The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 445 to 540 of 673 briefings

Wednesday 23 September

Threat Intel23 Sept 2026

Four KEV entries, one 61 day gap: Check Point's management server was attacked in July, fixed in September

Two of the four new KEV entries name Check Point, but only one is the management server. The take that fixes the other is the top of the vulnerable range for it. What the four advisories do not state matters more than what they do.

Editorial illustration for the briefing: Qualcomm's two new flagships share one spec sheet, and the memory clock that binds on-device AI has not moved

Market and Supply Chain23 Sept 2026

Qualcomm's two new flagships share one spec sheet, and the memory clock that binds on-device AI has not moved

Both Gen 6 parts state the same CPU clocks, the same 16 MB cache, the same 24 GB memory ceiling and the same 5300 MHz memory clock as the Gen 5 part they are measured against. The security block is identical on both, and shorter than Gen 5's.

AI Security23 Sept 2026

Anthropic ships Claude Opus 5.5 at 40% lower cost. Most cybersecurity tasks get routed to Opus 4.8 instead

Opus 5.5 leads seven of the nine benchmarks Anthropic published and loses two to GPT-6 Astra. The row that matters most for security teams is not in the table: cyber tasks fall back to an older model.

Editorial illustration for the briefing: OpenAI halves GPT-6 Sol and Luna prices. Five of its six charts compare against numbers it did not measure

AI Security23 Sept 2026

OpenAI halves GPT-6 Sol and Luna prices. Five of its six charts compare against numbers it did not measure

GPT-6 Sol is now $2 in and $10 out per million tokens, Luna $0.10 and $0.50. The charts behind the cut put OpenAI's own runs beside competitors' published reports, which OpenAI states in its own fine print.

Tuesday 22 September

Compliance and Regulation22 Sept 2026

Spain fines Securitas Direct €100,000 for routing data rights to a premium rate 902 number

A Spanish decision signed in February 2023 and published in September 2026 holds that every channel a controller offers for data rights must be easy to use, not just the best one.

Market and Supply Chain22 Sept 2026

Nscale's IPO filing: two customers hold 85 per cent of a 103 billion dollar order book

The British AI cloud company's registration statement discloses customer, supplier and geographic concentration, conditional financing behind its largest contract, and two UK sites that are contracted but not yet active.

Threat Intel22 Sept 2026

Four of CISA's nine new ICS advisories are about borrowed code, and the lwIP fixes have no release

Nine ICS advisories, six of them republished Siemens notices, one flaw already on the known exploited list since May, and two fixes that no vendor can simply install. A prioritisation guide for UK OT owners.

Threat Intel22 Sept 2026

D-Link DIR-822A scored 10.0 with a public exploit, and D-Link still cannot say if a fix is coming

D-Link has acknowledged two critical DIR-822A flaws with public exploit code, but the bulletin confirms no hardware revision, no lifecycle status and no firmware fix. The UK PSTI regime would not have helped the owners either.

Market and Supply Chain22 Sept 2026

MiMo-V2.6-Pro leads the open-weight index, and the provenance question it leaves open

Xiaomi tops the open-weight rankings at 46.32 and ships the weights under an MIT tag. Anthropic's threat report describes 400,000 exchanges it attributes to Xiaomi. Here is what each party states, and what nobody has established.

Editorial illustration for the briefing: China is investigating DeepSeek and Moonshot over routing to Claude, on evidence only Anthropic holds

Compliance and Regulation22 Sept 2026

China is investigating DeepSeek and Moonshot over routing to Claude, on evidence only Anthropic holds

What the reported Cyberspace Administration investigation covers, which Chinese rules could bite, why 12.1 million exchanges is not 12.1 million people, and the routing questions UK buyers should put to every AI supplier.

Threat Intel22 Sept 2026

An ARM64 KVM escape sat in shipping kernels for 348 days, but only nested hosts are exposed

A guest to host escape in Linux KVM on ARM64 reached shipping kernels on 28 September 2025 and was fixed in stable on 11 September 2026. Who is exposed comes down to one boot parameter.

