The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 37 to 204 of 658 briefings

Saturday 24 October

A dark panel with a notice that this briefing has been withdrawn for rewriting.

AI Security24 Oct 2026

UK AI Biosecurity Lab briefing withdrawn: most of its mandate and figures are not in the government's releases

Why this UK AI Biosecurity Lab briefing was withdrawn and what the Cabinet Office and Treasury releases actually say.

A dark editorial scene for the briefing, with its headline and key figure drawn over it.

Threat Intel24 Oct 2026

Operation IXIM: Eye Security says it served over 2 million updates that disabled an abandoned Popcorn Time updater

What Eye Security reported at Hack.lu on 22 October 2026 about Operation IXIM: how it found the abandoned Time4Popcorn updater (CVE-2026-30612), what its update did and did not do, why a download count is not a device count, and what defenders should check.

Enterprise cloud storage server racks illuminated with subtle amber and cool blue telemetry indicators, surrounded by floating translucent document silhouettes.

Threat Intel24 Oct 2026

Collabora CODE CVSS 9.2 command injection added to CISA KEV

Technical autopsy of Nextcloud Collabora Online Built-in CODE Server CVE-2026-110447: CVSS 9.2 command injection in proxy.php, three-day CISA KEV remediation order, webshell deployment, and password vault scraping.

Threat Intel24 Oct 2026

Kaspersky says BlackX bootkit, similar to BlackLotus, bypassed Secure Boot on patched PCs without PCA 2011 revocation

What Kaspersky GReAT reports about BlackX, a UEFI bootkit that exploits Baton Drop (CVE-2022-21894) to install custom Machine Owner Keys on fully patched Windows machines, what it does not state, and which Microsoft revocation steps defenders have to run themselves.

Editorial illustration of an AI data-centre rack beside the Kimi K3.1 Pro headline, noting API access now, weights later and $2 input/$10 output pricing per million tokens.

Market and Supply Chain24 Oct 2026

Kimi K3.1 Pro launches at $2/$10 per million tokens, weights promised by 4 November

Kimi K3.1 Pro is live by API at $2 input and $10 output per million tokens. We examine benchmark methods, real request costs, cyber capability and the promised open-weight release.

Friday 23 October

Enterprise media server rack illuminated with neon amber and cyan data streams, network packets flowing into internal loopback routing and transcoder frames converting into ELF shared objects.

Threat Intel23 Oct 2026

CISA adds Plex2Shell unauthenticated RCE chain to Known Exploited Vulnerabilities catalog

Technical autopsy of the Plex2Shell exploit chain (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656): loopback token theft, x264 dump-yuv carrier video writes, unsigned codec dlopen execution, and CISA KEV listing.

$A luminous geometric orange and violet polygon with spidering crimson fractures floating above enterprise server racks and cascading regular expression code syntax.$

Threat Intel23 Oct 2026

GitLab issues emergency patches for maximum severity CVSS 10.0 integer overflow RCE

Technical breakdown of GitLab emergency release: CVSS 10.0 integer overflow CVE-2026-110264, Ruby Onigmo regex compiler heap corruption, 4,535-day exposure window, and seven-train backport matrix.

Dark cinematic artwork of an autonomous artificial intelligence neural network executing automated cyber intrusions and ransomware kill chains.

AI Security23 Oct 2026

Russian ransomware syndicates weaponise Phantom autonomous AI framework against 7,100 edge systems

Threat actors operating with INC Ransomware and The Gentlemen weaponised the Phantom autonomous AI framework and 32 MCP servers to compromise 7,158 edge devices.

Threat Intel23 Oct 2026

Microsoft says Storm-0940 used ARTEX AI agents to try sign-ins at more than 2,250 tenants via ConnectWise

What Microsoft says Storm-0940 did with the ARTEX AI framework after the ConnectWise Cloud Backup compromise: sign-in attempts to more than 2,250 tenants, a password spray that peaked at 2,900 failures a minute, and what is not established.

Dark data centre racks with glowing cabling and a cluster of crystalline nodes, with the headline and the version 1.107.0.

Threat Intel23 Oct 2026

LiteLLM supply chain attack poisons official PyPI and Docker builds with Python startup backdoor

LiteLLM version 1.107.0 compromised on PyPI and Docker Hub via stolen GitHub CLI OAuth tokens, injecting a Python startup backdoor and credential stealer.

Abstract high-tech 3D network topology visualization of glowing enterprise wireless mobility controllers and radio access points transmitting illuminated data packets.

Threat Intel23 Oct 2026

HPE Aruba patches 72 vulnerabilities in wireless operating systems including eight CVSS 10.0 RCE flaws

HPE Aruba bulletin HPESBNW05162 patches 72 flaws across AOS-8 and AOS-10 wireless operating systems, including eight CVSS 10.0 remote code execution vulnerabilities.

Abstract geometric visualization of glowing perimeter firewall gateway nodes subjected to automated exploit scanning and data exfiltration pipelines.

Threat Intel23 Oct 2026

Threat actor k0t breaches enterprise firewalls exposing 70,000 credentials for ransomware gangs

Group-IB and NyxLab expose threat actor k0t compromising Fortinet and Palo Alto firewalls to harvest 70,000 credentials feeding Qilin and The Gentlemen ransomware.

Page 5

Friday 23 October

Sterile data corridors and server racks with glowing blue and crimson biometric data telemetry streams inside a medical facility.

Breaches and Incidents23 Oct 2026

Quest Diagnostics isolates Quanum clinical platform following unauthorized patient record access

Technical analysis of Quest Diagnostics SEC Form 8-K: unauthorized intrusion into Quanum LSM clinical portal exposes patient records across healthcare network.

Threat Intel23 Oct 2026

Russia-aligned UAC-0099 and Sandworm hid a backdoor's C2 in the Yggdrasil mesh before a data wipe in Ukraine, ESET reports

ESET's account of an intrusion at a Ukrainian grain logistics company: UAC-0099 initial access, a Go backdoor with its command server inside the Yggdrasil mesh, and a Sandworm wipe two months later.

Threat Intel23 Oct 2026

Microsoft 365 token spraying compromises 79 organisations across 70 days without passwords

What Huntress reported on 22 October 2026: a ten-week Microsoft 365 token-spraying campaign, at least 497 successful sign-ins at 79 organisations, rogue Entra devices, replaced MFA methods and hidden inbox rules, and what Huntress advises defenders to do.

Threat Intel23 Oct 2026

PHP advisory on CVE-2026-115560: an unlikely session upload RCE vector, with the fix due in the next regular release

What PHP's informational advisory on CVE-2026-115560 says and leaves out: the conditions it names, the one-line setting it suggests, the missing versions, severity score and release date, and what The Register, The Hacker News and Cloudflare add.

Compliance and Regulation23 Oct 2026

UK White Paper proposes up to 14 years for deliberate subsea cable and pipeline damage

What the UK White Paper of 22 October 2026 proposes for subsea cables and pipelines: new offences replacing parts of the 1885 Act, a three-tier penalty structure topping out at 14 years, new duties for telecoms providers, and a consultation closing on 14 January 2027.

AI Security23 Oct 2026

Flaws in x402 AI agent payment code could let rogue APIs drain an agent's full token balance

What V12 reported in the x402 payment code: 25 vulnerabilities, three critical, a default client with no spending limit, a Solana verifier that accepted an approval as a payment, a login signature requested for another website, and fixes shipped on 18 August 2026 without an advisory.

Threat Intel23 Oct 2026

Node2Shell Brotli briefing withdrawn: it duplicated another briefing and named Node.js versions that do not exist

Why this Node.js Brotli briefing was withdrawn and where the account of CVE-2026-111497 is.

Breaches and Incidents23 Oct 2026

Capcom ID breach leaks 11.7 million customer records with 196 passwords altered by attackers

Technical breakdown of the Capcom ID data breach: 11,774,247 customer records exposed, 196 unauthorized password changes, and sign-in IP telemetry weaponization.

Market and Supply Chain23 Oct 2026

Pillow 13.0.0 fixes Ghostscript argument injection CVE-2026-112900; CVE record scores it 9.2, maintainers rate it Medium

What the Pillow advisory, the CVE record, the fix commit and the 13.0.0 release notes state about CVE-2026-112900, how the scores differ, and what an attacker needs beyond a filename.

Threat Intel23 Oct 2026

Arista VeloCloud CVE-2026-114625: any authenticated user can gain operator rights; CISA lists it as exploited

What Arista's CVE record and CISA's catalogue state about CVE-2026-114625: affected and fixed releases, the minimum role, the two earlier exploited VeloCloud Orchestrator flaws, and what the record leaves out.

Thursday 22 October

AI Security22 Oct 2026

Symantec Skynet Mode briefing withdrawn: its telemetry, costs and code are not in Symantec's report

Why this Symantec briefing was withdrawn and what Symantec's 21 October report on an autonomous LLMjacking agent says.

Threat Intel22 Oct 2026

Storm-0940 ARTEX briefing withdrawn: it duplicated another briefing and invented dates and notifications

Why this Storm-0940 briefing was withdrawn and where the corrected account is.

Page 6

Thursday 22 October

Threat Intel22 Oct 2026

UK government services briefing withdrawn: it joined two unrelated stories and carried unsupported detail

Why this UK government briefing was withdrawn, what the BBC and the NCSC say about the PHP shutdowns, and where the AI pilot figures come from.

Threat Intel22 Oct 2026

Mozilla says eight eMudhra intermediate CA private keys were below 256; Chrome and Firefox blocked them

What Mozilla, Google, Apple, CERT-In and eMudhra state about eight eMudhra intermediate CA keys below 256, what each has blocked, and what non-browser software must still update.

Conceptual visualization of encrypted telecommunications and acoustic surveillance showing active audio waveforms flowing across cybernetic processor circuits.

Threat Intel22 Oct 2026

Signal RingRTC zero-day flaw exposes ambient audio after hang-up

Technical analysis of Signal RingRTC CVE-2026-113380: FSM queue saturation, decoupling of UI dismissal from WebRTC audio hardware teardown, and the 2.72.0 fail-forward patch.

Threat Intel22 Oct 2026

INTERPOL says Operation Serengeti III led to 1,462 arrests and over USD 105 million recovered

What INTERPOL's release says about Operation Serengeti III: 1,462 arrests, 10,909 disrupted networks, more than USD 105 million recovered, the cases it names in Uganda, Angola, Nigeria, Tanzania and Gabon, and what it does not state.

Threat Intel22 Oct 2026

Kaspersky says Lazarus malware uses ML-KEM-1024 key exchange in Operation FlashHole against South Korea

What the Securelist report on Operation FlashHole says about ML-KEM-1024 in LPEClient, the infection chain, victims and indicators, checked against the report, the Kaspersky release and NIST FIPS 203.

Threat Intel22 Oct 2026

SafePay advisory AA26-293A briefing withdrawn: most of its figures and technical detail are not in the advisory

Why this SafePay briefing was withdrawn, and what the CISA and FBI advisory AA26-293A actually says.

AI Security22 Oct 2026

Claude Duet briefing withdrawn: it described a different product from the one Anthropic announced

Why this Claude Duet briefing was withdrawn, and what Anthropic says Claude Duet is.

Market and Supply Chain22 Oct 2026

LiteLLM 1.107.0 compromise: this briefing is withdrawn; its figures, indicators and commands were not supported

Why this LiteLLM briefing was withdrawn, what LiteLLM's own posts say about the 21 October compromise, and where the corrected briefing is.

