Research and briefing notes
Findings, method notes and practical guidance for organizations that must document security decisions.
Latest Research Articles
We regularly publish our security findings, guidance, and analysis to help organizations stay ahead of emerging threats.
CHOSEN BRICK is aimed at people, not at your ERP
UK, US, and Dutch agencies described Iranian Windows spyware used against dissidents, activists, and journalists. Rapport on Telegram, then an installer. Leak sites come after. If you hold those clients' files, this is in scope.
Mathew Potter
Security Analyst
Plugin4Shell: the AI coding agent pinned a hash, and the hash was not the last word
Air Security says four AI coding agents could install swapped plugin code even after a pin. Claude Code and Codex have builds. Copilot does not. No CVE yet. Saturday is still ISE, Acronis, and Pixel.
Mathew Potter
Security Analyst
Cisco ISE is a perfect 10 this week, and it is already being used
CVE-2026-76460 is an unauthenticated API bypass on Identity Services Engine. Cisco says it can become root. CISA listed it the day the advisory shipped. Thursday is also the Secure Email Gateway deadline.
Mathew Potter
Security Analyst
The other new KEV is a backup plugin. That should bother you.
CVE-2026-87886 is a Linux privilege escalation in Acronis Backup for cPanel and Plesk. Targeted attacks against the cPanel plugin. If the backup add-on is the hole, the last copy is not a last copy.
Mathew Potter
Security Analyst
Nipigon hospital is on paper procedures. That is what a restore test is for.
Nipigon District Memorial Hospital confirmed ransomware this week. Lab and imaging are closed. Some files that may hold health information were encrypted. A 37-bed site still has to run emergency.
Mathew Potter
Security Analyst
While everyone patches Cisco, Unbound shipped a 9.1 in the resolver you forgot you run
Thursday's headlines are ISE, an email-gateway deadline, an Acronis backup plugin, and a hospital on paper. The quiet one is CVE-2026-81642: a DNSSEC heap overflow in Unbound through 1.26.0. Upgrade to 1.26.1.
Mathew Potter
Security Analyst
Stay updated
New briefing notes by email. No marketing list, and you can leave at any time.
We respect your privacy. Unsubscribe at any time.