The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 85 to 108 of 654 briefings

Tuesday 20 October

A dim data hall at night: a row of tall black server rack cabinets with perforated mesh doors, receding to the right. One cabinet in the middle is dark, its indicator lights off, between cabinets lit with rows of small cyan and green lights. A small amber lamp glows on the end wall. The left half is darkened, with the headline and the stat 38 PRODUCTS drawn over it.

Breaches and Incidents20 Oct 2026

Google says a power event hit one London zone: 38 products listed, UK banks and courts report faults

What Google's status entries say, minute by minute, what its documentation and SLAs promise when one zone fails, who said what in the UK, and what the PRA, FCA, ICO and Treasury regimes require. A developing incident, time stamped.

Editorial illustration for the briefing: Bullhorn says service is restored 62 to 63 hours after its cyber incident notice; exfiltration 'not yet determined'

Breaches and Incidents20 Oct 2026

Bullhorn says service is restored 62 to 63 hours after its cyber incident notice; exfiltration 'not yet determined'

What Bullhorn's status page, FAQ and known limitations page state and do not state about its cyber incident, the credential changes, and what UK controllers and processors must do under the ICO and NCSC texts. Time stamped 20 October 2026.

A dark desk. On the right, a thick hardback book lies open with blank pages and seven blank coloured index tabs along its left edge, a black pen resting on the page. Behind it an open laptop shows a screen with seven empty outlined boxes. The left half is empty dark navy, with the headline and a stat drawn over it: 33 strands.

AI Security20 Oct 2026

NCSC's AI research chapter, 20 October 2026: 7 problems, 33 strands, and no UK code or guideline named

What the NCSC's new AI chapter asks, counted from the pages read on 20 October 2026: seven problems and 33 strands, which have a published UK answer, which words it leaves undefined, what it does not state, the UK routes to engage, and a ranked checklist.

A dark desk in low blue light. A silver laptop on the right shows a plain list of empty rounded rows, the top few tinted amber, with no writing. In front of it lies an unmarked steel padlock with its shackle open, and beside it a steel stopwatch with a plain white dial and one blue hand. The left half is empty dark navy, with the headline and a stat drawn over it: 94 minutes.

Market and Supply Chain20 Oct 2026

OVHcloud CLI: five releases swapped for up to 94 minutes on 19 October 2026, and the checksum list was swapped too

What the public issue, GitHub's release records, the Homebrew tap and OVHcloud's statements show: which files were swapped, which install routes were exposed, what immutable releases do and do not lock, what UK guidance says, and a ranked checklist. Defender level only.

A dark IT desk at night. A matte grey laptop shows a generic backup utility made only of shapes: a sidebar of empty pills, a progress bar about two thirds full, two blank buttons and three list rows. A small pop-up card outlined in amber, with a blank banner and one empty button, overlaps the lower right corner of the window. The left half is dark, with the headline and the stat 10 + 6 + 5 MIN drawn over it.

Market and Supply Chain20 Oct 2026

AOMEI Backupper's checksum was rewritten with the file in three confirmed 10, 6 and 5 minute windows, 28 May to 20 July

What Google, ManageEngine and AOMEI say about the Backupper tampering, the intervals computed from the dates, the labels that did the work of controls, what UK guidance covers and where it stops, and a ranked checklist. Defender level only.

A dark engineering workstation at night. One monitor shows an installer-style window with blank list rows and a half-filled progress bar beside a folder window of identical blank file tiles, one tile outlined in amber and tilted. A desk lamp glows amber at the right edge. The headline and figure are added by the site.

Threat Intel20 Oct 2026

Siemens Software Center CVE-2026-110936: fix added 17 October, exploitation noted 19 October

What Siemens's advisory, blog and CVE records state about CVE-2026-110936, the four days before exploitation was noted, two scores, what Romulus is, what UK guidance reads, and a ranked defender checklist. Defender level only.

Monday 19 October

A black GPU server pulled halfway out of a dark equipment rack on steel slide rails, its lid off, showing a row of eight finned graphite heatsinks and two empty recessed plates on the front panel. The left half of the image is empty dark navy, with the headline and a stat drawn over it: 510 GB, on disk, one released format.