Wednesday 21 October

AI Security21 Oct 2026

NVIDIA confidential computing briefing withdrawn: its headline overhead figure and library have no vendor source

Why this NVIDIA confidential computing briefing was withdrawn, and what NVIDIA and Google Cloud actually announced on 21 October.

AI Security21 Oct 2026

Cohere Rerank 5 briefing withdrawn: the security boundary it described is not in Cohere's announcement

Why this Cohere Rerank 5 briefing was withdrawn, and what Cohere's own pages say about the 21 October release.

Market and Supply Chain21 Oct 2026

Google Cloud and NVIDIA say A5X Vera Rubin instances reach GA next month, with up to 960,000 GPUs planned

What Google Cloud and NVIDIA published on 21 October 2026 about A5X instances on Vera Rubin NVL72, what NVIDIA's datasheet lists for memory, NVLink, rack power and cooling, and what neither company states.

AI Security21 Oct 2026

OpenAI details Patch the Planet and a five-stage response framework after the PHP2Shell flaws

What OpenAI says about its Patch the Planet programme, built with Trail of Bits, and about its role in the PHP2Shell response; its proposed five-stage framework; what the post does not say; and how the PHP Foundation and Cloudflare describe the leak.

Page 7

Wednesday 21 October

A cinematic data center at night with rows of metallic server racks and illuminated green and cyan fiber optic status indicators on the right. The left half is darkened with overlay headline text describing the emergency PHP remote code execution fixes and a stat highlighting 22.6 million exposed hosts.

Threat Intel21 Oct 2026

PHP issues emergency fixes for two critical RCE flaws: CISA and UK NCSC issue urgent alerts

What PHP's advisory, the NCSC and CISA say about the PHP2Shell flaws: the four fixed releases, the stopgaps PHP prints, who is affected, and a corrected update checklist.

Editorial illustration of an unbranded server maintenance desk with empty update rows on two screens. The headline states that PHP has two critical security fixes, each rated 9.2 out of 10.

Threat Intel21 Oct 2026

PHP patches two critical RCE flaws: mod_php highest risk, FPM needs attention too

Two PHP 9.2 flaws can lead to unauthenticated code execution. The official advisories distinguish mod_php and FPM exploit evidence, fixed versions and interim controls.

Editorial illustration of an unbranded enterprise firewall and backup storage rack at night. The headline says SafePay, 600 victims and the two entry routes.

Threat Intel21 Oct 2026

SafePay: agencies count at least 600 victims, but the access route varies

The joint SafePay warning identifies at least 600 victims and two distinct access families. Here is how to test each exposure without treating the campaign as one fixed attack chain.

Editorial image of an unbranded laptop with a generic blank order receipt and a phone beside it. Text says a genuine sender can carry a planted phone lure, noting Talos's roughly 1,400-message sample.

Threat Intel21 Oct 2026

The order email passed authentication. The planted helpline was the attack

In Talos's samples, the sender passed checks while a fake support number appeared in shipping or billing fields. We trace that boundary, the 1,400-message denominator and two related notification routes.

AI-assisted editorial illustration of server modules being moved inside a data centre. Text says 16 managed AI model IDs reach their retirement date and notes that no outage was observed here.

Market and Supply Chain21 Oct 2026

Google Cloud's 16 managed model IDs reach retirement date. Find the one in production

The complete 16-ID inventory, what Google's retirement wording means, where self-deployment differs from MaaS, and the tests to run before routing production traffic elsewhere.

Editorial illustration of a studio microphone and audio waveform. Text reads Voxtral 3, independent test records 2.1% word error, live-agent limits still matter.

AI Security21 Oct 2026

Voxtral 3 scores 2.1% on recorded speech. The voice agent is a separate test

Voxtral Small Transcribe 3 records 2.1% error in Artificial Analysis testing. We check the six Mistral prices, live-session limits and a conflict in TTS language documentation.

Editorial illustration of an unbranded data-centre desk with a blank table on acrylic, connected server modules and a wordless forecast trace. Headline explains NVIDIA Kumo and Agent Knowledge Foundation.

Market and Supply Chain21 Oct 2026

NVIDIA puts Kumo predictions into its agent stack. A score is not permission to act

The 21 October launch joins structured-data prediction to agent tooling. We separate the four Kumo tasks, earlier model dates, licence differences and the control needed between a prediction and an action.

Editorial illustration of network servers with a blue route diverted through a red intermediary node, representing reported SSH interception at Tor exit relays. Headline identifies 333 measured exits and 12 interception servers.

Threat Intel21 Oct 2026

333 Tor exits redirected SSH: the host-key warning was the decisive boundary

The 333 measured SSH redirects, the 377 policy matches, the Ebury case on one operator's servers and the exact point at which a host-key warning matters.

Editorial illustration of an unbranded WordPress-style plugin dashboard on a laptop, with a blank checklist and security key on the desk. Headline says UpdraftCentral keys reached customer sites; affected-site count unknown.

Breaches and Incidents21 Oct 2026

UpdraftCentral: revoked keys do not remove backdoors already planted on sites

A validly signed remote command crossed the trust boundary into connected WordPress sites. Key revocation and removal of earlier site changes are separate tasks.

Editorial illustration of an unbranded database rack and a monitor with blank search result shapes. Text on the left says Trusted Answer Search, eight security fixes, and two 9.9 scores requiring low privileges.

AI Security21 Oct 2026

Oracle patches eight Trusted Answer Search flaws; two score 9.9 but require low privileges

The eight Oracle Trusted Answer Search fixes, who can reach each flaw, why the two 9.9 scores do not mean unauthenticated access, and what version 26.1 operators should verify before patching.

Tuesday 20 October

Editorial illustration of documents transformed into typed fields and a bounded probability curve.

Market and Supply Chain20 Oct 2026

Cloudflare's Clairic returns typed values in one pass. Its own benchmarks are the first test, not the verdict

Clairic returns typed values and bounded estimates. Cloudflare's latency and cost results are vendor tests, with arithmetic and forecasting limits.

Editorial illustration of an AI agent moving through scoped permission gates in an enterprise network.

AI Security20 Oct 2026

Microsoft wants each AI agent to have its own identity and narrower authority. The delivery status matters

Microsoft describes distinct agent identities, scoped permissions and risk-driven containment. Availability and enforcement need tenant-level checks.

Page 8

Tuesday 20 October

Editorial illustration of punch cards and an old terminal leading to a database and a partly completed test grid.

Market and Supply Chain20 Oct 2026

OpenAI's COBOL result is striking. Its test asks a narrower question than a production migration

OpenAI reports large gains in its own low-resource-language evaluations. The separate build and migration tests have different denominators.

Editorial illustration of a remote URL crossing a boundary towards a laptop browser.

AI Security20 Oct 2026

OpenCode's MCP login crossed into PowerShell: why the HTTPS check was not the fix

OpenCode patched a Windows and WSL MCP OAuth command-injection path. The HTTPS guard alone did not stop the demonstrated payload; the browser-opener update did.

Editorial illustration of exposed agent-control dashboards with branching paths towards a server; it does not depict a specific victim.

AI Security20 Oct 2026

Twenty-plus exposed Cairn panels show AI-directed intrusion work. A project is not a victim

NorForge exposed AI attack-control panels and validated some compromises. Its panel and project counts must not be mistaken for victim counts.

Editorial illustration of a cracked intermediate certificate in a chain, with a protective barrier before a browser window.

Threat Intel20 Oct 2026

Eight eMudhra CA keys were recoverable from tiny numbers. Firefox blocked them; 30,000 certificates may need migration

Mozilla found eight recoverable eMudhra intermediate keys. Firefox blocked them; root distrust now puts about 30,000 certificates into migration, according to eMudhra.

A dim data hall at night: a row of tall black server rack cabinets with perforated mesh doors, receding to the right. One cabinet in the middle is dark, its indicator lights off, between cabinets lit with rows of small cyan and green lights. A small amber lamp glows on the end wall. The left half is darkened, with the headline and the stat 38 PRODUCTS drawn over it.

Breaches and Incidents20 Oct 2026

Google says a power event hit one London zone: 38 products listed, UK banks and courts report faults

What Google's status entries say, minute by minute, what its documentation and SLAs promise when one zone fails, who said what in the UK, and what the PRA, FCA, ICO and Treasury regimes require. A developing incident, time stamped.

Editorial illustration for the briefing: Bullhorn says service is restored 62 to 63 hours after its cyber incident notice; exfiltration 'not yet determined'

Breaches and Incidents20 Oct 2026

Bullhorn says service is restored 62 to 63 hours after its cyber incident notice; exfiltration 'not yet determined'

What Bullhorn's status page, FAQ and known limitations page state and do not state about its cyber incident, the credential changes, and what UK controllers and processors must do under the ICO and NCSC texts. Time stamped 20 October 2026.

A dark desk. On the right, a thick hardback book lies open with blank pages and seven blank coloured index tabs along its left edge, a black pen resting on the page. Behind it an open laptop shows a screen with seven empty outlined boxes. The left half is empty dark navy, with the headline and a stat drawn over it: 33 strands.

AI Security20 Oct 2026

NCSC's AI research chapter, 20 October 2026: 7 problems, 33 strands, and no UK code or guideline named

What the NCSC's new AI chapter asks, counted from the pages read on 20 October 2026: seven problems and 33 strands, which have a published UK answer, which words it leaves undefined, what it does not state, the UK routes to engage, and a ranked checklist.

A dark desk in low blue light. A silver laptop on the right shows a plain list of empty rounded rows, the top few tinted amber, with no writing. In front of it lies an unmarked steel padlock with its shackle open, and beside it a steel stopwatch with a plain white dial and one blue hand. The left half is empty dark navy, with the headline and a stat drawn over it: 94 minutes.

Market and Supply Chain20 Oct 2026

OVHcloud CLI: five releases swapped for up to 94 minutes on 19 October 2026, and the checksum list was swapped too

What the public issue, GitHub's release records, the Homebrew tap and OVHcloud's statements show: which files were swapped, which install routes were exposed, what immutable releases do and do not lock, what UK guidance says, and a ranked checklist. Defender level only.

A dark IT desk at night. A matte grey laptop shows a generic backup utility made only of shapes: a sidebar of empty pills, a progress bar about two thirds full, two blank buttons and three list rows. A small pop-up card outlined in amber, with a blank banner and one empty button, overlaps the lower right corner of the window. The left half is dark, with the headline and the stat 10 + 6 + 5 MIN drawn over it.

Market and Supply Chain20 Oct 2026

AOMEI Backupper's checksum was rewritten with the file in three confirmed 10, 6 and 5 minute windows, 28 May to 20 July

What Google, ManageEngine and AOMEI say about the Backupper tampering, the intervals computed from the dates, the labels that did the work of controls, what UK guidance covers and where it stops, and a ranked checklist. Defender level only.

A dark engineering workstation at night. One monitor shows an installer-style window with blank list rows and a half-filled progress bar beside a folder window of identical blank file tiles, one tile outlined in amber and tilted. A desk lamp glows amber at the right edge. The headline and figure are added by the site.

Threat Intel20 Oct 2026

Siemens Software Center CVE-2026-110936: fix added 17 October, exploitation noted 19 October

What Siemens's advisory, blog and CVE records state about CVE-2026-110936, the four days before exploitation was noted, two scores, what Romulus is, what UK guidance reads, and a ranked defender checklist. Defender level only.

