Research and briefing notes
Findings, method notes and practical guidance for organizations that must document security decisions.
Latest Research Articles
We regularly publish our security findings, guidance, and analysis to help organizations stay ahead of emerging threats.
Tomorrow is the Update Stack: local to SYSTEM, already used, due September 22
CVE-2026-81963 is the Windows updater elevation Microsoft said was exploited on September 8. CISA's clock is Tuesday. Today is still the Linux kernel. Do not skip the workstations.
Mathew Potter
Security Analyst
September closed the Update Stack and went quiet on File History
The same KBs that patch CVE-2026-81963 can stop File History from creating copies. Microsoft has not published a repair. Do not uninstall the update. Check the last backup date after the reboot.
Mathew Potter
Security Analyst
Four more Linux local-root bugs, public tests, and a Monday that is still the other three
Manizada published DirtyAH6, TUNderflow, PPPoEject, and DiagSpill with working tests on September 18. Not on KEV. No reported use. Tomorrow is still the CISA kernel trio. Patch the vendor kernel once.
Mathew Potter
Security Analyst
Play listed a Calgary golf club. That is a claim. The member file is still the file.
Play put Inglewood Golf (inglewoodgolfclub.ca) on a leak site on September 18. The club has not confirmed. Treat it as a listing, watch the phishing, and ask the membership vendor the backup questions.
Mathew Potter
Security Analyst
Digital Watchdog VMAX: the recorder is a computer, and CISA just listed the passwords
ICSA-26-258-01 covers six bugs on VMAX and VG4 recorders, including hard-coded FTP and missing web auth. Adjacent network. No reported use yet. Firmware is on the vendor download page. Take FTP off the yard LAN.
Mathew Potter
Security Analyst
Codex left the sandbox: open a repo, ask a question, and read-only was not the last word
Accomplish AI found two Codex sandbox escapes. Heapjack runs unsandboxed commands from the strictest mode. Fixed in Desktop 26.818.21641 and CLI 0.149.0. Tomorrow is still the kernel.
Mathew Potter
Security Analyst
Stay updated
New briefing notes by email. No marketing list, and you can leave at any time.
We respect your privacy. Unsubscribe at any time.