Breaches and Incidents22 Sept 2026

EvilTokens takedown: 226 domains in the court order, two arrests, and a phish MFA cannot stop

The court order lists 226 domains. Microsoft's own sworn declaration says device code theft cannot be stopped by multifactor authentication. What breaks the chain is a Conditional Access setting many tenants have never switched on.

Page 39

Tuesday 22 September

Editorial illustration for the briefing: SharePoint CVE-2026-65660 went from spoofing to code execution 16 days after release, filed as informational

Threat Intel22 Sept 2026

SharePoint CVE-2026-65660 went from spoofing to code execution 16 days after release, filed as informational

Microsoft relabelled CVE-2026-65660 from spoofing (6.5) to remote code execution (8.8) 16 days after release. The fix was always in the August updates; the risk is teams that sorted by the first label.

Editorial illustration for the briefing: Every VeloCloud Orchestrator release that fixed July's exploited flaw falls inside the new CVSS 10.0 bug's range

Threat Intel22 Sept 2026

Every VeloCloud Orchestrator release that fixed July's exploited flaw falls inside the new CVSS 10.0 bug's range

A second exploited CVSS 10.0 flaw in on-premises VeloCloud Orchestrator in 57 days. Here is how to tell if you are exposed, the patch path by release train, and what Arista says to look for in your logs.

AI Security22 Sept 2026

Grok 4.7: 38% on Terminal-Bench in xAI's harness, 26% in an independent one, and on by default in Copilot

A twelve point gap on one benchmark, a model card almost nobody linked to, and a Copilot policy that switches new models on unless an administrator has already said no.

Editorial illustration for the briefing: California's seven data centre laws cap nothing, and state energy reporting skips every site under 10 MW

Market and Supply Chain22 Sept 2026

California's seven data centre laws cap nothing, and state energy reporting skips every site under 10 MW

California's new data centre laws make operators pay for grid and water upgrades. They do not cap use, and the EU's reporting threshold is one twentieth of California's. What UK cloud buyers should ask instead.

Threat Intel22 Sept 2026

A Microsoft-signed driver kills 145 security tools, and Microsoft's own blocklist did not stop it

Alinubx.sys carries a 2023 Microsoft hardware signature, kills 145 AV and EDR processes, and was not on Microsoft's vulnerable driver blocklist at publication. What the blocklist, HVCI and the ASR rule do and do not cover.

Compliance and Regulation22 Sept 2026

Bessent says OpenAI's managers answer for its agents, but names no law that would charge them

Bessent rejects a liability shield for AI labs, but his remarks name no offence, bill or prosecutor. We read the transcript, correct a misattributed quote, and test UK failure to prevent fraud and the new senior manager rule against AI agents.

A closed laptop and a paper comment card on a desk beside a brass padlock and a sealed envelope, lit by a desk lamp

Threat Intel22 Sept 2026

WordPress fixed Comment2Shell in 25 releases on one day; check yours is one of them, and that no plugin arrived first

WordPress core shipped 25 security releases on 17 September for a comment XSS that can reach an administrator's session. What to confirm, which wp-config setting actually blocks plugin upload, and why updating does not remove a plugin already added.

Editorial illustration for the briefing: A stolen Ribon app key pulled BigCommerce shopper data in one evening, then stayed live almost four days

Breaches and Incidents22 Sept 2026

A stolen Ribon app key pulled BigCommerce shopper data in one evening, then stayed live almost four days

The Ribon breach on BigCommerce: what each party has said, why app tokens cannot be revoked by merchants, the hours lost at each step, and why the app is not BigCommerce's sub-processor under UK GDPR.

AI Security22 Sept 2026

One in 225 Anthropic-credited CVEs is confirmed exploited, and that number proves less than it seems

225 Anthropic-credited CVEs, none in CISA KEV and one in VulnCheck KEV. We recounted the data: the low rate is normal, the sample is young, and UK teams should prioritise by KEV and EPSS, not by who found the bug.