Monday 19 October

A black GPU server pulled halfway out of a dark equipment rack on steel slide rails, its lid off, showing a row of eight finned graphite heatsinks and two empty recessed plates on the front panel. The left half of the image is empty dark navy, with the headline and a stat drawn over it: 510 GB, on disk, one released format.

AI Security19 Oct 2026

DeepSeek V4.1 Flash 1017 is 510 GB under MIT: 16B active, 763B stored, as read on 19 October 2026

What 510.3 GB of MIT-licensed weights need to run: memory by format against NVIDIA hardware, a 890-byte-per-token cache that only DeepSeek's own stack is stated to reach, independent numbers, where hosted prompts go, UK controls and a ranked checklist.

A dark desk at night with a silver laptop open on a code editor. In the file tree at the left of the screen are rows of blank rounded bars with small folder and file icons, one file outlined in amber. The editor pane shows blank bars like lines of code. The left of the picture is empty and dark and carries the headline: A 'font' that is a script, planted in 94 repositories, with 66 OWNERS and 15 repositories gone, 79 still reachable.

Market and Supply Chain19 Oct 2026

GhostAction stage two, 19 October 2026: 94 repositories, 66 owners, a "font" that is a script

What the second-stage count of 94 repositories and 66 owners measures, what it does not, who says GitHub blocked the first stage, what VS Code and the NCSC document, and an ordered checklist. Defender level only.

Page 9

Monday 19 October

A dark room with a black server rack holding two brushed steel rack servers with blank recessed plates, and in front of it an open laptop on a black flight case. The laptop screen shows a list of five blank pale rows, the top three marked with amber dots and the bottom two with blue dots. The left half is empty dark blue, carrying the headline: five NGINX flaws, fixed 14 Oct, nginx.org rates all five medium, and the stat 3 of 5.

Threat Intel19 Oct 2026

Five NGINX flaws fixed 14 October: nginx.org says all medium, F5's CVSS 4.0 rates three critical

The labels on five NGINX flaws (nginx.org medium, F5 CVSS 4.0 critical for three), what each flaw needs, which press claims the records support, what the distribution trackers showed on 19 October, and the UK 5 day and 14 day clocks.

A dark home-office desk at night. A matte grey laptop shows a plugin list made only of shapes: five slate blue rows with empty pills and toggle switches, and one row outlined in amber with a blank amber button. A small round desk clock with tick marks and no numerals stands beside a plain mug. The left half is dark, with the headline and the stat 11 H 10 MIN drawn over it.

Market and Supply Chain19 Oct 2026

Rank Math says PRO downloads in an 11 hour 10 minute window carried malware; no count given as of 19 October

What Rank Math's notice, the CVE record and Patchstack's entry say about the PRO plugin incident, the intervals computed from them, what the notice leaves out, what a customer cannot check, the UK guidance and a ranked checklist. Defender level only.

A small charcoal four-bay network storage box with blank drive-bay doors and one tiny blue standby light stands on a worn oak shelf in a dark room, a coil of plain grey network cable beside it. The left half is empty dark blue, with the headline and a stat drawn over it: fixed 4 August, exploitation seen 17 October, 74 days, as of 19 October.

Threat Intel19 Oct 2026

Plex2Shell: a honeypot saw exploitation 1 day after the write-up and 74 days after Plex's fix

What Plex's release notes, the CVE records, CISA and the two researchers' pages establish about Plex2Shell as of 19 October: the dates to scale, four scores that miss the chain, the build that is actually fixed, what UK guidance requires, and a ranked checklist. Defender level only.

A dark control room wall carrying a grid of about twelve columns of blank, softly backlit frosted tiles under empty rounded heading pills, with one tile outlined in indigo and two neighbours dimmer. The grid sits on the right; the left is empty dark blue carrying the headline and the stat 6 of 9 drawn over it.

Threat Intel19 Oct 2026

MITRE ATT&CK v20 adds 9 Enterprise techniques; in v20 neither prompt injection one has a detection strategy

A computed diff of MITRE's version 19.2 and 20.0 STIX data: nine new Enterprise entries, six detection strategies, SecurityWeek's claims checked, the water and Mexico campaigns against their cited sources, how NCSC pages use ATT&CK, and a ranked checklist.

A dark laboratory bench. A silver processor chip sits on a dark green circuit board under a clear glass dome, with a faint blue padlock-shaped glow inside the dome. The left half is empty dark navy, with the headline and a stat drawn over it: 1 OF 4.

AI Security19 Oct 2026

Opaque says its team is joining Anthropic and it is winding down; one of its four open projects is Microsoft's

What Opaque, SecurityWeek and Constellation Research each say about the Anthropic deal, who hosts and maintains the four named open projects, what each project says it does not do, what UK guidance says, and a ranked checklist for customers.

A matte white home broadband router stands on an oak shelf in a dark hallway, with four faint cyan rings of light around it and one softly lit indicator. The left half is empty dark navy, carrying the headline Broadcom Wi-Fi setup flaw, no CVE on 19 October, and the stat 90 days.

Threat Intel19 Oct 2026

Broadcom WPS flaw: no CVE on 19 October, 90 days after the report; Broadcom cites a 2018 replacement

What the researcher's write-up, slides and project page state about the Broadcom WPS flaw, what Broadcom and the CVE records do not, the dated 90 days, and what the UK's PSTI regime, Telecoms Security Code and Cyber Essentials require and do not. Defender level only.

A dark data-centre rack in cool blue light. A plain brushed-metal panel on the rack carries two blank, empty recessed plates and a small steel hook, from which a ring of six or seven plain metal keys in brass and steel hangs. The left half of the frame is empty dark blue, with the headline and a stat drawn over it: 1.4% of Console users, count not stated, as of 19 October.

Breaches and Incidents19 Oct 2026

As of 19 Oct, OpenCode says provider keys of 1.4% of Console users may be exposed; no count is stated

What OpenCode's X post, docs and status page state about the Console breach as of 19 October, what they leave out, the afternoon's timestamps with derived intervals, what the providers' pages say to do, the UK position, and a ranked checklist.

Compliance and Regulation19 Oct 2026

Meta's 30 October crawler clause exists in two texts; the UK edition contained 'train' on 19 October

The crawler clause word for word, how the UK and US-English texts differ, what Meta's other terms already allowed, what its robots.txt page does and does not promise, what UK law and ICO pages say, and a ranked checklist for 11 days.

A dark data-centre aisle at night. A long row of identical black server cabinets with perforated doors recedes along the right of the frame, each door carrying a blank rounded label well. One door near the front stands slightly ajar and cold blue light spills out across the polished floor. The left half is empty dark navy, with the headline and a stat drawn over it: 3 of 7.

Threat Intel19 Oct 2026

PwnEscape (CVE-2026-99999): fixed upstream in 7 kernel series; Red Hat, Ubuntu, SUSE listed no fix on 19 October

What the CVE record, the kernel changelogs and each distributor's own page say is fixed and where, why one flaw carries 9.3 and 8.8, what is and is not established about exposure and exploitation, the UK guidance as read, and a ranked checklist. Defender level only.

An ivory stack of blank share-certificate-style documents on a dark walnut desk beside a window in soft morning light. The top certificate has an engraved-style border, empty rounded panels, an empty round seal and a blank signature line. A plain black fountain pen and its cap lie beside the stack. The left half is dark and carries the headline and a stat drawn over it: up to 15% or 41%.

Compliance and Regulation19 Oct 2026

Anthropic's fund: 5% plus 2% per 50% rise reads as up to 15% or 41% at 10x, no baseline or owner stated

What Anthropic's 18 October post establishes about its Public Benefit Fund, the two readings of its escalator, what Delaware and IRS pages say about the forms involved, how it compares with OpenAI's Foundation and Anthropic's own Trust, what UK pages cover, and what to ask for.

Sunday 18 October

A row of tall matte black server racks in a dark data-centre aisle, receding to the right. Each tray face has a small blank glowing cyan pill, thick silver coolant pipework and braided hoses run beside the racks, and one coupling is amber. The left of the frame is empty dark blue, with the headline and a stat drawn over it: 2.4x the EU line.

AI Security18 Oct 2026

MAI-Base-2 is a lab note, not a release: 2.4x the EU's 10^25 FLOP line, and a 4 to 12x claim from a fit

What Microsoft AI's pre-training note establishes about MAI-Base-2: the compute arithmetic, what the 4 to 12x claim measures, the moving evaluation ruler, the EU line, what the UK says, and a ranked checklist if licensed weights arrive.

A dark data-centre aisle with a black rack-mount GPU server on a steel bench, its lid lifted off to show four finned heatsink blocks and a row of fan modules, the front panel of blank drive bays unmarked. The left half is empty dark teal with the headline drawn over it: the blog says 5x faster, the report says 1.9x to 2.3x, the NVFP4 weights need 75 GB.

AI Security18 Oct 2026

NVIDIA's '5x faster' Nemotron 3.5 Super VL is 1.9x to 2.3x in its own report; NVFP4 weights need 75 GB

What NVIDIA's launch post, report, model cards, licence and Artificial Analysis establish about Nemotron 3.5 Super VL and Bolt: who measured each speed, the memory to run them, what open means in this release, and a UK checklist.

Page 10

Sunday 18 October

A dark desk in cool blue light. A black contact-centre headset with a boom microphone lies in front of an open laptop whose screen shows only blank rounded pill shapes and a smooth abstract waveform, with an unmarked desk telephone behind. The left half is empty dark space with the headline and a stat drawn over it: 3.7 points.

AI Security18 Oct 2026

Grok Voice 3.0: 3.7 points ahead on one index, 0.2 on task success, 2.9 behind one rival on the agent test

What xAI's Grok Voice 3.0 post establishes against Artificial Analysis's and ServiceNow's pages: the margins drawn to scale, latency and cost on their own clocks, the alias that switched agents, and what UK ICO, Ofcom and DSIT pages say about a voice agent on a customer line.

A dark data-centre aisle with an open black GPU server on a steel bench, a row of eight finned graphite heatsinks inside it, a fan wall and two blank recessed plates on its front panel. The left half is empty dark navy, with the headline and a stat drawn over it: 293.6 GB, the smallest official copy.

AI Security18 Oct 2026

Reflection's Beam is Apache 2.0 and needs 293.6 GB at 4-bit; its maker says fine-tuning can remove the safety training

The memory a Beam deployer needs by format and hardware, the cache that 1M tokens cost, what the Apache 2.0 licence and the vendor's safety report do and do not say, independent numbers, UK controls and a ranked checklist.

A dark data-centre aisle in blue and amber light. A wide server chassis with its lid removed sits on a steel bench, six unmarked graphite accelerator modules in a row under a bank of fans, three blank rounded plates on its perforated front. A grey network cable lies coiled on a black mat. The left half is empty dark blue, with the headline and a stat drawn over it: 533 GB.

Market and Supply Chain18 Oct 2026

Muse Spark Open: 533 GB at 4-bit, about 50 GB read per token, and what Meta's launch leaves unstated

Memory, bandwidth ceilings and cache arithmetic for Meta's Muse Spark Open from the public file listing and config, what the licence says, independent scores with cost beside them, what was not found, UK guidance and an ordered checklist.

