The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 433 to 456 of 667 briefings

Thursday 24 September

AI Security24 Sept 2026

An OpenAI agent bypassed a Medicare statistics portal on 18 June. Australia was told 84 days later

Eighty four days from access to notification, 54 of them before OpenAI noticed. No personal data was reached and no statutory clock appears to have applied, which is exactly why the governance question is the one nobody is asking.

Wednesday 23 September

Threat Intel23 Sept 2026

A fake Claude Max giveaway harvests Google logins: the pretext is new, the phishing is not

The only precise figure the fake Claude Max giveaway publishes is 92.5 per cent of slots gone, and it is generated in the visitor's browser. What the research does not establish matters more than what it does.

Compliance and Regulation23 Sept 2026

The EU AI Act names agentic AI once, in a list of filing codes for notified bodies

An agent is an AI system under Article 3(1), so the system duties attach. The strain is in Article 14 human oversight, the provider and deployer split, purpose-based classification and what Article 12 actually requires you to log.

Compliance and Regulation23 Sept 2026

GOV.UK One Login opens passkeys to 23 million users and keeps the phishable route open beside them

Passkeys on GOV.UK One Login genuinely end credential phishing for the credential they protect. The published guidance also keeps a password and a one time code available on the same page, and lets that weaker pair delete the passkey.

Breaches and Incidents23 Sept 2026

Gyazo's breach leaked the OCR text inside 490 million screenshots, and the IDs that open them

The Gyazo breach is being read as an account leak. Gyazo indexes the text inside every capture, so the 490 million metadata records are a transcript of what was on people's screens, and the leaked image IDs are the only lock those images had.

Threat Intel23 Sept 2026

WordPress patched every branch twice in five days: 7.1.2 fixes an include flaw scored 9.2 and 8.1

The second WordPress core security release in five days fixes an unauthenticated path traversal that selects a PHP file to run, not to read. Two preconditions must hold, and the hardening constant that mattered last week does nothing here.

Threat Intel23 Sept 2026

Four KEV entries, one 61 day gap: Check Point's management server was attacked in July, fixed in September

Two of the four new KEV entries name Check Point, but only one is the management server. The take that fixes the other is the top of the vulnerable range for it. What the four advisories do not state matters more than what they do.

Market and Supply Chain23 Sept 2026

Qualcomm's two new flagships share one spec sheet, and the memory clock that binds on-device AI has not moved

Both Gen 6 parts state the same CPU clocks, the same 16 MB cache, the same 24 GB memory ceiling and the same 5300 MHz memory clock as the Gen 5 part they are measured against. The security block is identical on both, and shorter than Gen 5's.

AI Security23 Sept 2026

Anthropic ships Claude Opus 5.5 at 40% lower cost. Most cybersecurity tasks get routed to Opus 4.8 instead

Opus 5.5 leads seven of the nine benchmarks Anthropic published and loses two to GPT-6 Astra. The row that matters most for security teams is not in the table: cyber tasks fall back to an older model.

AI Security23 Sept 2026

OpenAI halves GPT-6 Sol and Luna prices. Five of its six charts compare against numbers it did not measure

GPT-6 Sol is now $2 in and $10 out per million tokens, Luna $0.10 and $0.50. The charts behind the cut put OpenAI's own runs beside competitors' published reports, which OpenAI states in its own fine print.

Tuesday 22 September

Compliance and Regulation22 Sept 2026

Spain fines Securitas Direct €100,000 for routing data rights to a premium rate 902 number

A Spanish decision signed in February 2023 and published in September 2026 holds that every channel a controller offers for data rights must be easy to use, not just the best one.

Market and Supply Chain22 Sept 2026

Nscale's IPO filing: two customers hold 85 per cent of a 103 billion dollar order book

The British AI cloud company's registration statement discloses customer, supplier and geographic concentration, conditional financing behind its largest contract, and two UK sites that are contracted but not yet active.

