Research and briefing notes
Findings, method notes and practical guidance for organizations that must document security decisions.
Latest Research Articles
We regularly publish our security findings, guidance, and analysis to help organizations stay ahead of emerging threats.
CISA just listed a Pixel modem bug. Check the date on the phone, not the MDM checkbox.
CVE-2026-58704 is a high-severity privilege bypass in the Pixel cellular modem. Google says there are signs of limited, targeted use. CISA added it to KEV today with a September 19 deadline.
Mathew Potter
Security Analyst
Starlette's Host-header trick is due today. FastAPI version is the wrong number.
CVE-2026-48710 lets a malformed Host header make request.url.path lie while the router still hits the real path. CISA's KEV deadline is September 16. Check starlette in the lockfile.
Mathew Potter
Security Analyst
Leak sites are advertising key maps now, not just file servers
ShadowByt3$ claimed a property key-control haul on September 15. Storm, Settra, and Krybit also listed Canadian names this month. Treat listings as claims. Treat door schedules as crown jewels.
Mathew Potter
Security Analyst
Someone pulled a Flock camera off a pole. The encryption key was on the camera.
WIRED and 404 Media analyzed a dumped Flock ALPR on September 16. On-device encryption kept its key on the device. About 1.6 million images over 21 days. The lesson for yards is older than Flock: lock the recorder and do not store the key next to the footage.
Mathew Potter
Security Analyst
Cisco email gateways under fire: a crafted message can become root
Cisco confirmed active exploitation of CVE-2026-76461, a CVSS 9.8 SQL injection in Secure Email Gateway parsing. No login required. No workaround. CISA wants federal systems patched by September 17. If you run AsyncOS on-prem, this is an emergency change window.
Mathew Potter
Security Analyst
CISA says ransomware gangs are now using the vCenter bug patched in July
CVE-2026-59310 is a 9.8 in the vCenter Syslog server. Broadcom shipped a fix on July 29. Espionage crews used it first. CISA now says ransomware operators have piled on. If your management plane is still unpatched, this is no longer a wait-and-see item.
Mathew Potter
Security Analyst
Stay updated
New briefing notes by email. No marketing list, and you can leave at any time.
We respect your privacy. Unsubscribe at any time.