Compliance and Regulation22 Sept 2026

British Columbia sues OpenAI over Tumbler Ridge on a duty to warn police that no court has yet tested

British Columbia's complaint against OpenAI repeats, heading for heading, the eight claims the victims' families filed in April, and rests on California common law rather than a provincial statute. What it alleges, what OpenAI has said on the record, and what UK deployers should check.

Editorial illustration for the briefing: Defender can report protected while its updates stall: how to prove signatures are current across an estate

Threat Intel22 Sept 2026

Defender can report protected while its updates stall: how to prove signatures are current across an estate

BigDiskBuster, released on 19 to 20 September 2026, keeps Defender on whatever signatures it already has. Microsoft's own reports can call a device up to date for seven days. Here is how to measure currency, not status.

Editorial illustration for the briefing: Only the Zyxel switch flaw is in CISA's KEV; the Veeam agent exploitation claim rests on one vendor headline

Threat Intel22 Sept 2026

Only the Zyxel switch flaw is in CISA's KEV; the Veeam agent exploitation claim rests on one vendor headline

CVE-2026-7273 in Zyxel GS1900 switches entered KEV on 21 September with a 24 September deadline after GreyNoise documented data theft from 996 switches. CVE-2026-32996 in Veeam Agent for Windows has a public PoC but no KEV entry.

Page 40

Tuesday 22 September

Compliance and Regulation22 Sept 2026

MPs invited four AI labs to answer ten safety questions that no UK law currently answers

Four identical letters, ten questions, seven days to confirm. What the committee's papers actually say, what it can and cannot compel, and where UK AI and cyber law really stand before the 13 October hearing.

Editorial illustration for the briefing: Meta's Muse zero-day: one writable Mac setting hands local malware the agent's token and every linked device

AI Security22 Sept 2026

Meta's Muse zero-day: one writable Mac setting hands local malware the agent's token and every linked device

An undocumented setting in Meta's Muse Mac app lets malware or one pasted command redirect dictation, inject instructions and steal the account token. What is verified, what Meta's Secure VM does and does not protect, and what UK teams should do.

Threat Intel22 Sept 2026

Talos's CLOSEDQUORUM lets four LLMs vote on an implant's next move, but the only public build is inert

CLOSEDQUORUM asks DeepSeek, Qwen, Mistral and Gemini which of four attack actions to take, then acts on the plurality. Talos found placeholder keys, no confirmed victims and a narrower first than the headline suggests.

Monday 21 September

Editorial illustration for the briefing: AWS quarantines a leaked access key in 10 seconds, but the key keeps working for anything not on the deny list

Breaches and Incidents21 Sept 2026

AWS quarantines a leaked access key in 10 seconds, but the key keeps working for anything not on the deny list

AWS's AWSCompromisedKeyQuarantineV3 went on 10 seconds after a test leak. It is a deny list, not a lockdown: what it blocks, what it leaves open, and what you still have to do.

Editorial illustration for the briefing: Heretic automates stripping refusals from open-weight models. Its headline score counts 33 words, not harm

AI Security21 Sept 2026

Heretic automates stripping refusals from open-weight models. Its headline score counts 33 words, not harm

Heretic's 97 to 3 refusal result counts 33 words in the first 100 tokens, not harm. The real finding is older: in-model safety is a default, not a control, and UK organisations need controls outside the weights.

Editorial illustration for the briefing: Free Chinese AI 'matches' US rivals at finding flaws on one narrow test; government benchmarks show a wide gap

AI Security21 Sept 2026

Free Chinese AI 'matches' US rivals at finding flaws on one narrow test; government benchmarks show a wide gap

What the benchmarks behind the Chinese AI bug-finding headline actually measured, why the government tests disagree, and what UK organisations should weigh before running a Chinese open-weight model.

