The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 37 to 72 of 654 briefings

Saturday 24 October

Editorial illustration of an AI data-centre rack beside the Kimi K3.1 Pro headline, noting API access now, weights later and $2 input/$10 output pricing per million tokens.

Market and Supply Chain24 Oct 2026

Kimi K3.1 Pro launches at $2/$10 per million tokens, weights promised by 4 November

Kimi K3.1 Pro is live by API at $2 input and $10 output per million tokens. We examine benchmark methods, real request costs, cyber capability and the promised open-weight release.

Friday 23 October

Enterprise media server rack illuminated with neon amber and cyan data streams, network packets flowing into internal loopback routing and transcoder frames converting into ELF shared objects.

Threat Intel23 Oct 2026

CISA adds Plex2Shell unauthenticated RCE chain to Known Exploited Vulnerabilities catalog

Technical autopsy of the Plex2Shell exploit chain (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656): loopback token theft, x264 dump-yuv carrier video writes, unsigned codec dlopen execution, and CISA KEV listing.

$A luminous geometric orange and violet polygon with spidering crimson fractures floating above enterprise server racks and cascading regular expression code syntax.$

Threat Intel23 Oct 2026

GitLab issues emergency patches for maximum severity CVSS 10.0 integer overflow RCE

Technical breakdown of GitLab emergency release: CVSS 10.0 integer overflow CVE-2026-110264, Ruby Onigmo regex compiler heap corruption, 4,535-day exposure window, and seven-train backport matrix.

Dark cinematic artwork of an autonomous artificial intelligence neural network executing automated cyber intrusions and ransomware kill chains.

AI Security23 Oct 2026

Russian ransomware syndicates weaponise Phantom autonomous AI framework against 7,100 edge systems

Threat actors operating with INC Ransomware and The Gentlemen weaponised the Phantom autonomous AI framework and 32 MCP servers to compromise 7,158 edge devices.

A dark editorial scene for the briefing, with its headline and key figure drawn over it.

Threat Intel23 Oct 2026

Microsoft says Storm-0940 used ARTEX AI agents to try sign-ins at more than 2,250 tenants via ConnectWise

What Microsoft says Storm-0940 did with the ARTEX AI framework after the ConnectWise Cloud Backup compromise: sign-in attempts to more than 2,250 tenants, a password spray that peaked at 2,900 failures a minute, and what is not established.

Dark data centre racks with glowing cabling and a cluster of crystalline nodes, with the headline and the version 1.107.0.

Threat Intel23 Oct 2026

LiteLLM supply chain attack poisons official PyPI and Docker builds with Python startup backdoor

LiteLLM version 1.107.0 compromised on PyPI and Docker Hub via stolen GitHub CLI OAuth tokens, injecting a Python startup backdoor and credential stealer.

Abstract high-tech 3D network topology visualization of glowing enterprise wireless mobility controllers and radio access points transmitting illuminated data packets.

Threat Intel23 Oct 2026

HPE Aruba patches 72 vulnerabilities in wireless operating systems including eight CVSS 10.0 RCE flaws

HPE Aruba bulletin HPESBNW05162 patches 72 flaws across AOS-8 and AOS-10 wireless operating systems, including eight CVSS 10.0 remote code execution vulnerabilities.

Abstract geometric visualization of glowing perimeter firewall gateway nodes subjected to automated exploit scanning and data exfiltration pipelines.

Threat Intel23 Oct 2026

Threat actor k0t breaches enterprise firewalls exposing 70,000 credentials for ransomware gangs

Group-IB and NyxLab expose threat actor k0t compromising Fortinet and Palo Alto firewalls to harvest 70,000 credentials feeding Qilin and The Gentlemen ransomware.

Sterile data corridors and server racks with glowing blue and crimson biometric data telemetry streams inside a medical facility.

Breaches and Incidents23 Oct 2026

Quest Diagnostics isolates Quanum clinical platform following unauthorized patient record access

Technical analysis of Quest Diagnostics SEC Form 8-K: unauthorized intrusion into Quanum LSM clinical portal exposes patient records across healthcare network.

Threat Intel23 Oct 2026

Russia-aligned UAC-0099 and Sandworm hid a backdoor's C2 in the Yggdrasil mesh before a data wipe in Ukraine, ESET reports

ESET's account of an intrusion at a Ukrainian grain logistics company: UAC-0099 initial access, a Go backdoor with its command server inside the Yggdrasil mesh, and a Sandworm wipe two months later.

Threat Intel23 Oct 2026

Microsoft 365 token spraying compromises 79 organisations across 70 days without passwords

What Huntress reported on 22 October 2026: a ten-week Microsoft 365 token-spraying campaign, at least 497 successful sign-ins at 79 organisations, rogue Entra devices, replaced MFA methods and hidden inbox rules, and what Huntress advises defenders to do.