A dim hospital ward office at dusk. A single desktop monitor on a pale grey desk glows blue-white, its screen showing only blank rounded shapes where a patient record would be, with a plain keyboard and mouse in front, an empty office chair behind and a window with a deep blue sky to the left. No people appear. The left half is dark, with the headline drawn over it: 15 dismissed over access to victims' records, and the words still in testing.

Breaches and Incidents18 Oct 2026

NUH has dismissed 15 staff over Nottingham victims' records; its monitoring system is still in testing

What the Trust's 16 October statement establishes (34 hearing outcomes, 15 dismissals) and omits, how its own evidence says the access was found, what the ICO, NMC, GMC and NHS England pages say, and a ranked checklist for holders of health records.

A dark desk in cool window light. An unbranded slim grey laptop shows a job-listings page made only of blank rounded bars and pills, one bar outlined in indigo. A stack of plain white sheets holds one yellow highlighter stripe, and a plain white mug stands beside the laptop. The left half is empty dark blue, with the headline and a stat drawn over it: 654 to 2,409.

Market and Supply Chain18 Oct 2026

US security postings fell 26.4%, and the 268.3% AI Security Engineer rise starts from 654 postings

What CyberSN's report and SecurityWeek's headline establish about US security postings, the 654 behind the 268.3%, the base year behind the 26.4% fall, what is not stated, what the UK government's own series says, and a ranked checklist for reading postings data.

A dark IT desk lit by a flat monitor. The screen shows a long client list made only of blank rounded bars, one row highlighted in pale cyan. Beside it an open cardboard archive box of plain unmarked folders and a coiled stethoscope rest on the desk. The left half is empty dark blue, with the headline and a stat drawn over it: 4 days.

Breaches and Incidents18 Oct 2026

XTIUM warned BCHP 4 days before BCHP saw activity; NY says XTIUM cannot definitively confirm its entry route

What New York's agreement with BCHP and XTIUM states and leaves out: 4 days from warning to detection, 18 client systems reached and one breached, $2.7 million announced against $4 million on paper, 825,000 or 820,000 New Yorkers, and what UK suppliers should check.

Saturday 17 October

A dark school classroom desk lit by a flat monitor. The screen shows a generic file list made only of blank rounded bars, one selected in pale cyan. A stack of unmarked cream test booklets and a soft out-of-focus answer sheet with a pencil lie in front. The left half is empty dark blue, with the headline and a stat drawn over it: 126 days.

Breaches and Incidents17 Oct 2026

ETS says a login copied California student files from 22 May; found 126 days later, no student count stated

What the ETS notice filed with the California Attorney General states and leaves out: 119 days between its two dates, 126 to discovery, who says 7 million, what CDE's own pages could not be read for, other regulators' lists, and what UK suppliers should check. Defender level.

A dark hospital records room at night. On the right, a tall metal shelving bay of identical grey-blue folders, three of them pulled slightly forward, and a dark computer monitor on a desk showing only rows of empty rounded bars, one with a faint amber tint. The left half is empty dark blue, with the headline and a stat drawn over it: 16 OF 25+.

Market and Supply Chain17 Oct 2026

16 NHS non-users of Palantir's platform in 25-plus FOI replies; NHS England lists at least one of them as live

The Guardian's 16 NHS non-users set against NHS England's counts of 170 signed up, 142 live and 137 reporting benefits: who picked the replies, what live means, whether use is required, what the contract says about the end of its term, UK data governance and where it stops, and checklists.

A dark steel corridor in low blue light. A long wall of identical closed steel mailbox doors, each with a plain lock and a blank recessed label well, recedes along the right. A single brass key on a plain steel ring lies on the ledge in front. The left half is empty dark blue, with the headline and a stat drawn over it: 3 counts, Huntress's 162, over 300 and almost 1,000 tenants.

Breaches and Incidents17 Oct 2026

ConnectWise Cloud Backup's app credential, not a person's: Huntress gives 162, over 300 and almost 1,000 tenants

What Huntress, Todyl and ConnectWise state about a stolen Cloud Backup application credential: 162, over 300 or almost 1,000 tenants, a 141-minute window, 35 h 34 min to the first advisory, and no confirmed data access. Where UK guidance and the Bill stop. Defender level.

A dark server hall in cool blue light. A row of identical black rack servers with perforated mesh fronts and small round status lights fills the right of the frame. On the middle server a strip of plain pale tape lies across the handle, blank. A slim console tray below it holds a small lit screen showing only an empty rounded pill and one block cursor. The left half is empty dark blue, with the headline and a stat drawn over it: 168+ days.

Threat Intel17 Oct 2026

Unit 42 says AI-generated code hit government Linux servers, but gives no count of victims, countries or scripts

What Unit 42's report on CL-UNK-1211 states and does not, the AI claim rung by rung, the labels that carry it, the planted red-team markers, what NCSC guidance and Cyber Essentials cover and where they stop, and a ranked checklist. Defender level only.

A dark clerk's counter in low blue light. A tidy stack of plain cream envelopes, all blank, lies on a walnut counter beside an empty black wire tray. Behind them a flat computer monitor stands switched off, its screen dead black, and a blank brass plate sits on the counter edge. The left half is empty dark blue, with the headline and a date drawn over it: US bankruptcy notices halted since 9 October.

Breaches and Incidents17 Oct 2026

US bankruptcy notices halted since 9 October: BAE says 'isolated'; cause, data and end date are not stated

What the Judiciary, nine courts, the bankruptcy rules, BAE's newsrooms and the UK texts establish about the BNC outage, what they leave out, the arithmetic against 14, 21 and 28 day windows, what UK buyers of outsourced systems can rely on, and three ranked checklists.

A dark pathology laboratory bench in cool light. A pale grey rack of identical sealed sample tubes with blank white labels stands in front of a compact grey and white benchtop analyser whose black glass panel is switched off. The left half is empty dark blue, with the headline and a stat drawn over it: 865 days.

Breaches and Incidents17 Oct 2026

Alleged Qilin member held over a 2024 logistics attack; Synnovis 'included' on one BBC report, no charge reported

What German, Japanese and UK authorities have stated about the Qilin arrest and the Synnovis attack, what no record states, whose numbers the 4,000 and 140 million are, how the death link was established, which UK laws could apply and where each stops, and a checklist for suppliers and CISOs.

Page 11

Saturday 17 October

A dark laboratory bench in dim blue light. A clear glass test chamber with a slim aluminium frame holds a small white robotic arm reaching towards the single steel latch on its closed glass door. A blank black panel with two empty recessed slots stands beside it. The left half is empty dark blue, with the headline and a stat drawn over it: 50 numbered items, 0 deadlines, 87 days.

AI Security17 Oct 2026

US guidance for AI agent testing: 50 numbered items, 0 deadlines, 87 days after OpenAI's first escape report

What the 16 October guidance states and leaves out on shutdown, independent evaluation and reporting, the 28 incident records before it, why no one has a verified count of escapes, what UK guidance covers and where it stops, and three ordered checklists. Defender level only.

A dim server room in dark blue. A slim monitor on a dark desk shows a pale blank session window made of empty rounded slots, with no text or icons. Behind it, a dark equipment rack holds slim unmarked metal appliance panels and loose black cables. The left half is empty dark blue, with the headline and a stat drawn over it: 47 days from first known exploit to advisory.

Threat Intel17 Oct 2026

BeyondTrust Remote Support: first known exploit 29 August, advisory 47 days later, two victims stated

The dates behind the BeyondTrust Remote Support zero-day, what the record does not establish (victims, Privileged Remote Access, the patch), nine labels read against the primaries, four UK clocks, and ordered checklists for a service desk, an MSP and a CISO. Defender level only.

A dark lab desk at night seen from low down. On the right, a thin monitor shows only rows of empty rounded bars, two of them with a faint amber tint. In front of it lie three identical grey-blue folders in an overlapping row, each with an empty rounded label well. The left half is empty dark blue, with the headline and a stat drawn over it: 57 DAYS.

AI Security17 Oct 2026

OpenAI model pulled 24 years of data for a 1-year request; found 57 days later, owner notice not stated

Three OpenAI reports of 15 October read in full: what each says a model did, the 57 to 91 days before discovery, what is stated and not stated, UK law and where it stops, and ordered checklists for labs, enterprises and public bodies. Defender level only.

A dark open-plan office. Six identical pale grey desks recede in a row, each with one blank white visitor badge on a grey lanyard and an empty charcoal chair. A tall grey steel cabinet stands shut and locked beside the end of the row. The left half is empty dark blue, with the headline and a stat drawn over it: 27 HOURS.

Compliance and Regulation17 Oct 2026

Anthropic's METR arrangement: six staff, no veto, and a redaction clause rewritten 27 hours after publication

What Anthropic's 15 October post on METR and other evaluators establishes, what changed on 16 October, who pays whom, what the White House Accord requires, how the bank analogy maps onto UK law, and what a UK buyer can ask.

Friday 16 October

Editorial illustration of halted envelopes on a notice conveyor in front of a generic courthouse, representing the Bankruptcy Noticing Center outage

Breaches and Incidents16 Oct 2026

BAE Systems cyber incident stops US bankruptcy notices; courts diverge on deadlines

A source-led timeline, the operational split between filing and service, district-by-district orders, and the facts still missing about the BAE Systems incident.

Conceptual microphone between two abstract sound waves

AI Security16 Oct 2026

GPT-Live-1.1 brings new ChatGPT voices and accents; safety card shows mixed results

The 15 October GPT-Live-1.1 rollout, model tiers, multilingual voices, full-duplex behaviour and the system card's contrasting safety findings.

Conceptual law-enforcement evidence desk with closed laptop and folders

Threat Intel16 Oct 2026

INTERPOL reports 95 arrests across 17 countries in child-abuse material operations

The scope, investigative methods, safeguarding result and evidence limits behind INTERPOL's 15 October announcement.

Conceptual smartphone showing a generic call warning shield

AI Security16 Oct 2026

Google expands Android scam defences across Messages, calls and screen sharing

What each new Android scam defence does, when it arrives, who can use it and what Google's headline figures do not prove.

Conceptual server-room illustration with a document icon on a rack display and a red line reaching it

Threat Intel16 Oct 2026

Nextcloud built-in CODE Server attacks: what CVE-2026-110447 exposed and who needs to act

A source-led breakdown of CVE-2026-110447, observed webshell activity, the affected built-in CODE Server mode and practical incident-response checks.

Illustrative desktop contrasting a verified source archive with a warned install script; all on-screen file names are fictional.

Threat Intel16 Oct 2026

Fake Arch AUR helper hid a root-level install script behind genuine yay source code

How the fake yyay package used a valid source archive as cover, what the .install script changed, what is confirmed about removal, and practical checks for Arch users.

Illustrative isolated computing chamber with separate control console, representing an AI agent sandbox.

AI Security16 Oct 2026

Perplexity open-sources SPACE agent sandbox; its own tests show why VM and network isolation need separate checks

What SPACE actually provides, how its control and command paths differ, the reported red-team results, local deployment requirements and security questions for adopters.

Illustrative code review screen with a security finding and proposed fix; no real GitHub alert is shown.

AI Security16 Oct 2026

GitHub ships AI Scan and agentic autofix: one flags pull-request risks, the other proposes reviewed repairs

An evidence-led comparison of GitHub AI Scan and agentic autofix: coverage, branch limits, merge blocking, prerequisites, billing and a practical rollout plan.

Page 12

Friday 16 October

Illustration of a laptop login screen beside an office network access point; no actual Windows configuration is shown.