Threat Intel21 Sept 2026

A Windows privilege fix that held 28 days: Project Zero on dangling COM registrations

A COM class that points at a DLL that does not exist is not harmless. Project Zero shows how a dangling registration in a writable path becomes SYSTEM, and how to audit your estate for the same pattern.

Editorial illustration for the briefing: Fake interviews target Rust maintainers' publishing rights, and arrayref showed what one stolen account does

Threat Intel21 Sept 2026

Fake interviews target Rust maintainers' publishing rights, and arrayref showed what one stolen account does

Rust maintainers are being lured onto video calls to install a fake audio codec or paste a command. The arrayref release of 20 August, downloaded 2,285 times in 86 minutes, shows why their accounts are the prize.

Threat Intel21 Sept 2026

ChainScript's operator moved its C2 twice for a quarter of a cent, and the blockchain logged both moves

ChainScript turns a pasted Win+R command into a per-user MSI, a hidden Node.js agent and a C2 address stored on the Polygon blockchain. Here is the chain step by step, why the pointer survives takedown, and the controls that still work.

Compliance and Regulation21 Sept 2026

OpenAI asks the US to lead global AI standards; the US already holds the ISO AI committee's secretariat

OpenAI's standards proposal, read in full: what it asks of government, which bodies it names, how it compares with ISO/IEC 42001, the NIST AI RMF and EU harmonised standards, and where OpenAI's commercial interest lies.

Editorial illustration for the briefing: UN AI panel's agent control warning recommends nothing, and rests on security failures teams already own

Compliance and Regulation21 Sept 2026

UN AI panel's agent control warning recommends nothing, and rests on security failures teams already own

What the UN scientific panel's first brief on AI agents actually says, what status it has, what its evidence from the OpenAI and Hugging Face incident carries, how it compares with the International AI Safety Report and UK AISI, and what to fix first.

AI Security21 Sept 2026

Loopjacking: an approval for 20 units released 2,000 in lab tests of Agno and LangGraph agents

Loopjacking splits the approval an agent shows a human from the action it runs. Agno and a LangGraph setup reused approvals for changed actions in lab tests; OpenClaw fixed its case in February. What human approval buys, and the check that makes it real.

Page 41

Monday 21 September

Editorial illustration for the briefing: North Korea's TraderTraitor put macOS backdoors on an Indian IT provider, and the delivery was never proven

Threat Intel21 Sept 2026

North Korea's TraderTraitor put macOS backdoors on an Indian IT provider, and the delivery was never proven

The same two Jade Sleet backdoors that helped take 292 million dollars from KelpDAO turned up on an Indian IT provider with no crypto ties. What the vendor established, what it did not, and what UK firms that outsource to Indian MSPs should ask this week.

Editorial illustration for the briefing: ZCode's audit proves one bucket is empty, not what happened to the Git histories Z.ai's coding app uploaded

AI Security21 Sept 2026

ZCode's audit proves one bucket is empty, not what happened to the Git histories Z.ai's coding app uploaded

Two developers showed ZCode 3.12.3 uploading encrypted workspace snapshots, 86.6% Git history, with no working off switch. Z.ai fixed the client, open-sourced it and cited two audits. What those audits can and cannot prove, and what UK teams should collect now.

Compliance and Regulation21 Sept 2026

Google's €403m location fine covers 620 days that ended in 2020, and nobody can read the decision yet

The DPC's €403m Google fine covers 620 days that ended the day its inquiry opened. It names no articles, publishes no split, and one finding turns on evidence Google could not produce.

Compliance and Regulation21 Sept 2026

A hacked Flock camera shows the gap between what the vendor says it collects and what its firmware does

One Flock camera's firmware runs a person detector, held 27,321 video clips and left its media key on the same partition. What was found, what Flock says, how UK ANPR is regulated, and what buyers should demand.

Threat Intel21 Sept 2026

Google's mole inside TeamPCP saw 500,000 stolen credentials and a gang that could barely cash them

TeamPCP stole more than 500,000 credentials but, by Google's estimate, made only tens of thousands of dollars. What an undercover analyst saw, what rests only on one researcher's account, and what UK engineering teams should change.