Threat Intel23 Oct 2026

PHP advisory on CVE-2026-115560: an unlikely session upload RCE vector, with the fix due in the next regular release

What PHP's informational advisory on CVE-2026-115560 says and leaves out: the conditions it names, the one-line setting it suggests, the missing versions, severity score and release date, and what The Register, The Hacker News and Cloudflare add.

Page 5

Friday 23 October

Compliance and Regulation23 Oct 2026

UK White Paper proposes up to 14 years for deliberate subsea cable and pipeline damage

What the UK White Paper of 22 October 2026 proposes for subsea cables and pipelines: new offences replacing parts of the 1885 Act, a three-tier penalty structure topping out at 14 years, new duties for telecoms providers, and a consultation closing on 14 January 2027.

AI Security23 Oct 2026

Flaws in x402 AI agent payment code could let rogue APIs drain an agent's full token balance

What V12 reported in the x402 payment code: 25 vulnerabilities, three critical, a default client with no spending limit, a Solana verifier that accepted an approval as a payment, a login signature requested for another website, and fixes shipped on 18 August 2026 without an advisory.

A dark panel with a notice that this briefing has been withdrawn for rewriting.

Threat Intel23 Oct 2026

Node2Shell Brotli briefing withdrawn: it duplicated another briefing and named Node.js versions that do not exist

Why this Node.js Brotli briefing was withdrawn and where the account of CVE-2026-111497 is.

Breaches and Incidents23 Oct 2026

Capcom ID breach leaks 11.7 million customer records with 196 passwords altered by attackers

Technical breakdown of the Capcom ID data breach: 11,774,247 customer records exposed, 196 unauthorized password changes, and sign-in IP telemetry weaponization.

Market and Supply Chain23 Oct 2026

Pillow 13.0.0 fixes Ghostscript argument injection CVE-2026-112900; CVE record scores it 9.2, maintainers rate it Medium

What the Pillow advisory, the CVE record, the fix commit and the 13.0.0 release notes state about CVE-2026-112900, how the scores differ, and what an attacker needs beyond a filename.

Threat Intel23 Oct 2026

Arista VeloCloud CVE-2026-114625: any authenticated user can gain operator rights; CISA lists it as exploited

What Arista's CVE record and CISA's catalogue state about CVE-2026-114625: affected and fixed releases, the minimum role, the two earlier exploited VeloCloud Orchestrator flaws, and what the record leaves out.

Thursday 22 October

AI Security22 Oct 2026

Symantec Skynet Mode briefing withdrawn: its telemetry, costs and code are not in Symantec's report

Why this Symantec briefing was withdrawn and what Symantec's 21 October report on an autonomous LLMjacking agent says.

Threat Intel22 Oct 2026

Storm-0940 ARTEX briefing withdrawn: it duplicated another briefing and invented dates and notifications

Why this Storm-0940 briefing was withdrawn and where the corrected account is.

Threat Intel22 Oct 2026

UK government services briefing withdrawn: it joined two unrelated stories and carried unsupported detail

Why this UK government briefing was withdrawn, what the BBC and the NCSC say about the PHP shutdowns, and where the AI pilot figures come from.

Threat Intel22 Oct 2026

Mozilla says eight eMudhra intermediate CA private keys were below 256; Chrome and Firefox blocked them

What Mozilla, Google, Apple, CERT-In and eMudhra state about eight eMudhra intermediate CA keys below 256, what each has blocked, and what non-browser software must still update.

Conceptual visualization of encrypted telecommunications and acoustic surveillance showing active audio waveforms flowing across cybernetic processor circuits.

Threat Intel22 Oct 2026

Signal RingRTC zero-day flaw exposes ambient audio after hang-up

Technical analysis of Signal RingRTC CVE-2026-113380: FSM queue saturation, decoupling of UI dismissal from WebRTC audio hardware teardown, and the 2.72.0 fail-forward patch.

Threat Intel22 Oct 2026

INTERPOL says Operation Serengeti III led to 1,462 arrests and over USD 105 million recovered

What INTERPOL's release says about Operation Serengeti III: 1,462 arrests, 10,909 disrupted networks, more than USD 105 million recovered, the cases it names in Uganda, Angola, Nigeria, Tanzania and Gabon, and what it does not state.

Page 6

Thursday 22 October

Threat Intel22 Oct 2026

Kaspersky says Lazarus malware uses ML-KEM-1024 key exchange in Operation FlashHole against South Korea

What the Securelist report on Operation FlashHole says about ML-KEM-1024 in LPEClient, the infection chain, victims and indicators, checked against the report, the Kaspersky release and NIST FIPS 203.