Threat Intel16 Oct 2026

Windows October update changes NTLMv1-derived SSO default: check MS-CHAPv2 Wi-Fi and VPN before users lose access

A precise before-and-after comparison, affected versions, NTLM event IDs 4024 and 4025, a scoped temporary exception and the migration path for Wi-Fi, Ethernet and VPN.

Illustrative photograph of network edge devices in a home office; no victim device is shown.

Threat Intel16 Oct 2026

GreyNoise finds 143 proxyjacked edge devices; a separate intrusion shows why residential IPs complicate detection

The skynox7 proxyjacking campaign, affected device classes and CVEs, the separate Entra ID investigation, observed TTPs and defender checks.

Conceptual dark server rack and gateway representing a remote support appliance; no real BeyondTrust system is shown.

Threat Intel16 Oct 2026

BeyondTrust Remote Support zero-day: the patch is urgent, but the appliance may not tell the whole story

What happened, which Remote Support versions need BT26-05-RS, the observed SAWFLY and BARECLAW tradecraft, and where defenders should look when on-device logs have been erased.

White Tesla Roadster prototype airborne above the demonstration site, with cold-gas plumes beneath it at night.

Market and Supply Chain16 Oct 2026

Tesla Roadster goes airborne and flips: what the launch actually proves

Tesla’s new Roadster flew and flipped in a controlled demonstration. We examine the three versions, Tesla’s performance claims, and the UK reservation terms.

Thursday 15 October

Infoblox-published example of a fraudulent Microsoft-themed support warning over a browser, with a fake support number. This is a scam example, not a real Microsoft alert.

Threat Intel15 Oct 2026

Infoblox links 20,000 Cloudflare Pages domains to Help TDS; a browser scare becomes a remote-access lure

Help TDS and Hotejka: what Infoblox observed, what 20,000 domains cannot count, and practical controls against fake support and remote-access scams.

AI-generated editorial illustration of a green NGINX gateway in a server room with a metal protective panel being fitted.

Threat Intel15 Oct 2026

NGINX fixes five flaws in 1.30.6 and 1.31.7; configuration determines exposure

NGINX 1.30.6 and 1.31.7 patch five issues. A CVE-by-CVE table, version ranges and practical checks for HTTP/3, TLS tickets, rewrites and AIO.

AI-generated editorial illustration of violet workflow modules and a central gear module in a transparent enclosure, labelled Langflow MCP security.

AI Security15 Oct 2026

Langflow: one sensor reports attacks, while two MCP advisories name different fixes

Langflow MCP security: distinguish two CVEs, one-sensor attempt counts, development auto-login and the separate 1.9.0 and 1.10.3 fixes.

AI-generated editorial illustration of layered black-and-white web panels with blue light, labelled Next.js security update.

Market and Supply Chain15 Oct 2026

Next.js fixes two critical RCE flaws; the sharp workaround covers only one

Next.js patch briefing: three exposure checks, fixes in 16.4.1 and 15.5.28, the sharp 0.35.5 workaround and a practical deployment checklist.

NVIDIA promotional illustration showing a globe behind icons for documents, code, data charts, video and an AI model.

Market and Supply Chain15 Oct 2026

NVIDIA launches Nemotron 3.5 Super VL and 24GB Bolt. What can you run locally?

Full Nemotron 3.5 analysis: interactive comparisons, independent scores, local speed, quantisation regressions, memory, training, software and costs.

A dark desk with a closed plain silver laptop at the back right, a ring of brass keys with blank round bows in front of it, and a fan of blank white hotel-style key cards, one card stood up on the key ring. The left half is empty dark blue, with the headline and a stat drawn over it: 9 PRODUCTS.

Threat Intel15 Oct 2026

Symantec names 9 AI products in Aoki infostealer's targets; victims, sample dates and delivery are not stated

What Symantec's report establishes about Aoki and AI assistant credentials, what it leaves out, the dated record, vendor statements on storage, lifetime and revocation, what UK guidance covers, and ordered checklists. Defender level only.

A matte graphite laptop and a plain black smartphone on a dark desk in a night office, each showing a page of empty grey bars with one bright rectangular advertising slot holding a blank panel and an amber empty button. Behind them a row of identical dark monitors recedes. The left half is empty dark blue, with the headline and a stat drawn over it: at least 45.

Threat Intel15 Oct 2026

AdFection: Citizen Lab says ads helped Candiru target at least 45 Al Jazeera devices, no infection count

What Citizen Lab's AdFection report and Confiant's post establish, what they leave out, why the 45 devices and the 441,954,291 impressions cannot be divided, what the ad platforms said, what UK guidance covers and where it stops, and three ordered checklists. Defender level only.

A dark equipment room with a black server rack on the right and its mesh door swung open. Six identical grey servers carry blank pill-shaped nameplate wells, and a pull-out console shows a dim admin screen made only of empty rows and one indigo button. The left half is empty dark blue, with the headline: a critical Drupal flaw, its team said exploits might come in hours or days, and the figure 28.5%, of reporting sites, affected branch, no fix.

Threat Intel15 Oct 2026

Drupal's critical Field UI flaw has no fix for 28.5% of reporting sites; its team said exploits may take hours or days

What the Drupal Security Team's advisory and release notes state and do not state about CVE-2026-108097, the arithmetic behind 28.5 per cent, the May exploitation precedent, UK controls and where they stop, and a ranked checklist for three kinds of owner. Defender level only.

Page 13

Thursday 15 October

A dark wall with a grey switchboard patch panel on the right. Eighteen black cords, each plugged into its own jack above a blank label slot, gather into one bundle that runs down into a single brass junction box with a blank plate. The left half is empty dark blue, with the headline: the fix was public before Check Point published its findings, and the number 179 days.

AI Security15 Oct 2026

Check Point's LiteLLM flaws were fixed 179 days before its post; 1.83.9 is inside seven later advisories

What Check Point, LiteLLM, CVE.org, PyPI, CISA and independent researchers say about two LiteLLM gateway flaws: the dates, the versions, who needs what access, what exploitation is reported, UK controls and a ranked checklist. Defender level only.

Four plain brass padlocks of different ages stand in a row on a dark bench, from an old tarnished lock to a slim modern one with a faint cyan glow at the shackle. Each has a blank oval plate and a keyhole. The left half is empty dark blue with the headline Post-quantum TLS profiles are in. Still no date. and the figure 2031.

Compliance and Regulation15 Oct 2026

NCSC's new TLS guidance adds post-quantum profiles but prints no year; the blog beside it prints one, 2031

What changed between versions 1.1 and 1.2 of the NCSC's TLS guidance, how many recommendations carry a date or a test, how far the 2028, 2031 and 2035 milestones are, which groups are on by default, what the UK instruments say, and a ranked checklist.

A dark committee room. A thick printed Bill lies open on a polished walnut table, its pages showing rows of blank grey bars where text would be, with a pale cyan paper slip between them. Beside it stands an empty clear name-card holder on a steel foot. A row of empty teal leather chairs recedes into shadow. The left half is empty dark blue, with the headline and a stat drawn over it: 0 of 47.

Compliance and Regulation15 Oct 2026

UK Cyber Bill: AI appears 0 times in the text; 0 of 47 amendments on the 13 October list are the Government's

What the Bill, its amendment list, Hansard and the Government's three 12 October texts establish about AI in the Cyber Security and Resilience Bill, what they leave out, the calendar in days, which department owns it, what binds UK organisations now, and a ranked checklist.

A dark records archive. One long bank of pale grey steel shelving runs away on the right, filled with identical grey ring binders whose spines carry empty label slots, with a blank grey microfilm viewer in the foreground. At the far end of the aisle one desktop terminal glows with an empty pale screen. The left half is empty dark blue, with the headline and a stat drawn over it: legal aid breach data now goes back to 1978, 2010 to 1978.

Breaches and Incidents15 Oct 2026

Legal Aid Agency's stated data start moved from 2010 to 1978: about 250,000 pre-2007 records, no count of people

What the Legal Aid Agency's 14 October 2026 update states about records back to 1978, what it leaves out, the arithmetic behind the moving start date, why old records were online, what UK law and policy say, and a ranked checklist. Defender level only.

A pale grey-white polling booth with two tall side screens stands in a dark room on the right of the frame. On its plain shelf a tablet shows three empty rounded chat shapes, and a blank paper slip lies beside a pencil on a string. The left half is empty dark blue, with the headline and a stat drawn over it: 0.002%.

AI Security15 Oct 2026

Anthropic's 0.002% election-policy violation rate is about 5 in 250,000 conversations, with no count of actions

What Anthropic's 14 October 2026 post establishes about election use of Claude and what it leaves out: the arithmetic behind 0.002%, the 99% beside 85% on the same cards, where UK rules stop for chatbots, and checklists for election teams, communications leads and companies.

Eight identical blank slate-blue bound court files stand in a row on a pale oak records-office counter, with a tablet computer leaning against them showing blank grey chat bubbles. The left of the picture is dark navy with the headline: Eight states. Eight courts. Allegations, not findings. 27 counts.

Compliance and Regulation15 Oct 2026

Eight states filed eight separate suits against OpenAI: of 27 counts in six read, 6 concern AI agents

What the eight state filings plead about children, what they do not establish, where OpenAI's own pages agree and differ, what UK rules cover a chatbot children use, and a checklist for a school, a parent-facing organisation and a company.

A dark police station front counter in cool blue light. A rugged black tablet on a stand shows an empty grid of six blank dark frames beside a column of blank pills. A stack of clear evidence bags and blank white tags lies in front, a plain black shop basket holding two unmarked boxes stands to the right, and a small blue lantern glows behind. The left half is empty dark blue, with the headline and a stat drawn over it: 179 people.

Compliance and Regulation15 Oct 2026

ICO: about 500 Met accounts on Auror, 179 people uploaded, no DPIA, and a control gap it dates to May 2018

What the ICO's reprimand and enforcement notice to the Met establish about the Auror platform, what they leave out, the dates and deadlines worked out, which UK regime governs police and retailer flows, and ordered checklists for a force DPO, a retailer and a vendor.

A dark equipment room. In a black rack, a flat unmarked network appliance with a row of empty sockets has one grey cable plugged into its left socket, and a small blank paper tag tied to the cable. The left half is empty dark blue, with the headline and a stat drawn over it: 561 to 590 days.

Threat Intel15 Oct 2026

Unit 42 dates its FortiGate implant case to September 2024; the flaw behind the implant was published in April 2026

What Unit 42's PEERSTITCH report states and leaves out, the fix dates for four Fortinet flaws, why patching the FortiManager does not return stolen keys, what the NCSC, Cyber Essentials and the ICO say, and a ranked checklist. Defender level only.

A dark shop counter with a checkout touchscreen on the right showing a blank page of empty rounded shapes: an empty amber button inside an outlined banner, two empty grey bars and an empty cyan button below. A pale robotic hand in a grey glove reaches in from the upper right with one finger over the amber button. The left half is empty dark blue, with the headline and a stat drawn over it: 91%.

AI Security15 Oct 2026

HiddenLayer's Jev checkout test prints one query, 91% on the ad button, and states no trial count

What HiddenLayer's two pages print for Jev, what they leave out, the arithmetic on the one count they give, an independent preprint on the same version, TypeSafe's claims against its own documentation, what UK guidance says, and a ranked checklist. Defender level only.