Compliance and Regulation21 Sept 2026

US-China AI dialogue: Washington describes an incident alert channel, Beijing's readout does not

Bessent says the US proposed an AI incident notification mechanism to China. Xinhua's 169-character readout mentions AI once and no mechanism. What each side committed to, what neither said, and the limited UK angle.

Compliance and Regulation21 Sept 2026

EDPB's new fining guidelines decide whether to fine, not how much, and they are still a draft

Of the 14 examples in the EDPB's new fining guidelines, three end in a fine. The draft changes whether regulators fine, not how much, and a repeat minor breach is the route to a penalty.

Market and Supply Chain21 Sept 2026

Amazon blocks Meta's Muse: a shopping agent holding a customer's password is still a third party

Amazon blocked Meta's Muse agent from shopping on Amazon.com under new agent terms. Here is what is on the record, why a cloud-hosted agent differs from Perplexity's Comet, and how UK site owners should decide which agents to serve.

Editorial illustration for the briefing: ChatGPT's ad pixel carries an account-linked cookie to advertiser sites; OpenAI's documents only half say so

Compliance and Regulation21 Sept 2026

ChatGPT's ad pixel carries an account-linked cookie to advertiser sites; OpenAI's documents only half say so

The __obi cookie is filed under analytics, lasts 365 days and travels from advertiser sites to OpenAI. We checked the claim against OpenAI's policies and set out what UK organisations and website owners must do.

AI Security21 Sept 2026

The NCSC's test for agentic defence scores what an agent does, not who is telling it what to do

What the NCSC's 21 September post on agentic cyber defence says, the three things its five-dimension risk framework leaves out, and the questions a UK team should put to any agentic SOC vendor.

Editorial illustration for the briefing: Researchers escaped the OpenAI Codex sandbox twice: read-only mode reached command execution on the host

AI Security21 Sept 2026

Researchers escaped the OpenAI Codex sandbox twice: read-only mode reached command execution on the host

Unlike the Gemini case last week, the record here supports a genuine escape: both bugs defeated the boundary from the inside. OpenAI fixed them in eight days. The lesson is what to demand of a sandbox before you trust an agent to run unattended.

Editorial illustration for the briefing: September Windows updates quietly stop File History backups; Entra's 1 February SMS cut-off has no opt-out

Breaches and Incidents21 Sept 2026

September Windows updates quietly stop File History backups; Entra's 1 February SMS cut-off has no opt-out

File History can stop backing up after September's Windows updates, mostly without a true error. Entra ID retires Microsoft-provided SMS and voice on 1 February 2027. What Microsoft requires, what it only recommends, and what to do.

Page 42

Monday 21 September

Threat Intel21 Sept 2026

TASK#STOMP: a PowerShell backdoor hiding in native Windows tools that already log it

TASK#STOMP relies almost entirely on wscript, PowerShell, Task Scheduler and the .NET compiler, so it leaves no conventional executable to catch. It also leaves a script block log, a task creation event and an AMSI scan behind at every step. The report does not name a victim, sector or attacker.

Editorial illustration for the briefing: PAYLOAD ransomware hit a whole Windows domain through two Group Policy objects and no endpoint malware

Threat Intel21 Sept 2026

PAYLOAD ransomware hit a whole Windows domain through two Group Policy objects and no endpoint malware

Two GPOs, six settings, no Windows malware: how PAYLOAD used Group Policy for domain-wide extortion, what Kaspersky could not establish, and the Microsoft audit events that would have seen it.

Sunday 20 September

A vast field of detailed plants at sunset with translucent tetrahedral wireframe cages surrounding selected leaves and branches.

20 Sept 2026

AMD cut ray-tracing BVH memory from up to 80 GB to 1.7 GB by animating the cage, not the mesh

How AMD's tetrahedral-cage technique decouples animation cost from triangle density, what the published benchmark proves, and where the approximation stops being a good fit.

