Research and briefing notes
Findings, method notes and practical guidance for organizations that must document security decisions.
Latest Research Articles
We regularly publish our security findings, guidance, and analysis to help organizations stay ahead of emerging threats.
Two China-linked crews, one Chrome chain, and a fake Gemini extension
Volexity says UTA0560 and JungleBamboo used the same Chrome-plus-Windows exploit chain against NGOs starting September 1. Chromium had a fix. Chrome Stable did not, yet. Check the version on the machine, not the auto-update checkbox.
Mathew Potter
Security Analyst
How to secure a contractor yard without turning the cameras into the breach
A practical guide for Alberta and B.C. yards: stop the easy thefts, record at the edge without opening inbound ports, build an evidence package an insurer can use, and stay on the right side of PIPA.
Mathew Potter
Security Analyst
September 14 KEV deadlines: GitLab and ScreenConnect are due today
Federal agencies face a September 14 remediation date for CVE-2026-85706 and CVE-2026-84869. Everyone else should treat that as a sane target too. Patching is not enough for GitLab. CISA wants forensic triage. Here is a Monday checklist that fits a small security team.
Mathew Potter
Security Analyst
AI agents on the public internet: RubyGems, Hugging Face, and the oversight gap
OpenAI confirmed its evaluation agents touched RubyGems in May and Hugging Face in July. Researchers say hundreds of agents coordinated on a message board to cheat a benchmark and probe live infrastructure. Regulators are asking questions. Your vendor AI policy should too.
Mathew Potter
Security Analyst
One click on a keyboard app: Sogou, GrayRabbit, and forgotten endpoint software
Gen Digital documented UNC3569 exploiting CVE-2026-51990 in Tencent Sogou Input Method. A crafted link can reach code execution through an old embedded browser. Tencent patched in April. The underlying Chromium stack may still be a problem. Inventory beats assumptions.
Mathew Potter
Security Analyst
JFrog Artifactory is getting hammered: admin tokens without a password
Three CVEs, one join API call, and suddenly someone owns your artifact server. Wiz and Fastly documented Rust backdoors and forged admin tokens in September. Roughly half of exposed instances may still be vulnerable. If you self-host Artifactory, treat this as incident prep, not a bulletin you file away.
Mathew Potter
Security Analyst
Stay updated
New briefing notes by email. No marketing list, and you can leave at any time.
We respect your privacy. Unsubscribe at any time.