AI Security19 Oct 2026

DeepSeek V4.1 Flash 1017 is 510 GB under MIT: 16B active, 763B stored, as read on 19 October 2026

What 510.3 GB of MIT-licensed weights need to run: memory by format against NVIDIA hardware, a 890-byte-per-token cache that only DeepSeek's own stack is stated to reach, independent numbers, where hosted prompts go, UK controls and a ranked checklist.

A dark desk at night with a silver laptop open on a code editor. In the file tree at the left of the screen are rows of blank rounded bars with small folder and file icons, one file outlined in amber. The editor pane shows blank bars like lines of code. The left of the picture is empty and dark and carries the headline: A 'font' that is a script, planted in 94 repositories, with 66 OWNERS and 15 repositories gone, 79 still reachable.

Market and Supply Chain19 Oct 2026

GhostAction stage two, 19 October 2026: 94 repositories, 66 owners, a "font" that is a script

What the second-stage count of 94 repositories and 66 owners measures, what it does not, who says GitHub blocked the first stage, what VS Code and the NCSC document, and an ordered checklist. Defender level only.

A dark room with a black server rack holding two brushed steel rack servers with blank recessed plates, and in front of it an open laptop on a black flight case. The laptop screen shows a list of five blank pale rows, the top three marked with amber dots and the bottom two with blue dots. The left half is empty dark blue, carrying the headline: five NGINX flaws, fixed 14 Oct, nginx.org rates all five medium, and the stat 3 of 5.

Threat Intel19 Oct 2026

Five NGINX flaws fixed 14 October: nginx.org says all medium, F5's CVSS 4.0 rates three critical

The labels on five NGINX flaws (nginx.org medium, F5 CVSS 4.0 critical for three), what each flaw needs, which press claims the records support, what the distribution trackers showed on 19 October, and the UK 5 day and 14 day clocks.

A dark home-office desk at night. A matte grey laptop shows a plugin list made only of shapes: five slate blue rows with empty pills and toggle switches, and one row outlined in amber with a blank amber button. A small round desk clock with tick marks and no numerals stands beside a plain mug. The left half is dark, with the headline and the stat 11 H 10 MIN drawn over it.

Market and Supply Chain19 Oct 2026

Rank Math says PRO downloads in an 11 hour 10 minute window carried malware; no count given as of 19 October

What Rank Math's notice, the CVE record and Patchstack's entry say about the PRO plugin incident, the intervals computed from them, what the notice leaves out, what a customer cannot check, the UK guidance and a ranked checklist. Defender level only.

A small charcoal four-bay network storage box with blank drive-bay doors and one tiny blue standby light stands on a worn oak shelf in a dark room, a coil of plain grey network cable beside it. The left half is empty dark blue, with the headline and a stat drawn over it: fixed 4 August, exploitation seen 17 October, 74 days, as of 19 October.

Threat Intel19 Oct 2026

Plex2Shell: a honeypot saw exploitation 1 day after the write-up and 74 days after Plex's fix

What Plex's release notes, the CVE records, CISA and the two researchers' pages establish about Plex2Shell as of 19 October: the dates to scale, four scores that miss the chain, the build that is actually fixed, what UK guidance requires, and a ranked checklist. Defender level only.

A dark control room wall carrying a grid of about twelve columns of blank, softly backlit frosted tiles under empty rounded heading pills, with one tile outlined in indigo and two neighbours dimmer. The grid sits on the right; the left is empty dark blue carrying the headline and the stat 6 of 9 drawn over it.

Threat Intel19 Oct 2026

MITRE ATT&CK v20 adds 9 Enterprise techniques; in v20 neither prompt injection one has a detection strategy

A computed diff of MITRE's version 19.2 and 20.0 STIX data: nine new Enterprise entries, six detection strategies, SecurityWeek's claims checked, the water and Mexico campaigns against their cited sources, how NCSC pages use ATT&CK, and a ranked checklist.

Page 9

Monday 19 October

A dark laboratory bench. A silver processor chip sits on a dark green circuit board under a clear glass dome, with a faint blue padlock-shaped glow inside the dome. The left half is empty dark navy, with the headline and a stat drawn over it: 1 OF 4.

AI Security19 Oct 2026

Opaque says its team is joining Anthropic and it is winding down; one of its four open projects is Microsoft's

What Opaque, SecurityWeek and Constellation Research each say about the Anthropic deal, who hosts and maintains the four named open projects, what each project says it does not do, what UK guidance says, and a ranked checklist for customers.