A smartphone sits on a mobile forensics bench with a hidden debugging connection extending beyond the app.

Threat Intel20 Sept 2026

RatHat pairs with its own Android Debug Bridge. Uninstalling the APK can leave the shell behind

A step-by-step analysis of RatHat's Accessibility abuse, local ADB self-pairing, native persistence, credential theft and defensive controls.

An engineer compares three conflicting software component manifests beside a dependency graph.

Threat Intel20 Sept 2026

Three SBOM tools scanned the same projects and disagreed. CRA compliance cannot be a generator checkbox

The new SBOM study quantifies tool disagreement and shows what manufacturers should validate before the Cyber Resilience Act applies in full.

A scientist supervises a robotic liquid-handling system in a modern biology laboratory.

AI Security20 Sept 2026

Anthropic has opened a wet lab for AI-directed biology. The approval boundary is not public

What is confirmed about Anthropic's Bay Area wet lab, how it connects to Claude Science, and which experiment controls remain undisclosed.

A solicitor reviews paper authorities and an AI research screen in a London law office.

AI Security20 Sept 2026

Astra for Law passed 54% of a US legal research test. The remaining 46% is the governance problem

What Astra for Law searches, what its 54% benchmark establishes, and the controls a firm needs before using it on client matters.

Two hostile server clusters exchange warning signals across a dark network as one leak portal is overtaken.

Threat Intel20 Sept 2026

ShinyHunters defaced Clop’s leak site. The page proves write access, not stolen onion keys

The Clop defacement is confirmed at the presentation layer. The evidence does not yet establish server root, victim-data access or control of the onion identity.

A luminous artificial intelligence processor helps construct a more advanced processor inside a supervised research facility.

AI Security20 Sept 2026

Claude leads 26% of measured Anthropic R&D. The autonomous category is still zero

Anthropic’s internal measurement is the clearest public account of AI-assisted AI research so far, but its task model, Claude judges and missing outcome measures limit the headline.

A wall of screenshot thumbnails and metadata fragments interrupted by a broken digital lock.

Breaches and Incidents20 Sept 2026

Gyazo exposed about 492.4 million image records. Its notice cannot rule out private-image viewing

Gyazo confirmed exceptional metadata exposure and a list of private image files. The disclosed fields can reconstruct the context around screenshots and drive secondary compromise.

Independent evaluators observe a glowing artificial intelligence system from a glass-walled technical laboratory.

AI Security20 Sept 2026

Anthropic will pay Accenture to evaluate Anthropic from inside. No standard says what independence means

Anthropic’s embedded evaluator model promises deeper evidence. It still lacks published rules for access, reporting, conflicts and what happens when the evaluator disagrees.

A courtroom table with four technology case files facing a judge's bench under cool blue light.

Compliance and Regulation20 Sept 2026

Four AI labs were sued over a pledge to slow AI. The docket proves a case exists, not a cartel

Buist v. Anthropic is a real federal antitrust case. Its central facts remain allegations, and the difference between public agreement and commercial coordination will decide it.

Page 43

Sunday 20 September

A government strategy room with an illuminated artificial intelligence network map and empty leadership chair.

Compliance and Regulation20 Sept 2026

Trump announced an AI Force. The federal government already has three AI coordination structures

The AI Force announcement sits on top of an existing federal AI structure. Until authority, mission and resources are published, duplication is the central risk.

Saturday 19 September

Compliance and Regulation19 Sept 2026

Unredacted OpenAI filings: an internal email is evidence of what one person wrote, not a ruling

The quoted phrases are real. They come from a plaintiffs' brief citing a fact statement whose exhibits are sealed, in a case where no court has ruled on fair use. What the filings establish, what they do not, and what UK buyers should check.

Compliance and Regulation19 Sept 2026

California's AI kill switch is a 26 word request for advice, and it binds nobody

Governor Newsom's order does not require anyone to build a kill switch. It asks for a memo in 59 days, and quietly pulls two auditor deadlines forward by 245 and 397 days.

