The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 397 to 420 of 667 briefings

Saturday 26 September

Threat Intel26 Sept 2026

Canada says this flaw is being exploited. CISA's own machine-readable record, three days later, says none

Two allied national cyber bodies, one CVE, three days apart, opposite conclusions. Neither is reading a sensor. Both are reasoning over the same thin public record, which is the part worth understanding.

Breaches and Incidents26 Sept 2026

Kiteworks told customers to shut down for six hours. Its own press release says nine, twice

The public release says nine hours and federal intelligence authorities. The customer email, as quoted, says six hours and law enforcement. Both cannot be the number a defender acts on.

Friday 25 September

Threat Intel25 Sept 2026

The attacker's dashboard calls these 79 events executions. The researchers who found it refuse the word

A fake verification page that verifies nothing, measured by a panel that counts interface progress and labels it execution. The gap between an event and the thing it is named after is the entire story.

Threat Intel25 Sept 2026

Of seven controls in this spyware's console, one does exactly what its label says, and it only answers pong

Two controls are not implemented at all, one is a stub that reports success without reading anything, and the self destruct does not uninstall or undo the damage. Your own device management console is read exactly the same way.

Threat Intel25 Sept 2026

Cisco gave customers a compromise hunting command 47 days before the same advisory said the flaw was exploited

An indicator of compromise is a retrospective artefact. Publishing one says compromise is possible and checkable. Every tool that triages on the exploitation field saw nothing for 47 days.

AI Security25 Sept 2026

A banking trojan's own API documentation calls stolen PINs quiz answers, and the victim a person staring at it

Nobody had to jailbreak anything. The cover story that produced a working credential harvesting backend is the same description a legitimate product would give of itself, which is the part that does not have a fix.

25 Sept 2026

Bitget says its private keys were never compromised. The signer did exactly what it was asked to do

The exchange published two different loss figures within 24 hours, 351.6 million and 387.5 million, against a protection fund of over 464 million. The gap matters less than what the mechanism says about where custody controls stop.

Threat Intel25 Sept 2026

Two vendors published three days apart. The malware shares a LaunchAgent, a repair script and a utility name

Neither vendor says they are the same thing, and a shared builder sold as a service would explain it too. Either way, a defender reading one report and not the other is missing half the indicators.

Threat Intel25 Sept 2026

The TeamCity entry did not change on Wednesday. One field did, and it is the one your tooling drops

Shadowserver counts about 160 exposed TeamCity servers still unpatched, down from roughly 700. The remaining ones hold build credentials and sign artefacts.

Market and Supply Chain25 Sept 2026

Disabling a repository is not removing the malware, and on 16 September the tags started working again

Every workflow referencing either action by tag rather than by commit SHA resumed running the payload on its next trigger, inside the runner, with the workflow's token and secrets.

Threat Intel25 Sept 2026

Both of today's additions to the exploited catalogue were public for weeks. The deadline is three days

September now stands at 38 additions to the catalogue, 30 of them on a three day clock. The clock starts when CISA notices, not when the flaw became dangerous.

AI Security25 Sept 2026

AI commits leak secrets at twice the rate, says the report. The baseline it is twice is not what you think

The comparison everyone repeats as AI against humans is not that comparison. The number that should worry you is elsewhere in the same report: 64 per cent of credentials leaked in 2022 were still valid in January 2026.

Page 35

Friday 25 September

Compliance and Regulation25 Sept 2026

The EDPB's new fining guidelines make a fine the default: not minor means a strong presumption to fine

Minor infringements generally get a reprimand. Anything else carries a strong presumption that a fine should be imposed. The guidelines are open to consultation until 13 November.

Threat Intel25 Sept 2026

Roundcube fixed eight flaws in one release and named none of them. The exploited one was line three

Roundcube has eleven entries in the CISA exploited catalogue, more than any other webmail. This one is not among them, four days after a national cyber centre warned about it.

Breaches and Incidents25 Sept 2026

OnePlus confirmed the root chain, warned of legal liability, and shipped nothing in 159 days

The researcher agreed to hold publication until 17 September. He asked for an update twice and got no reply. He published on the 24th, with no CVE and no patch in existence.

Breaches and Incidents25 Sept 2026

Google's tracker says P1. Its panel says working as intended. The flaw makes a namespace user an org owner

A Google engineer wrote Nice catch and filed it. Eleven days later a panel called it working as intended. The case is still open at P1 and S1, and the researcher's page says it is still unpatched.

Threat Intel25 Sept 2026

Windows reports the path of every file touched on the machine, and Microsoft calls it an undocumented feature

A watch on the root of C: reports filesystem events across every user, with filenames, regardless of permissions. That was enough to identify which of the top 1,000 sites another user was visiting, with an F1 score of 97.8 per cent.

AI Security25 Sept 2026

Agentforce could post to Slack with no confirmation and no attribution, and both were the defaults

The vulnerability was not a bug in the model. It was two safety controls that the shipped template did not have, and it took 112 days from report to the last fix.

AI Security25 Sept 2026

The Docker botnet did not write malware. It installed an open source AI agent and gave it a persona file

ThreatDown recovered 4.3 GB from an unauthenticated registry, spanning October 2024 to August 2026. The interesting part is not the botnet. It is that the crew used somebody else's agent framework and only wrote the prompt.

AI Security25 Sept 2026

Anthropic says 1 in 47,000 agent decisions was blocked. The number it does not publish is the catch rate

Over a billion agent decisions in August, about 20,000 blocked, and roughly 100,000 transcripts flagged a week of which about 50 reach a human. Anthropic names the missing metric itself.

Threat Intel25 Sept 2026

Two CISA advisories, 17 CVEs each scored twice, and the number at the top of both pages is the lower one

Both advisories put a v3 score in their summary table. One of them headlines 8.8 high while the page below it contains a 9.2 critical.

Threat Intel25 Sept 2026

The KEV entry says path traversal. Its own CWE, and both sources it cites, say JWT signature bypass

A defender triaging by the catalogue's own words would hunt for a file upload path. The flaw hands over an administrator session to anyone who signs a token with an algorithm the server never supported.

Breaches and Incidents25 Sept 2026

Cloudflare skipped block zeroing for speed, and researchers read 5,614 directory blocks that were not theirs

Cloudflare has fixed a cross tenant exposure in Containers and Sandboxes. The flag took six hours to change. Clearing the blocks already mapped took fifteen days.

Thursday 24 September

Threat Intel24 Sept 2026

CISA added 34 flaws to the exploited catalogue in September, and 26 came with a three day deadline

September is the busiest month of 2026 in the Known Exploited Vulnerabilities catalogue, at 1.48 additions a day against a yearly mean of 0.89. The deadline never varies with how hard the change is.