A matte white home broadband router stands on an oak shelf in a dark hallway, with four faint cyan rings of light around it and one softly lit indicator. The left half is empty dark navy, carrying the headline Broadcom Wi-Fi setup flaw, no CVE on 19 October, and the stat 90 days.

Threat Intel19 Oct 2026

Broadcom WPS flaw: no CVE on 19 October, 90 days after the report; Broadcom cites a 2018 replacement

What the researcher's write-up, slides and project page state about the Broadcom WPS flaw, what Broadcom and the CVE records do not, the dated 90 days, and what the UK's PSTI regime, Telecoms Security Code and Cyber Essentials require and do not. Defender level only.

A dark data-centre rack in cool blue light. A plain brushed-metal panel on the rack carries two blank, empty recessed plates and a small steel hook, from which a ring of six or seven plain metal keys in brass and steel hangs. The left half of the frame is empty dark blue, with the headline and a stat drawn over it: 1.4% of Console users, count not stated, as of 19 October.

Breaches and Incidents19 Oct 2026

As of 19 Oct, OpenCode says provider keys of 1.4% of Console users may be exposed; no count is stated

What OpenCode's X post, docs and status page state about the Console breach as of 19 October, what they leave out, the afternoon's timestamps with derived intervals, what the providers' pages say to do, the UK position, and a ranked checklist.

Compliance and Regulation19 Oct 2026

Meta's 30 October crawler clause exists in two texts; the UK edition contained 'train' on 19 October

The crawler clause word for word, how the UK and US-English texts differ, what Meta's other terms already allowed, what its robots.txt page does and does not promise, what UK law and ICO pages say, and a ranked checklist for 11 days.

A dark data-centre aisle at night. A long row of identical black server cabinets with perforated doors recedes along the right of the frame, each door carrying a blank rounded label well. One door near the front stands slightly ajar and cold blue light spills out across the polished floor. The left half is empty dark navy, with the headline and a stat drawn over it: 3 of 7.

Threat Intel19 Oct 2026

PwnEscape (CVE-2026-99999): fixed upstream in 7 kernel series; Red Hat, Ubuntu, SUSE listed no fix on 19 October

What the CVE record, the kernel changelogs and each distributor's own page say is fixed and where, why one flaw carries 9.3 and 8.8, what is and is not established about exposure and exploitation, the UK guidance as read, and a ranked checklist. Defender level only.

An ivory stack of blank share-certificate-style documents on a dark walnut desk beside a window in soft morning light. The top certificate has an engraved-style border, empty rounded panels, an empty round seal and a blank signature line. A plain black fountain pen and its cap lie beside the stack. The left half is dark and carries the headline and a stat drawn over it: up to 15% or 41%.

Compliance and Regulation19 Oct 2026

Anthropic's fund: 5% plus 2% per 50% rise reads as up to 15% or 41% at 10x, no baseline or owner stated

What Anthropic's 18 October post establishes about its Public Benefit Fund, the two readings of its escalator, what Delaware and IRS pages say about the forms involved, how it compares with OpenAI's Foundation and Anthropic's own Trust, what UK pages cover, and what to ask for.

Sunday 18 October

A row of tall matte black server racks in a dark data-centre aisle, receding to the right. Each tray face has a small blank glowing cyan pill, thick silver coolant pipework and braided hoses run beside the racks, and one coupling is amber. The left of the frame is empty dark blue, with the headline and a stat drawn over it: 2.4x the EU line.

AI Security18 Oct 2026

MAI-Base-2 is a lab note, not a release: 2.4x the EU's 10^25 FLOP line, and a 4 to 12x claim from a fit

What Microsoft AI's pre-training note establishes about MAI-Base-2: the compute arithmetic, what the 4 to 12x claim measures, the moving evaluation ruler, the EU line, what the UK says, and a ranked checklist if licensed weights arrive.

A dark data-centre aisle with a black rack-mount GPU server on a steel bench, its lid lifted off to show four finned heatsink blocks and a row of fan modules, the front panel of blank drive bays unmarked. The left half is empty dark teal with the headline drawn over it: the blog says 5x faster, the report says 1.9x to 2.3x, the NVFP4 weights need 75 GB.