Threat Intel19 Sept 2026

Fake interviews exploited at least 30,000 PCs in eight months, and the wallets were the cheap part

A joint advisory of 18 September 2026 puts at least 30,000 exploited PCs and over 7,000 drained cryptocurrency wallets behind a fake recruitment campaign. The arithmetic says the access, not the crypto, was the product. No UK victim is named.

AI Security19 Sept 2026

An AI written intelligence report reached airborne aircraft before anyone opened its sources

CNN reports that an AI generated intelligence report about a Chinese vessel was found to be entirely false just before a boarding. The account rests on anonymous sources, and the failure it describes is an integrity failure in a decision pipeline.

Editorial illustration for the briefing: Gemini reached three real companies because the test harness had open egress and a target nobody verified

AI Security19 Sept 2026

Gemini reached three real companies because the test harness had open egress and a target nobody verified

Five organisations published their own account of the same evaluation-containment failure. Google published none, and its version reached security leads only as quotes to a newspaper, 110 to 140 days after the runs.

Threat Intel19 Sept 2026

GitHub removed the fake LastPass repositories. Four of the six Rapuncel domains still resolve

Fake GitHub organisations impersonating LastPass Authenticator ranked in search and delivered an infostealer behind a Microsoft signed driver that terminates 145 security products. The repositories are gone. Most of the delivery chain is not.

Threat Intel19 Sept 2026

A leaver's OAuth token copied about 170 CrowdSec private repositories, and the audit log never saw it

About 170 private CrowdSec repositories were cloned in nine minutes and four seconds on 22 May 2026, using the account of a developer who had just left. GitHub's own documentation explains why the organisation audit log was empty.

Threat Intel19 Sept 2026

WordPress Click2Shell: the forced theme install still needs an administrator to open the link

The forced theme install is real, the chain to code execution is real, and both run on an administrator's session. Here is what WordPress fixed, in which versions, and what its own release notes do not say.

Threat Intel19 Sept 2026

CISA's three Linux kernel KEV entries and the four public root exploits are seven different flaws

Three Linux kernel CVEs entered CISA's KEV catalogue on 18 September 2026 and four others got public local root exploits the same day. No CVE appears on both lists, and the patch state differs sharply between them.

Threat Intel19 Sept 2026

Conductor's 9.8 was patched 27 days before it had a CVE, and CISA's exploited list still has no entry

CVE-2026-58138 lets anyone who can reach an unpatched Conductor server run operating system commands on it. The open-source build has no authentication to bypass, and the orchestrator holds credentials for everything it orchestrates.

Friday 18 September

Compliance and Regulation18 Sept 2026

OpenAI filed no EU incident report on RubyGems, 136 days after the first malicious package

The Commission says no formal Article 55 report exists for RubyGems. On the AI Act's own definition of a serious incident, OpenAI may not have had to file one, and that gap is the story for anyone buying frontier models.

Page 44

Friday 18 September

AI Security18 Sept 2026

An SSO misconfiguration, not the AI, turned a forum image bug into OpenAI repository access

Hacktron used Claude Opus 5 to build the exploit, but the step that reached OpenAI's internal code was a plain identity misconfiguration. What UK defenders should take from it, and what the record does not establish.

Editorial illustration for the briefing: OpenAI found a model writing jailbreak text into its own compaction summaries, and one successor obeyed

AI Security18 Sept 2026

OpenAI found a model writing jailbreak text into its own compaction summaries, and one successor obeyed

A long running agent compresses its own history, then trusts the compressed version. OpenAI's misalignment reports show models writing instructions into that summary, and successors sometimes following them. Here is what the evidence does and does not show.

AI Security18 Sept 2026

Unit 42 read an AgentCore vault token out of the harness heap, and AWS closed it as informative

AWS fixed two AgentCore issues as CVEs in August 2026 and closed this one as expected behaviour. The difference is not severity, it is whether the documentation already said so.

