The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 49 to 72 of 654 briefings

Friday 23 October

Compliance and Regulation23 Oct 2026

UK White Paper proposes up to 14 years for deliberate subsea cable and pipeline damage

What the UK White Paper of 22 October 2026 proposes for subsea cables and pipelines: new offences replacing parts of the 1885 Act, a three-tier penalty structure topping out at 14 years, new duties for telecoms providers, and a consultation closing on 14 January 2027.

AI Security23 Oct 2026

Flaws in x402 AI agent payment code could let rogue APIs drain an agent's full token balance

What V12 reported in the x402 payment code: 25 vulnerabilities, three critical, a default client with no spending limit, a Solana verifier that accepted an approval as a payment, a login signature requested for another website, and fixes shipped on 18 August 2026 without an advisory.

Threat Intel23 Oct 2026

Node2Shell Brotli briefing withdrawn: it duplicated another briefing and named Node.js versions that do not exist

Why this Node.js Brotli briefing was withdrawn and where the account of CVE-2026-111497 is.

Breaches and Incidents23 Oct 2026

Capcom ID breach leaks 11.7 million customer records with 196 passwords altered by attackers

Technical breakdown of the Capcom ID data breach: 11,774,247 customer records exposed, 196 unauthorized password changes, and sign-in IP telemetry weaponization.

Market and Supply Chain23 Oct 2026

Pillow 13.0.0 fixes Ghostscript argument injection CVE-2026-112900; CVE record scores it 9.2, maintainers rate it Medium

What the Pillow advisory, the CVE record, the fix commit and the 13.0.0 release notes state about CVE-2026-112900, how the scores differ, and what an attacker needs beyond a filename.

Threat Intel23 Oct 2026

Arista VeloCloud CVE-2026-114625: any authenticated user can gain operator rights; CISA lists it as exploited

What Arista's CVE record and CISA's catalogue state about CVE-2026-114625: affected and fixed releases, the minimum role, the two earlier exploited VeloCloud Orchestrator flaws, and what the record leaves out.

Thursday 22 October

AI Security22 Oct 2026

Symantec Skynet Mode briefing withdrawn: its telemetry, costs and code are not in Symantec's report

Why this Symantec briefing was withdrawn and what Symantec's 21 October report on an autonomous LLMjacking agent says.

Threat Intel22 Oct 2026

Storm-0940 ARTEX briefing withdrawn: it duplicated another briefing and invented dates and notifications

Why this Storm-0940 briefing was withdrawn and where the corrected account is.

Threat Intel22 Oct 2026

UK government services briefing withdrawn: it joined two unrelated stories and carried unsupported detail

Why this UK government briefing was withdrawn, what the BBC and the NCSC say about the PHP shutdowns, and where the AI pilot figures come from.

Threat Intel22 Oct 2026

Mozilla says eight eMudhra intermediate CA private keys were below 256; Chrome and Firefox blocked them

What Mozilla, Google, Apple, CERT-In and eMudhra state about eight eMudhra intermediate CA keys below 256, what each has blocked, and what non-browser software must still update.

Threat Intel22 Oct 2026

Signal RingRTC zero-day flaw exposes ambient audio after hang-up

Technical analysis of Signal RingRTC CVE-2026-113380: FSM queue saturation, decoupling of UI dismissal from WebRTC audio hardware teardown, and the 2.72.0 fail-forward patch.

Threat Intel22 Oct 2026

INTERPOL says Operation Serengeti III led to 1,462 arrests and over USD 105 million recovered

What INTERPOL's release says about Operation Serengeti III: 1,462 arrests, 10,909 disrupted networks, more than USD 105 million recovered, the cases it names in Uganda, Angola, Nigeria, Tanzania and Gabon, and what it does not state.

Page 6

Thursday 22 October

Threat Intel22 Oct 2026

Kaspersky says Lazarus malware uses ML-KEM-1024 key exchange in Operation FlashHole against South Korea

What the Securelist report on Operation FlashHole says about ML-KEM-1024 in LPEClient, the infection chain, victims and indicators, checked against the report, the Kaspersky release and NIST FIPS 203.

Threat Intel22 Oct 2026

SafePay advisory AA26-293A briefing withdrawn: most of its figures and technical detail are not in the advisory

Why this SafePay briefing was withdrawn, and what the CISA and FBI advisory AA26-293A actually says.

AI Security22 Oct 2026

Claude Duet briefing withdrawn: it described a different product from the one Anthropic announced

Why this Claude Duet briefing was withdrawn, and what Anthropic says Claude Duet is.

Market and Supply Chain22 Oct 2026

LiteLLM 1.107.0 compromise: this briefing is withdrawn; its figures, indicators and commands were not supported

Why this LiteLLM briefing was withdrawn, what LiteLLM's own posts say about the 21 October compromise, and where the corrected briefing is.

Wednesday 21 October

AI Security21 Oct 2026

NVIDIA confidential computing briefing withdrawn: its headline overhead figure and library have no vendor source

Why this NVIDIA confidential computing briefing was withdrawn, and what NVIDIA and Google Cloud actually announced on 21 October.

AI Security21 Oct 2026

Cohere Rerank 5 briefing withdrawn: the security boundary it described is not in Cohere's announcement

Why this Cohere Rerank 5 briefing was withdrawn, and what Cohere's own pages say about the 21 October release.

Market and Supply Chain21 Oct 2026

Google Cloud and NVIDIA say A5X Vera Rubin instances reach GA next month, with up to 960,000 GPUs planned

What Google Cloud and NVIDIA published on 21 October 2026 about A5X instances on Vera Rubin NVL72, what NVIDIA's datasheet lists for memory, NVLink, rack power and cooling, and what neither company states.

AI Security21 Oct 2026

OpenAI details Patch the Planet and a five-stage response framework after the PHP2Shell flaws

What OpenAI says about its Patch the Planet programme, built with Trail of Bits, and about its role in the PHP2Shell response; its proposed five-stage framework; what the post does not say; and how the PHP Foundation and Cloudflare describe the leak.

Threat Intel21 Oct 2026

PHP issues emergency fixes for two critical RCE flaws: CISA and UK NCSC issue urgent alerts

What PHP's advisory, the NCSC and CISA say about the PHP2Shell flaws: the four fixed releases, the stopgaps PHP prints, who is affected, and a corrected update checklist.

Threat Intel21 Oct 2026

PHP patches two critical RCE flaws: mod_php highest risk, FPM needs attention too

Two PHP 9.2 flaws can lead to unauthenticated code execution. The official advisories distinguish mod_php and FPM exploit evidence, fixed versions and interim controls.

Threat Intel21 Oct 2026

SafePay: agencies count at least 600 victims, but the access route varies

The joint SafePay warning identifies at least 600 victims and two distinct access families. Here is how to test each exposure without treating the campaign as one fixed attack chain.

Threat Intel21 Oct 2026

The order email passed authentication. The planted helpline was the attack

In Talos's samples, the sender passed checks while a fake support number appeared in shipping or billing fields. We trace that boundary, the 1,400-message denominator and two related notification routes.