AI Security18 Oct 2026

NVIDIA's '5x faster' Nemotron 3.5 Super VL is 1.9x to 2.3x in its own report; NVFP4 weights need 75 GB

What NVIDIA's launch post, report, model cards, licence and Artificial Analysis establish about Nemotron 3.5 Super VL and Bolt: who measured each speed, the memory to run them, what open means in this release, and a UK checklist.

A dark desk in cool blue light. A black contact-centre headset with a boom microphone lies in front of an open laptop whose screen shows only blank rounded pill shapes and a smooth abstract waveform, with an unmarked desk telephone behind. The left half is empty dark space with the headline and a stat drawn over it: 3.7 points.

AI Security18 Oct 2026

Grok Voice 3.0: 3.7 points ahead on one index, 0.2 on task success, 2.9 behind one rival on the agent test

What xAI's Grok Voice 3.0 post establishes against Artificial Analysis's and ServiceNow's pages: the margins drawn to scale, latency and cost on their own clocks, the alias that switched agents, and what UK ICO, Ofcom and DSIT pages say about a voice agent on a customer line.

A dark data-centre aisle with an open black GPU server on a steel bench, a row of eight finned graphite heatsinks inside it, a fan wall and two blank recessed plates on its front panel. The left half is empty dark navy, with the headline and a stat drawn over it: 293.6 GB, the smallest official copy.

AI Security18 Oct 2026

The Briefing

Tuesday 20 October

Google says a power event hit one London zone: 38 products listed, UK banks and courts report faults

Bullhorn says service is restored 62 to 63 hours after its cyber incident notice; exfiltration 'not yet determined'

NCSC's AI research chapter, 20 October 2026: 7 problems, 33 strands, and no UK code or guideline named

OVHcloud CLI: five releases swapped for up to 94 minutes on 19 October 2026, and the checksum list was swapped too

AOMEI Backupper's checksum was rewritten with the file in three confirmed 10, 6 and 5 minute windows, 28 May to 20 July

Siemens Software Center CVE-2026-110936: fix added 17 October, exploitation noted 19 October

Monday 19 October

DeepSeek V4.1 Flash 1017 is 510 GB under MIT: 16B active, 763B stored, as read on 19 October 2026

GhostAction stage two, 19 October 2026: 94 repositories, 66 owners, a "font" that is a script

Five NGINX flaws fixed 14 October: nginx.org says all medium, F5's CVSS 4.0 rates three critical

Rank Math says PRO downloads in an 11 hour 10 minute window carried malware; no count given as of 19 October

Plex2Shell: a honeypot saw exploitation 1 day after the write-up and 74 days after Plex's fix

MITRE ATT&CK v20 adds 9 Enterprise techniques; in v20 neither prompt injection one has a detection strategy

Monday 19 October

Opaque says its team is joining Anthropic and it is winding down; one of its four open projects is Microsoft's

Broadcom WPS flaw: no CVE on 19 October, 90 days after the report; Broadcom cites a 2018 replacement

As of 19 Oct, OpenCode says provider keys of 1.4% of Console users may be exposed; no count is stated

Meta's 30 October crawler clause exists in two texts; the UK edition contained 'train' on 19 October

PwnEscape (CVE-2026-99999): fixed upstream in 7 kernel series; Red Hat, Ubuntu, SUSE listed no fix on 19 October

Anthropic's fund: 5% plus 2% per 50% rise reads as up to 15% or 41% at 10x, no baseline or owner stated

Sunday 18 October

MAI-Base-2 is a lab note, not a release: 2.4x the EU's 10^25 FLOP line, and a 4 to 12x claim from a fit

NVIDIA's '5x faster' Nemotron 3.5 Super VL is 1.9x to 2.3x in its own report; NVFP4 weights need 75 GB

Grok Voice 3.0: 3.7 points ahead on one index, 0.2 on task success, 2.9 behind one rival on the agent test

Reflection's Beam is Apache 2.0 and needs 293.6 GB at 4-bit; its maker says fine-tuning can remove the safety training

Muse Spark Open: 533 GB at 4-bit, about 50 GB read per token, and what Meta's launch leaves unstated

NUH has dismissed 15 staff over Nottingham victims' records; its monitoring system is still in testing