The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 385 to 396 of 667 briefings

Saturday 26 September

Threat Intel26 Sept 2026

The marketplace listed 321,372 products to 18,000 users. In nine years it made 7,600 sales and $232,000

A listing is not a sale and a registered account is not a customer. The Rydox court record contains both measures, and the gap between them is the story that the word marketplace hides.

Threat Intel26 Sept 2026

Three separate mechanisms can each hand a scanner a clean page. A single automated fetch meets all three

A clean result from an automated check is not an observation about the site. It is a decision the operator made about the checker, and this chain makes that decision at three independent points.

Breaches and Incidents26 Sept 2026

Revolut stopped sending customer data to this provider up to 33 months ago. The records were still there

Migrating away from a processor removes the future risk and leaves the historic risk exactly where it was. Storage limitation is a legal duty, and it is also the only thing that would have helped here.

Compliance and Regulation26 Sept 2026

Eleven days from identifying the incident to telling anyone. The 72 hour clock is a different clock

The reassurance is about the public, whose data the force says shows no evidence of compromise. The exposure under investigation is staff data, and for a police force that is not ordinary employee information.

Threat Intel26 Sept 2026

Every link in this chain is a legitimate paid service. The only malicious artefact is a configuration

The impersonated products do not exist: none of the three payroll platforms ships a desktop app. Allure Security counted 291 downloads and said plainly that some of them were researchers.

Threat Intel26 Sept 2026

Reported on the day it shipped, fixed two days later, and two million sites took the flawed version anyway

Nobody in this story was slow. The flaw is a CSRF check that skips validation whenever a literal string appears anywhere in the request URI, and the query string is written by whoever composes the link.

Threat Intel26 Sept 2026

The only version listed as fixed was a beta of the next major release. The branch everyone runs got nothing

What eventually forced the backport was a ransomware gang's leak site being defaced. Grav shipped a 1.7 fix the day after the details became public, 144 days after the advisory.

AI Security26 Sept 2026

Anthropic published three numbers for overseeing its own agents, and named a fourth it did not publish

A blocked rate is not an error rate and not a danger rate. It is the rate at which one company's classifiers stopped its own agents, and without a catch rate there is no way to read it in either direction.

Threat Intel26 Sept 2026

Seventeen flaws, two official scores each. Six cross a severity band, and every one of them crosses upward

The flaw that gains the most, 8.1 to 9.2, is a firmware verification weakness on a dashcam with no fix, from a vendor that has not responded to CISA. A robot vacuum is filed under Information Technology.

Breaches and Incidents26 Sept 2026

Every container had its own microVM. The isolation that failed was one option on the disk pool

Firecracker per container is the strongest isolation on the market and it was not the boundary that mattered. A flag set for performance let a 4 KiB write expose the other 60 KiB of somebody else's block.

Threat Intel26 Sept 2026

The catalogue calls it path traversal. Its own CWE, and both sources it cites, say authentication bypass

The structured data is right and the prose is wrong, which is the failure mode of every hand-written label sitting beside machine-readable fields. A team triaging by name goes hunting for the wrong thing.

Threat Intel26 Sept 2026

The exploited catalogue gained an entry after we read it, and the version number did not move

Anything that caches on the version saw no change. The third entry is a WordPress Core remote file inclusion flagged for forensic triage, and a day later the trade press was still reporting two.