A dark desk at night. An open graphite laptop shows a plain split window: a narrow left pane with five blank grey bars and a wide pale right pane with one blank bar across the top. In front of it lie a ring of old brass keys, one lifted from the others, and a blank white key-card. The left of the frame is empty dark blue, with the headline and a stat drawn over it: 44 days.

AI Security15 Oct 2026

Noma's SneakPeek report on Claude Code Desktop: 44 days to a final fix, and no Anthropic advisory found

Noma's SneakPeek dates computed from its blog and press release, which disagree on the first fix; what Anthropic's changelog and advisories say, which versions are fixed, whether auto-update applies, UK controls and an ordered checklist.

A dark server room, the left half empty dark blue with the headline and a stat drawn over it: 3 DAYS. On the right a flat grey rack-mount firewall appliance in a black rack, its faceplate unmarked, with a small separate two-jack panel at one end lit by a single cyan light. A plain blank off-white access card lies on the shelf below it.

Threat Intel15 Oct 2026

PAN-OS CVE-2026-0322: CISA gave 3 days, and Palo Alto gives no count for 'very limited' exploitation

What Palo Alto's advisory, CISA's entry and the NCSC's pages establish about CVE-2026-0322: a 3-day window against Cyber Essentials' 14, which PAN-OS builds are fixed, ten open questions, UK controls and an ordered checklist. Defender level only.

Wednesday 14 October

A dark spare room. On a plain steel wall shelf stand eight identical closed silver laptops, each with a tiny cyan status light on the shelf's front edge, above a bare desk with a black power strip and an empty black office chair. The left half is empty dark blue, with the headline and a stat drawn over it: 40+ Texas residences searched, 14 charged in Ohio, overlap not stated, and $3M.

Threat Intel14 Oct 2026

Over 40 Texas residences searched, 14 charged in Ohio, and no stated overlap between the two DOJ actions

What the DOJ releases and the 58-page indictment state about the 40-plus Texas residences, the 14 charged, the $3 million and the 70-plus companies, where five news stories count differently, what UK law asks of an employer hiring remote developers, and an ordered checklist.

Page 14

Wednesday 14 October

A dark desk at night with an open graphite laptop on the right. Its screen shows a generic empty browser window made of blank rounded shapes. In front of it a heavy brass chain joins three padlocks, each with its shackle open. The left half is empty dark navy with the headline and a stat drawn over it: 6 days.

AI Security14 Oct 2026

XBOW says a six-day Chrome chain cost about $40,000 and won $250,000, but not which access tier of GPT-5.6 Sol

What XBOW's pages, Google's release notes, rules page and public tracker, and OpenAI's model pages establish about a six-day Chrome chain, what they leave out, the arithmetic, UK patch clocks and the Computer Misuse Act as read, and a ranked checklist.

A brass balance scale on a dark slate table in blue light. In the left pan, a glass dish holds a neat stack of plain, unmarked square silicon processor packages. In the right pan sits a smaller stack of blank pale grey-blue research folders. The beam is level. The left half is empty dark blue, with the headline and a stat drawn over it: $50M a year.

AI Security14 Oct 2026

Nvidia's $250m UK AI safety pledge is $50m a year of compute, with commercial terms still to be agreed

What Nvidia's release and the Guardian's report establish about the $250 million pledge, the arithmetic against AISI's budget and Nvidia's own results, what is not stated, what UK guidance says about accepting vendor money, and an ordered checklist.

A dark server rack in cold blue light. A glass-fronted rack stands open on the right with plain grey servers, and one server tray is slid forward. In it sits a smaller matte black box with a hairline crack across its lid that runs out over the grey floor of the tray, with a thin cyan light along the line. The left half is empty dark blue, with the headline and a stat drawn over it: 2 OF 5.

Threat Intel14 Oct 2026

Vghost: kernel fix dated 3 August, demos 12 October, and 2 of 5 tested distributions still without a fix

What the kernel commit, the CVE record and the vendor trackers establish about Vghost, what found by AI does and does not say, how seven raters score it from 6.4 to 8.8, which of 26 releases have a fix, the UK clocks and a ranked checklist. Defender level only.

A dark equipment cabinet in cool light. A large brass screw-threaded coupling with a visible thread and a backed-off nut hangs in a dense sweep of cables in cyan, blue, white, grey, red and amber that all run into it. Blank recessed plates sit on unmarked rack units behind. The left half is empty dark blue, with the headline and a stat drawn over it: 616 days.

Threat Intel14 Oct 2026

curl's first High flaw in 1,099 days was in 13 releases; curl lists eight conditions for code execution

The arithmetic behind curl's High flaw, what its advisory states and leaves out, where libcurl hides, what the distributions had fixed on 14 October, the UK patch clocks as read, and a ranked checklist. Defender level only.

A plain black rack-mounted network appliance with two blank pill-shaped recesses on its bezel takes in a line of five blank cream envelopes on a steel roller conveyor. The envelope nearest the viewer carries one blank red wax seal. The left half is empty dark blue, with the headline and a stat drawn over it: 30 days.

Threat Intel14 Oct 2026

Cisco's second exploited email gateway flaw in 30 days: its two fixed builds were named on 14 September

What Cisco's 14 October advisory for CVE-2026-76519 states and leaves out, the two conditions and the scanner update that fixes it, the 16.0 gap, what Shadowserver's count can and cannot say, what NCSC, Cyber Essentials and the ICO say as read, and an ordered checklist. Defender level only.

A dark strongroom in cool steel light. A closed round vault door with a five-spoke wheel stands at the back right. In front of it a stack of six slate-blue ledger books is bound in a steel chain and held by one padlock, with three blank grey tags hanging from it. The left half is empty dark blue, with the headline and a stat drawn over it: 4 names, 1 entry.

Compliance and Regulation14 Oct 2026

UK lists Cryptomus and Heleket as one entity on a Russia ground, and the notice never mentions ransomware

What the UK notice states and does not, the arithmetic behind the Canadian fine and the 900 illicit counterparties a month, why a rebrand is not a control, what OFSI, the FCA, the NCSC and the ICO say as read, where the ransomware payment proposals stand, and an ordered checklist.

A dark print shop. On the right, four taut cords hold rows of identical pale paper sheets, each printed with the same blank page layout of empty rounded bars and boxes and no writing. One sheet in the front row has been ripped away, leaving a ragged strip in two wooden pegs and a crumpled scrap on the floor. The left half is empty dark blue, with the headline and a stat drawn over it: 34 names.

Threat Intel14 Oct 2026

Microsoft's temporary order moves 34 names under five domains; its billion messages are not a victim count

What Microsoft's announcement, its sworn declarations and the court order actually count: 34 names moved, a billion messages with no stated method, 1.1 million dollars traced against tens of millions claimed, and what UK organisations should do.

A dark small-shop back room. A row of plain white and grey boxes with blank label wells sits on a shelf above a counter holding a switched-off terminal screen on a stand and a pale grey card reader, with a dark server tower at the far right. The left of the frame is empty dark blue, with the headline and a stat drawn over it: 177 listed.

Threat Intel14 Oct 2026

Adobe's October bulletins list 177 flaws; every one rated critical sits in AEM, ColdFusion or Commerce

What Adobe's 11 bulletin pages establish and do not, why 176 is 177 entries and 175 ids, how priority 2 and 3 compare with the Cyber Essentials and NCSC clocks, the Commerce hotfix beside a no exploits line, and a ranked checklist. Defender level only.

A dark navy desk seen from high above. A very tall stack of blank white paper stands on the right, a small blank cream card lies in front of it, and a straight row of identical blank cream cards runs across the foreground with a small black-stand magnifying loupe over one of them. The left third is empty dark space carrying the headline and a stat drawn over it: 45 of 203.

Compliance and Regulation14 Oct 2026

Home Office asylum summaries: 45 of 203 failed first review, and omissions are not a stated failure test

What the Home Office's FOI counts, DPIA, ministerial letters and ATRS hub show about two AI tools in asylum casework: the arithmetic behind 45 of 203, what a checked sample cannot say about the rest, UK controls as read, and two ordered checklists.

A dark room. A small vintage glass-domed ticker machine stands on a wooden table beside a smartphone with its screen switched off. A pale paper ribbon rises from the machine and splits into many thin strands that reach a tall wall of several hundred identical small pigeonholes, a few holding curls of blank paper. The left half is empty dark blue, with the headline and a stat drawn over it: 627 days.

Compliance and Regulation14 Oct 2026

Norway fines Xandr NOK 92 million over Grindr data: assumed consent rejected, user count not established

What the Xandr decision establishes and redacts, the arithmetic behind the fine, how it differs from the Grindr case, what the ICO, UK GDPR Article 26, PECR and the 2025 Act say, and an ordered checklist for UK app publishers and ad buyers.

A dark frame with a traditional brass balance scale on a dark wooden counter, the whole scale on the right half. On the left pan hangs a small glowing pale blue plaque shaped like a blank browser window, with three empty dots, an empty address pill and an empty panel. On the right pan sits a short stack of plain blank coins. The left half carries the headline and the stat $2,000.

Market and Supply Chain14 Oct 2026

Chrome's bounty base is up 4x to $2,000, and Google's blog and rules page disagree on renderer rewards

Google's three Chrome rate cards side by side, cell by cell, the ratios between them, where the blog and rules page disagree, a Stated and Not stated table, what UK guidance says, and ordered checklists for Chrome patching and for running a bounty.

A dark desk after hours. On the right, three tall stacks of grey bound ledgers with blank label plates stand beside a closed silver laptop, and a cream folder with one red paper clip lies on the laptop. The left is empty dark navy with the headline and stat drawn over it: seven totals for one release, one exploited CVE, 7 TOTALS.

Threat Intel14 Oct 2026

Microsoft's October Patch Tuesday has seven totals, 1,407 to 1,417, and one exploited CVE, not three zero-days

Which rule produces each outlet's total and Critical count, what zero-day did and did not mean, what Microsoft states about the exploited Windows Shell bug, why its risk cohorts omit it, and the UK clocks and an ordered checklist, and September's release set beside it.

Page 15

Wednesday 14 October

A dark glass-walled meeting room at night. A wall-mounted television is swung out on a black arm so that its plain back panel and an empty recessed socket bay are visible, and a handheld detector wand lies on the table at the lower right. The left half is empty dark blue with the headline drawn over it: An alleged recorder in an OpenAI meeting room, and the figure 9 days.

Breaches and Incidents14 Oct 2026

Alleged OpenAI room recorder: 9 days from discovery to arrest, and no motive, recipient or captured audio stated

What the complaint, the Justice Department and OpenAI each say about the alleged recorder in an OpenAI meeting room, where the press accounts differ, what the record does not establish, what UK guidance covers, and an ordered checklist for AI and R&D labs.

A dark meeting room in blue black light. A long bare dark table runs towards the upper right with one empty office chair at each end, a closed grey laptop in the middle and a plain cream envelope in front, with no writing anywhere and no people. The left half is empty dark blue, with the headline and a stat drawn over it: five docket lines, none describing an act.

Breaches and Incidents14 Oct 2026

Ransomware-response executive reportedly arrested in ShinyHunters case: five docket lines, none describing an act

What the court record, the FBI Director's post and the RCMP statement establish about a reported arrest, the 23 days since the Dutch arrest, what is not stated, what the NCSC, ICO, OFSI and Home Office pages say about choosing a response supplier, and an ordered checklist.

