hours offline, zero confirmed breaches: why Kiteworks told customers to shut down

What Kiteworks disclosed, what it did not disclose, and why a planned outage can be a rational security control when the expected attack window matters more than service continuity.

Saturday 26 September

Threat Intel26 Sept 2026

Nothing on the machine was locked. Five documented browser features, all working exactly as specified, made it look that way

There is no malware in this chain and nothing on the computer is affected. The product being manufactured is panic, and the delivery is ordinary paid advertising through uncompromised publishers.

Market and Supply Chain26 Sept 2026

Microsoft is withdrawing the role that serves PXE. Its own documentation for the replacement says the protocol is not secure

A deprecation withdraws a product. It does not move a trust boundary. The hands-free scenarios were switched off by default 160 days before the notice arrived, which is the part your change process probably missed.

Page 33

Saturday 26 September

Threat Intel26 Sept 2026

The marketplace listed 321,372 products to 18,000 users. In nine years it made 7,600 sales and $232,000

A listing is not a sale and a registered account is not a customer. The Rydox court record contains both measures, and the gap between them is the story that the word marketplace hides.

Threat Intel26 Sept 2026

Three separate mechanisms can each hand a scanner a clean page. A single automated fetch meets all three

A clean result from an automated check is not an observation about the site. It is a decision the operator made about the checker, and this chain makes that decision at three independent points.

Breaches and Incidents26 Sept 2026

Revolut stopped sending customer data to this provider up to 33 months ago. The records were still there

Migrating away from a processor removes the future risk and leaves the historic risk exactly where it was. Storage limitation is a legal duty, and it is also the only thing that would have helped here.

Compliance and Regulation26 Sept 2026

Eleven days from identifying the incident to telling anyone. The 72 hour clock is a different clock

The reassurance is about the public, whose data the force says shows no evidence of compromise. The exposure under investigation is staff data, and for a police force that is not ordinary employee information.

Threat Intel26 Sept 2026

Every link in this chain is a legitimate paid service. The only malicious artefact is a configuration

The impersonated products do not exist: none of the three payroll platforms ships a desktop app. Allure Security counted 291 downloads and said plainly that some of them were researchers.

Threat Intel26 Sept 2026

Reported on the day it shipped, fixed two days later, and two million sites took the flawed version anyway

Nobody in this story was slow. The flaw is a CSRF check that skips validation whenever a literal string appears anywhere in the request URI, and the query string is written by whoever composes the link.

Threat Intel26 Sept 2026

The only version listed as fixed was a beta of the next major release. The branch everyone runs got nothing

What eventually forced the backport was a ransomware gang's leak site being defaced. Grav shipped a 1.7 fix the day after the details became public, 144 days after the advisory.

AI Security26 Sept 2026

Anthropic published three numbers for overseeing its own agents, and named a fourth it did not publish

A blocked rate is not an error rate and not a danger rate. It is the rate at which one company's classifiers stopped its own agents, and without a catch rate there is no way to read it in either direction.

Threat Intel26 Sept 2026

Seventeen flaws, two official scores each. Six cross a severity band, and every one of them crosses upward

The flaw that gains the most, 8.1 to 9.2, is a firmware verification weakness on a dashcam with no fix, from a vendor that has not responded to CISA. A robot vacuum is filed under Information Technology.

Breaches and Incidents26 Sept 2026

Every container had its own microVM. The isolation that failed was one option on the disk pool

Firecracker per container is the strongest isolation on the market and it was not the boundary that mattered. A flag set for performance let a 4 KiB write expose the other 60 KiB of somebody else's block.

Threat Intel26 Sept 2026

The catalogue calls it path traversal. Its own CWE, and both sources it cites, say authentication bypass

The structured data is right and the prose is wrong, which is the failure mode of every hand-written label sitting beside machine-readable fields. A team triaging by name goes hunting for the wrong thing.

Threat Intel26 Sept 2026

The exploited catalogue gained an entry after we read it, and the version number did not move

Anything that caches on the version saw no change. The third entry is a WordPress Core remote file inclusion flagged for forensic triage, and a day later the trade press was still reporting two.