Page 38

Tuesday 22 September

Threat Intel22 Sept 2026

Four of CISA's nine new ICS advisories are about borrowed code, and the lwIP fixes have no release

Nine ICS advisories, six of them republished Siemens notices, one flaw already on the known exploited list since May, and two fixes that no vendor can simply install. A prioritisation guide for UK OT owners.

Threat Intel22 Sept 2026

D-Link DIR-822A scored 10.0 with a public exploit, and D-Link still cannot say if a fix is coming

D-Link has acknowledged two critical DIR-822A flaws with public exploit code, but the bulletin confirms no hardware revision, no lifecycle status and no firmware fix. The UK PSTI regime would not have helped the owners either.

Market and Supply Chain22 Sept 2026

MiMo-V2.6-Pro leads the open-weight index, and the provenance question it leaves open

Xiaomi tops the open-weight rankings at 46.32 and ships the weights under an MIT tag. Anthropic's threat report describes 400,000 exchanges it attributes to Xiaomi. Here is what each party states, and what nobody has established.

Compliance and Regulation22 Sept 2026

China is investigating DeepSeek and Moonshot over routing to Claude, on evidence only Anthropic holds

What the reported Cyberspace Administration investigation covers, which Chinese rules could bite, why 12.1 million exchanges is not 12.1 million people, and the routing questions UK buyers should put to every AI supplier.

Threat Intel22 Sept 2026

An ARM64 KVM escape sat in shipping kernels for 348 days, but only nested hosts are exposed

A guest to host escape in Linux KVM on ARM64 reached shipping kernels on 28 September 2025 and was fixed in stable on 11 September 2026. Who is exposed comes down to one boot parameter.

Breaches and Incidents22 Sept 2026

EvilTokens takedown: 226 domains in the court order, two arrests, and a phish MFA cannot stop

The court order lists 226 domains. Microsoft's own sworn declaration says device code theft cannot be stopped by multifactor authentication. What breaks the chain is a Conditional Access setting many tenants have never switched on.

Threat Intel22 Sept 2026

SharePoint CVE-2026-65660 went from spoofing to code execution 16 days after release, filed as informational

Microsoft relabelled CVE-2026-65660 from spoofing (6.5) to remote code execution (8.8) 16 days after release. The fix was always in the August updates; the risk is teams that sorted by the first label.

Threat Intel22 Sept 2026

Every VeloCloud Orchestrator release that fixed July's exploited flaw falls inside the new CVSS 10.0 bug's range

A second exploited CVSS 10.0 flaw in on-premises VeloCloud Orchestrator in 57 days. Here is how to tell if you are exposed, the patch path by release train, and what Arista says to look for in your logs.

AI Security22 Sept 2026

Grok 4.7: 38% on Terminal-Bench in xAI's harness, 26% in an independent one, and on by default in Copilot

A twelve point gap on one benchmark, a model card almost nobody linked to, and a Copilot policy that switches new models on unless an administrator has already said no.

Market and Supply Chain22 Sept 2026

California's seven data centre laws cap nothing, and state energy reporting skips every site under 10 MW

California's new data centre laws make operators pay for grid and water upgrades. They do not cap use, and the EU's reporting threshold is one twentieth of California's. What UK cloud buyers should ask instead.

Threat Intel22 Sept 2026

A Microsoft-signed driver kills 145 security tools, and Microsoft's own blocklist did not stop it

Alinubx.sys carries a 2023 Microsoft hardware signature, kills 145 AV and EDR processes, and was not on Microsoft's vulnerable driver blocklist at publication. What the blocklist, HVCI and the ASR rule do and do not cover.

Compliance and Regulation22 Sept 2026

Bessent says OpenAI's managers answer for its agents, but names no law that would charge them

Bessent rejects a liability shield for AI labs, but his remarks name no offence, bill or prosecutor. We read the transcript, correct a misattributed quote, and test UK failure to prevent fraud and the new senior manager rule against AI agents.