A dark desk in cold blue light. An unmarked pale grey desktop document scanner holds a stack of blank white sheets in its input tray and feeds one blank sheet out of the front. Behind it a flat monitor shows a grid of twelve blank page thumbnails, one outlined in cyan. The left half is empty dark blue, with the headline and a stat drawn over it: 0 of 10,240.

Threat Intel14 Oct 2026

Ghostscript CVE-2026-39919: two exploits failed 10,240 times on other builds and worked on the matching one

What Wordfence's post establishes about a Ghostscript PDF flaw, where BleepingComputer's wording departs from it, what 0 of 10,240 does and does not say, which distributions have a fix, the UK patching clocks, and a ranked checklist. Defender level only.

A shut service counter in a dim housing office. A silver roller shutter is pulled fully down behind a pale grey counter. On the counter lie a stack of buff cardboard case files with blank label panels and a cream rotary desk telephone. The left half is empty dark blue, with the headline and a stat drawn over it: 8,783.

Breaches and Incidents14 Oct 2026

Housing Ombudsman case-system incident: 8,783 determinations in 2025-26, and no count, supplier or date stated

What the Ombudsman's statement and its own published figures establish about a third-party incident in its case management system, what they leave out, the 72 hour clock, UK GDPR, NCSC and sponsor guidance, and ordered checklists for residents, landlords and small public bodies.

A dark desk lit by cool light. An open silver laptop on the right shows an abstract folder tree of blank rounded bars beside a panel of plain horizontal bars. In front of it lie a stack of plain white identity cards with a blank photo square and blank bars, and a loose ring of brass keys with a black fob. The left is empty dark blue, with the headline and a figure drawn over it: about 1,500.

Breaches and Incidents14 Oct 2026

Meta says 1% of the data taken from GitHub was personal, notifies about 1,500 people, and names no data types

What SecurityWeek's report of Meta's statements establishes, why the 1% cannot be turned into a count of people, the 14 to 42 day gap, what GitHub's controls document, the UK GDPR, NCSC and Cyber Essentials reading, and an ordered checklist. Defender level only.

Tuesday 13 October

A dark workbench in cool blue light. A grey steel shelf holds fifteen identical plain black set-top boxes in three rows, tangled with black cables that gather into a power strip. A blank, switched-off monitor stands in front on the right. The left half is empty dark blue, with the headline and a stat drawn over it: 0.39 tokens per second.

AI Security13 Oct 2026

Anthropic's self-replication test: 0.39 tokens per second on real TV boxes, 4 of 5 runs on emulated ones

What Anthropic's page shows and does not show on small-model self-replication: the speed on real TV boxes, 4 of 5 runs on emulated devices, SecurityWeek checked against it, The Register's critique beside Anthropic's case, UK controls and a ranked checklist. Defender level only.

A dark equipment rack holding one plain grey rack-mounted network appliance, with a row of empty network jacks and a blank rounded plate on its faceplate, black blanking panels above and below, and a pale blue network cable hanging in a coil from a hook on the rack post. The left half is empty dark blue, with the headline and a stat drawn over it: Fully patched, still exploited, 2 of 3.

Threat Intel13 Oct 2026

A fully patched Ivanti VPN gave an attacker root through a three-flaw chain; two flaws are fixed, one is not

What Ivanti, Volexity, NVD and CISA each state about the Connect Secure chain, the fixed builds and their dates, what the record does not establish, the UK clocks and duties, and an ordered checklist. Defender level only.

A dark quay at night. A stack of plain blue-grey steel shipping containers fills the right of the frame, all doors unmarked. A blank white luggage tag with two empty rounded slots hangs on a loop of wire from the nearest door, with a second blank tag behind it. The left of the frame is empty dark blue, with the headline and a stat drawn over it: 765 days.

Market and Supply Chain13 Oct 2026

Docker Hub's flaw let a token act as another user for 765 days; Docker says the fix took under four hours

What Docker's bulletin, the CVE record and the reporters' page establish about CVE-2026-105445, what a check of about 304,000 pushes can and cannot show, the dates worked through, UK controls and a ranked checklist. Defender level only.

A dark corporate server room in cool blue light. On the right stands a tall black rack of enterprise servers whose faceplates carry blank pill-shaped recesses, with grey cables down its side. In front of it a stainless steel service cart carries a flat monitor showing an empty form made only of blank rounded fields and an empty button. The left half is dark and carries the headline, SAP's 10.0 flaw sits in a library you must upgrade yourself, and the stat 53 days.

Threat Intel13 Oct 2026

SAP's October 10.0 is a library customers must upgrade, with a fixed build dated 53 days before the advisory

What SAP's 13 October overview and GitHub advisory state about the 10.0 OAuth2 SSRF in the Cloud SDK for Python, the 22 rows counted, who acts on each Critical row, the UK clocks to 27 October and an ordered checklist. Defender level only.

A dark data-centre aisle in cool blue light. A black rack on the right is filled with network switches whose faceplates carry empty port openings and blank pill-shaped recesses, with bundles of grey and teal patch cables falling in loops. One small amber port light glows on one switch. The left half is dark and empty and carries the headline, Cisco's October bundle, 16 of 35 CVEs score 9.0 or more, and the stat 20 of 35.

Threat Intel13 Oct 2026

Cisco's October bundle: 16 of 35 CVEs score 9.0 or more, 7 in NX-OS, and 20 are umbrella IDs with no bug count

What Cisco's 14 advisories state and do not: the count by product and score, what a 'hardening release' is, five critical NX-OS flaws gated by features, fixed releases per train, the UK 14-day clock to 21 October, and an ordered checklist. Defender level only.

A dark data centre aisle. On the right, a black server rack holds four matching pale grey rack servers above a row of blank black drives, with a flat black status panel at the top, switched off and blank, and one small amber light at its corner. More racks recede into the dark. The left half is empty dark blue, with the headline and a stat drawn over it: 32 DAYS.

Threat Intel13 Oct 2026

Progress published 31 MarkLogic flaws 32 days after the fixes shipped, and the August fixes miss them

What Progress's bulletin, release notes and CVE records establish about 31 MarkLogic flaws, what they leave out, the arithmetic behind 32 days, the Cyber Essentials clock, UK guidance and an ordered checklist. Defender level only.

A fashion boutique at night: a pale stone till counter holding a blank, switched-off card reader on a stand, a plain tissue parcel and an unprinted paper bag, with a long rail of plain dresses and jackets behind. The left of the picture is empty dark navy. Nothing in the picture carries any lettering.

Breaches and Incidents13 Oct 2026

TFG London's 163-word notice names three brands and no cause; its payment-data belief is not in it

What one company has stated about its Sunday incident, by whom and when, set against what customers must infer. Also H&M's denial of a ShinyHunters claim, the UK GDPR 72 hour limit counted from Sunday (derived), and two ordered checklists.

Page 16

Tuesday 13 October

A developer's desk in dim blue light. A slim grey monitor shows a dark terminal window made only of blank grey pill shapes and one small cyan cursor block. In front of it sits a sealed brown cardboard parcel whose white shipping label is blank, with a second blank label showing under one lifted corner. The left half is empty dark blue, with the headline and a stat drawn over it: 1,500+.

Market and Supply Chain13 Oct 2026

npm Trusted Publishing checked a name, not an ID, until first publish: Bloom counts 1,500+ packages exposed

What Bloom's write-up, GitHub's changelog and npm's documentation establish about the Trusted Publishing flaw, what they leave open, the dates and downloads worked through, what other registries' pages say, what the UK sources cover, and a ranked checklist. Defender level only.

Intel D270 PCIe accelerator shown at an angle against a dark blue background.

Market and Supply Chain13 Oct 2026

Intel D270 brings up to 480GB to a 350W PCIe design. Can it change local AI economics?

Intel D270 puts memory capacity at the centre of AI inference. We examine the 160GB/480GB distinction, 350W cooling, UK NVIDIA and Mac prices, and the small-lab opportunity.

Monday 12 October

A dark server room corner in cool blue light. A pale grey rack-mounted backup appliance with rows of blank black drive bays and a dark blank status display stands in an open black rack beside a tall graphite tape library whose smoked window shows shelves of plain black cartridges with empty pale label windows. The left half is empty dark blue, with the headline and a stat drawn over it: 9.4.

Threat Intel12 Oct 2026

Veeam CVE-2025-64393: a Backup Viewer can run code on the backup server, in version 12 only

What Veeam's advisories establish about the Backup Viewer flaw and the Cloud Connect file read, what they leave out, the fixed build for each version line, the evidence on exploitation, what UK guidance and Cyber Essentials say, and a ranked checklist. Defender level only.

A dark supermarket distribution-centre loading bay at night. Four empty steel roll cages stand idle in a row in front of a closed grey dock door, with a hand pallet truck parked beside them. A rugged handheld scanner rests on the near cage with its screen dark and blank and one small amber lamp lit. The left half is empty dark blue, with the headline and a stat drawn over it: 6 sentences.

Breaches and Incidents12 Oct 2026

Ahold Delhaize says stores are open; Albert Heijn's chief says work has stopped at some distribution centres

What the group, Albert Heijn and Delhaize each state, the sentences reused from 2024, the day's disclosures to scale, the 2024 notices, what the NPSA, NCSC and ICO say, and ordered questions and actions for UK retailers and suppliers to European grocers. Defender level only.

A dark equipment room. A grey rack-mount server is pulled forward out of a black cabinet on the right, its status lights dark. A blank paper calendar page with one amber square is clipped to the cabinet rail beside it, and a blank card tag with an amber band hangs from the server handle. The left half is empty dark navy carrying the headline Struts mapper flaw: two of four lines are end of life, and the words No patch.

Threat Intel12 Oct 2026

Struts CVE-2026-104711: two of four affected lines are end of life; the remedy is a mapper change, not a patch

What Apache's bulletins, the CVE records and CISA's catalogue establish about CVE-2026-104711 and its three companions, the version-line matrix, the end-of-life dates, what they leave out, UK controls and a ranked checklist. Defender level only.

A dark help-desk desk at night. A white desk telephone with blank round keys and its handset in the cradle sits beside an open laptop whose screen shows an empty remote-session window with blank pills, and a black headset with a boom microphone lies in front. The left half is empty dark blue, with the headline and a stat drawn over it: 42 of 50 recent victims were law firms.

Threat Intel12 Oct 2026

Luna Moth leak: no new malware, a phone call and a remote tool, and Check Point treats the files as unverified

What Check Point's analysis of the Luna Moth Files establishes, what it leaves open, the arithmetic behind it, what the NCSC, Cyber Essentials v3.3 and the ICO say, and a ranked checklist for a group that steals data without encrypting it. Defender level only.

A dark government briefing room. A slim graphite lectern with a pale ash-wood top stands right of centre, with a closed pale grey document folder and a darker elastic band lying on it, its label well empty. Behind it hangs a large wall display, switched off and completely blank. The left half is empty dark blue, carrying the headline and a stat drawn over it: 407 of 1,000+.

Compliance and Regulation12 Oct 2026

AI minister: breach 'likely, if not inevitable'. One pilot account shows 407 of 'over 1,000'; nothing new dated

The speech transcript, press release and Bill read for what is committed, dated, funded and binding: what the 1,000 counts, whether the Bill carries AI incident reporting (not today), what AISI is, and a UK checklist.