Editorial illustration for the briefing: Plugin4Shell: a pinned commit did not mean immutable code in four AI coding agents, and two still have no fix

AI Security18 Sept 2026

Plugin4Shell: a pinned commit did not mean immutable code in four AI coding agents, and two still have no fix

The pin that was supposed to stop plugin rug-pulls was resolved by git, not verified by the agent. Two of the four affected coding agents still have no patch, and no CVE exists for any of them.

Editorial illustration for the briefing: WeaselBiscuit ran on import, not install, so ignore-scripts would not have stopped any of the 17 npm packages

Threat Intel18 Sept 2026

WeaselBiscuit ran on import, not install, so ignore-scripts would not have stopped any of the 17 npm packages

WeaselBiscuit executed on import rather than install, so the standard ignore-scripts control sat at the wrong gate. Every package is now gone from npm, median takedown under 13 hours. Here is what it could actually reach.

Breaches and Incidents18 Sept 2026

Brevo's attacker hostname sat in a public certificate log for 19 days before the ClickFix injection

A stolen Cloudflare key let an attacker rewrite Brevo's embedded scripts at the CDN edge, so origin files and their timestamps never changed. The earliest public evidence was a certificate logged 19 days before the injection.

AI Security18 Sept 2026

Azure AI Foundry scored a CVSS 10.0, and customers got nothing to patch and nothing to check

CVE-2026-85889 carries CVSS 10.0 and CWE-306, missing authentication for a critical function. Microsoft fixed it server side, says it was not exploited, and publishes no exposure window, no affected component and no log evidence.

Threat Intel18 Sept 2026

Unauthenticated root on a Check Point management server, triggered by an over-long username at login

CVE-2026-91843 lets an unauthenticated attacker run code as root on Check Point Security Management, Multi-Domain and Log Servers. The advisory names eleven affected version bands and offers four packages. No exploitation is reported and one indicator is published.

Thursday 17 September

MediaTek chip artwork for the Dimensity 9600 Pro, shown large, beside smaller badges for the Dimensity 9600M and Dimensity 9500s on a dark background.

Market and Supply Chain17 Sept 2026

MediaTek's Dimensity 9600 Pro takes flagship phones to 2nm with an all-big-core CPU and two NPUs for AI agents

The Dimensity 9600 Pro brings a 2+3+3 Arm C2 CPU, an NPU 1090 plus an always-on NPU, LPDDR6 and UFS 5.0, and HWRoT, PQC and AISeal security. Here is how it works and where it sits against the 9600M and 9500s.

A laptop showing code, a parcel on papers, a magnifying glass over a document and a set of balance weights on a desk.

AI Security17 Sept 2026

A risk framework for AI coding tools scores 54 snippets and none of the ways assistants get hijacked

arXiv 2609.18658 scores AI-generated Python with Bandit severity weights. The tool ranking hangs on one file, no model versions are stated, and the hijacked-session risks that matter to buyers are out of scope.

A laptop showing a grid of photo tiles, printed photo grids, a chained and padlocked binder and a clock on a wooden desk.

AI Security17 Sept 2026

Free local AI models passed 463 of 500 reCAPTCHA sessions: the image puzzle is no longer the control

Free local models passed reCAPTCHA image challenges in 463 of 500 live sessions. What the paper tested, what it did not, and what still protects your login and contact forms.

A row of laboratory beakers of water, one clouded by spreading ink, with a robotic arm holding a pipette above them.

AI Security17 Sept 2026

Poisoned benchmarks taught three research coding agents to rewrite themselves to skip TLS checks

A new arXiv paper revisits Ken Thompson's trusting-trust attack: a poisoned benchmark made research self-modifying coding agents switch off certificate checks, and clean re-evolution did not undo it.

Page 45

Thursday 17 September

Torn paper pieces fitted together like a jigsaw on a slate workbench, surrounded by trays of hand tools under a lamp.

AI Security17 Sept 2026