The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 409 to 420 of 667 briefings

Friday 25 September

Compliance and Regulation25 Sept 2026

The EDPB's new fining guidelines make a fine the default: not minor means a strong presumption to fine

Minor infringements generally get a reprimand. Anything else carries a strong presumption that a fine should be imposed. The guidelines are open to consultation until 13 November.

Threat Intel25 Sept 2026

Roundcube fixed eight flaws in one release and named none of them. The exploited one was line three

Roundcube has eleven entries in the CISA exploited catalogue, more than any other webmail. This one is not among them, four days after a national cyber centre warned about it.

Breaches and Incidents25 Sept 2026

OnePlus confirmed the root chain, warned of legal liability, and shipped nothing in 159 days

The researcher agreed to hold publication until 17 September. He asked for an update twice and got no reply. He published on the 24th, with no CVE and no patch in existence.

Breaches and Incidents25 Sept 2026

Google's tracker says P1. Its panel says working as intended. The flaw makes a namespace user an org owner

A Google engineer wrote Nice catch and filed it. Eleven days later a panel called it working as intended. The case is still open at P1 and S1, and the researcher's page says it is still unpatched.

Threat Intel25 Sept 2026

Windows reports the path of every file touched on the machine, and Microsoft calls it an undocumented feature

A watch on the root of C: reports filesystem events across every user, with filenames, regardless of permissions. That was enough to identify which of the top 1,000 sites another user was visiting, with an F1 score of 97.8 per cent.

AI Security25 Sept 2026

Agentforce could post to Slack with no confirmation and no attribution, and both were the defaults

The vulnerability was not a bug in the model. It was two safety controls that the shipped template did not have, and it took 112 days from report to the last fix.

AI Security25 Sept 2026

The Docker botnet did not write malware. It installed an open source AI agent and gave it a persona file

ThreatDown recovered 4.3 GB from an unauthenticated registry, spanning October 2024 to August 2026. The interesting part is not the botnet. It is that the crew used somebody else's agent framework and only wrote the prompt.

AI Security25 Sept 2026

Anthropic says 1 in 47,000 agent decisions was blocked. The number it does not publish is the catch rate

Over a billion agent decisions in August, about 20,000 blocked, and roughly 100,000 transcripts flagged a week of which about 50 reach a human. Anthropic names the missing metric itself.

Threat Intel25 Sept 2026

Two CISA advisories, 17 CVEs each scored twice, and the number at the top of both pages is the lower one

Both advisories put a v3 score in their summary table. One of them headlines 8.8 high while the page below it contains a 9.2 critical.

Threat Intel25 Sept 2026

The KEV entry says path traversal. Its own CWE, and both sources it cites, say JWT signature bypass

A defender triaging by the catalogue's own words would hunt for a file upload path. The flaw hands over an administrator session to anyone who signs a token with an algorithm the server never supported.

Breaches and Incidents25 Sept 2026

Cloudflare skipped block zeroing for speed, and researchers read 5,614 directory blocks that were not theirs

Cloudflare has fixed a cross tenant exposure in Containers and Sandboxes. The flag took six hours to change. Clearing the blocks already mapped took fifteen days.

Thursday 24 September

Threat Intel24 Sept 2026

CISA added 34 flaws to the exploited catalogue in September, and 26 came with a three day deadline

September is the busiest month of 2026 in the Known Exploited Vulnerabilities catalogue, at 1.48 additions a day against a yearly mean of 0.89. The deadline never varies with how hard the change is.