Research and briefing notes
Findings, method notes and practical guidance for organizations that must document security decisions.
Latest Research Articles
We regularly publish our security findings, guidance, and analysis to help organizations stay ahead of emerging threats.
Three Linux kernel bugs are on KEV, and Sunday is the federal clock
CISA listed CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 as exploited. Red Hat refreshed the advisories Saturday. Federal due date is September 21. The reboot is the work.
Mathew Potter
Security Analyst
The licence scans were sitting at a vendor most people never named
Nexus advertised 153 million US and Canadian licence scans. Krebs traced them to IDScan.net. The company said its cloud may have been copied. RCMP is monitoring. The processor is the story.
Mathew Potter
Security Analyst
Check Point management: another unauthenticated root path, confirm the LivePatch
CVE-2026-91843 is a 9.8 stack overflow in the login path on Security Management and Log Servers. No known use yet. Fifth critical unauthenticated management bug since July. Trusted Clients still matters.
Mathew Potter
Security Analyst
Rapuncel: the GitHub download was a signed driver, and the signature was not the last word
LastPass and Delphos Labs say fake GitHub repos drop an infostealer and a Microsoft-signed kernel driver that kills 145 EDR names. Saturday is still ISE, Acronis, and Pixel. Sunday is the kernel.
Mathew Potter
Security Analyst
The 9.8 hiding in the workflow engine: Conductor is being hit and most teams do not know they run it
CVE-2026-58138 is unauthenticated code execution in Orkes Conductor. Fortinet is blocking thousands of tries. The complete fix is 3.30.2. The community API ships with no login. Find the UI before you trust the scanner.
Mathew Potter
Security Analyst
MovieReaper: the torrent is not the movie, and the next hop is on Solana
Kaspersky says a shared torrent archive was swapped so popular films, including The Odyssey, deliver a Windows loader. Later stages look up command servers on the Solana chain. Home PCs with a VPN still count.
Mathew Potter
Security Analyst
Stay updated
New briefing notes by email. No marketing list, and you can leave at any time.
We respect your privacy. Unsubscribe at any time.