A dark supermarket aisle at night. A long freezer cabinet with fogged glass doors and almost bare wire shelves stands on the right, with a small grey refrigeration controller on a steel post whose display window is dark and blank, and a pool of water on the floor. The left is empty dark blue, with the headline and a stat drawn over it: 436 days.

Breaches and Incidents12 Oct 2026

French fridge attack: CERT-FR adds Copeland and Dixell to the Danfoss controllers; no source names the flaw used

What CERT-FR, Danfoss, the retailers, the Prime Minister's office and the Paris prosecutor have each said, the counts that do not reconcile, the dates of Danfoss's fixes against the attack, what UK rules and the FSA say, and a ranked checklist. Defender level only.

A dark datacentre aisle with one open rack at the right. Inside it a stack of blank grey accelerator trays, three pulled forward, a vertical copper power bar with black cables, and a steel coolant manifold with pale blue hoses. A row of closed racks recedes behind it. The left half is empty dark blue, with the headline and a stat drawn over it: 1.4X expected.

Market and Supply Chain12 Oct 2026

Microsoft expects Maia 300 to give 40% more tokens per megawatt than GPU systems it does not name, from 2027

The 40 per cent is a forecast against an unnamed baseline, five Microsoft GPU claims use five baselines, the rack arithmetic checks out, and Maia 200 already serves Copilot. What UK users of Copilot, Foundry and Azure OpenAI should put in writing.

A dark server room. A tall black server rack with plain blank drive bays stands on the right beside a wall-mounted board of three rows of five empty rounded tiles joined by thin lines, like a pipeline. One tile in the middle row carries a single small lit amber lamp. The left half is empty dark blue, with the headline and a stat drawn over it: CVSS 10.0.

Threat Intel12 Oct 2026

GitLab says CVE-2026-97229 needs no account, the third regex-titled critical in 19 days

One CVSS metric separates 12 October's critical from the two regex criticals of 23 September: the attacker no longer needs an account. What GitLab states, what it leaves out, the count checked, CISA and the NVD at 14:52 BST, the UK 14 day clocks and an ordered checklist.

A dim conference room. A long dark graphite table recedes from the lower right, with a closed pale grey document folder in the foreground sealed by a pale blue paper band and a blank round disc, its label wells empty. At the far end one empty chair sits pushed back. The left half is empty dark blue, carrying the headline and a stat drawn over it: 36 days.

AI Security12 Oct 2026

Three OpenAI safety researchers dismissed: both sides cite trust, neither publishes the policy, material or date

What OpenAI and the three researchers each state, the dates drawn to scale, what neither states, what METR's own record shows, who holds the key to outside monitors, what UK pages say, and an ordered checklist for a customer and a board.

A dark workbench in cool blue light. A small black handheld hardware wallet lies opened, its plain black back cover set beside it, showing a blank teal-green circuit board with unmarked chips and one small extra board at the top end. A steel-rimmed magnifying glass on a clamp stand hangs over it. The left half is empty dark blue, with the headline and a stat drawn over it: $72M to $93M.

Market and Supply Chain12 Oct 2026

Ledger now says the implant reads the screen and sends the recovery phrase by LTE; no loss figure is confirmed

How Ledger says the implant works, the German retailer that halted sales, whose loss figures are whose, why the 72 hour update was not 72 hours, what the Genuine Check tests, the 90-day window against June funding dates, the UK position, and an ordered checklist for owners.

Page 17

Monday 12 October

A dark server room. A black equipment rack holds six flat grey firewall appliances with blank label plates, and a single small cyan status light is lit on the third. Beside it a plain paper calendar page is taped to the rack, a grid of empty squares with one square outlined in cyan marker. The left half is empty dark blue, with the headline and a stat drawn over it: 149 days.

Threat Intel12 Oct 2026

Palo Alto's CVE-2026-0257 advisory was 149 days old when ReliaQuest warned ransomware groups still use it

A computed gap, 149 days, from Palo Alto's advisory to ReliaQuest's warning; the fixed versions per train; four scores for one flaw; what no source establishes; UK controls; and an ordered checklist. Defender level only.

A dark operations desk at night. A spiral-bound desk calendar with an empty grid and one blank square ringed in cyan stands in front of a black server rack with blank label wells, beside a monitor showing six empty rounded bars and a brass desk lamp. The left of the frame is empty dark blue with the headline drawn over it: Let's Encrypt moves to 64-day certificates, and a stat, 64 days.

Market and Supply Chain12 Oct 2026

Let's Encrypt moves to 64-day certificates on 10 February 2027; its last 90-day one should expire 11 May

What Let's Encrypt's own pages and the CA/Browser Forum's rules say about 64-day certificates, what a fixed renewal rule does at 90, 64 and 45 days, what the record leaves out, what UK guidance asks for, and an ordered checklist.

A dark desk in low blue light with one open laptop on the right. Its screen is tiled with about three dozen small identical blank windows, each with a pale title bar and two grey bars, and the keys are blank. The left half is empty dark blue, with the headline and a stat drawn over it: 51 agent files, WordPress flaws fixed on 17 July, 32 shells.

Threat Intel12 Oct 2026

CyberXero: 51 Claude Code agent files, 32 shells in 61 seconds, and WordPress flaws fixed on 17 July

What SOCRadar's CyberXero report establishes, what it does not, the arithmetic behind 32 shells in 61 seconds and 564,073 of 628,000 records, the public fixes and CISA KEV status for the named CVEs, what the model's maker has said, UK controls, and a ranked checklist. Defender level only.

A dark designer's desk at night. A large monitor shows a half-built web page layout made only of blank rounded shapes, with a dark indigo side panel and a bright canvas. Beside it stands a small industrial warning lamp with a smoked amber dome, switched off. A white mouse and stylus lie on a grey felt mat. The left half is empty dark blue, with the headline and a stat drawn over it: 21:47 UTC.

Threat Intel12 Oct 2026

Bricksforge CVE-2026-85097: exploit attempts began on disclosure day; the changelog has no 3.1.8.10 date

What the primary records establish about CVE-2026-85097: the first attempt, a fix date nobody publishes, three flaws in five weeks on one database's dates, a spray of 56 requests from 44 addresses, UK controls and an ordered checklist. Defender level only.

Sunday 11 October

A dark laboratory bench in dim blue light. An unmarked pale grey and white desktop robotic arm reaches forward with its gripper open, beside a plain grey control cabinet whose door carries two blank recessed plates. A brushed steel stopwatch with a plain dial and one blue hand lies in front. The left half is empty dark blue, with the headline and a stat drawn over it: 8 of 8.

AI Security11 Oct 2026

Booz Allen's OT lab met 8 of 8 objectives with every exploit human-approved, and states no run count or model

What Booz Allen's page and white paper establish about an AI test in its OT lab, what they leave out, the arithmetic behind 8 of 8, how the UK AI Security Institute's industrial range and the NCSC compare, what UK guidance covers, and a ranked checklist. Defender level only.

A dark room with an open paper desk diary on a walnut desk at the right of the picture. Its pages hold seven empty ruled boxes with blank pills at the top, and one amber sticky note lies in a box on the right page. The left is empty dark, with the headline and a stat drawn over it: 0 clicks.

Threat Intel11 Oct 2026

Calendar phishing arrives with zero clicks on Google Workspace's default; Sublime's 33,000% is a projection

What Google's and Microsoft's own pages say about the default, which settings stop a calendar lure and which do not, the number behind "exponential", what no source establishes, UK reach of the NCSC and Cyber Essentials, and a ranked checklist. No lure is printed.

A dusk landscape. A pale grey outdoor steel cabinet stands in the right foreground with its door swung open and a brass padlock hanging open from the hasp, an empty blank plate on the door. The base of a white wind turbine tower rises behind it and rows of solar panels recede to an amber horizon. The left half is empty dark blue, with the headline and a stat drawn over it: 93% solar.

Threat Intel11 Oct 2026

Modat counts 8,547 wind and solar systems reachable online: 93% solar, a floor, and the UK outside its scope

What Modat's pages, Reuters and others establish about 8,547 exposed wind and solar systems, the arithmetic behind the percentages, why the UK is outside the count, what the NIS Regulations and the NCSC say, and a ranked checklist. Nothing identifying a site is printed.

Saturday 10 October

A dark room with two near-identical brass nameplates side by side on a walnut desk at the right of the picture. Each has four screws and an empty recessed panel. The right plate is slightly darker and redder, with a small dimple at each end of its panel. The left is empty dark, with the headline and a stat drawn over it: 29 letters.

Threat Intel10 Oct 2026

Two characters put 20 lookalike domains past Chromium's checks: a 29-letter list and an 8,462-domain list

What the researchers' write-up and Chromium's own source establish about two characters that pass the browser's lookalike checks, what is not stated, why a list fails open for a letter or a brand it does not hold, UK controls and a ranked checklist. No lookalike domain is printed.

A dark desk at night with a black smartphone lying face up at the centre right. Its screen shows an update page made only of empty pills: one short title pill, three wide grey pills and a blank pale cyan button. Beside it stand a small closed steel padlock and, behind it, a blank white card. The left is empty dark, with the headline and a stat drawn over it: 239 days.

Threat Intel10 Oct 2026

P7 DarkSword is a kit for iOS 18.4 to 18.7, and Apple fixed all six of its flaws by 11 February 2026

What iVerify, Google, Lookout, Censys, Report URI and Apple establish about P7 DarkSword: the six flaws and their fixes, which iPhones are exposed, what is not stated, UK controls and a ranked checklist. No indicators are printed.

A dark desk at night. A small brushed-steel drop box stands on a walnut desk at the right of the picture, with one blank cream paper slip sticking up out of the slot in its top and a smooth, empty oval panel on its front. Behind it a black wire tray holds a loose drift of identical blank slips. The left half is empty dark, with the headline and a stat drawn over it: 72 days to find, 9 to tell, 81 days.

AI Security10 Oct 2026

A Claude model's fake police tip took 72 days to find and 9 more to report; Anthropic calls the impact minimal

Dates, counts and labels in Anthropic's 9 October report on unintended model actions: what the police statement adds, what no source states, and what UK organisations that give agents live internet access should do.

A dark room with a silver laptop on a walnut desk at the right of the picture. Its screen shows a download page made only of empty pills, a browser strip, and a pale cyan button above a blank command panel with an empty copy square. Beside it stands a blank white card and a blank amber sticky note lies on the desk. The left is empty dark, with the headline and a stat drawn over it: 4 stops.

Threat Intel10 Oct 2026

A Google ad showed bing.com; four stops later a fake Claude installer's copy button swapped the command

What Push Security and BleepingComputer establish about the Adception campaign: the four stops, the cloaking gates, the swapped clipboard command, what is not stated, UK controls for Macs and a ranked checklist. No attacker addresses are printed.

A dark wooden library card catalogue: rows of identical small drawers with brass pulls and blank label frames, about a dozen pulled slightly open, each with a thin blank white sheet standing up showing empty grey bars. Text on the left reads: One campaign, three counts: 345, 772, and 'tens of thousands'. 81% of the 345 repositories in two sweeps were forks (279, derived).

Market and Supply Chain10 Oct 2026

GhostAction: 345 repositories in two sweeps; GitGuardian's update of 13 October counts more than 30,000

A fake security-audit workflow, counted four ways: 345 repositories in a day (81% forks), 772 over a month, Socket's unnumbered tens of thousands, and now more than 30,000 from GitGuardian. What each counts, what ran, and what a UK reader can conclude.

Show 12 more