Akari's Thursday briefing: the Zyxel GS1900 zero-day behind 996 compromised switches, Sekoia's APT29 mobile watering-hole campaign and the Apple flaw CISA just listed, a root flaw in Debian and Ubuntu's APT package manager, and DigiCert's archived-data breach.
The Amadeus reservation breach widens to Singapore Airlines (about 46,000 booking records), CISA lists the WordPress upgrade-window flaw CVE-2026-119977 as exploited with a November 6 deadline, NSW Health's dental scheme breach is declared a major incident, and University Hospitals is still restoring systems.
Arara Message breach grows to about 77 million email addresses across up to 380 companies, and the service itself was used to send 7.13 million phishing emails; Synology warns of C3RB3R ransomware on unpatched NAS devices; Sega's arcade networks remain offline and Suntory discloses a cloud breach affecting around 100,000 people.
Binance reopened after the record theft and saw billions in net outflows, the Ivanti Connect Secure zero-day chain hits its federal deadline today, and a public Android SMS of Death exploit leaves Android 12 and 13 phones with no fix.
GitLab CVSS 10 flaw in CISA KEV where upgrading GitLab alone does not fix own-Ruby installs, actively exploited Drupal Commerce bypass, PeopleSoft's one CVE hiding three chained flaws, plus Cisco KEV and TeamViewer updates.
Akari's first edition: ICHI's new offense-versus-defense scoring methodology, the PHP2Shell patching deadline, the Keystone breach, and the widening threat-defense gap.
Week in review: the control plane was the target — FBI attributes the B+ Binance theft to North Korea, Chainalysis discloses an agentic intrusion, KeyDrift steals SD-WAN keys, and GitLab, Cisco and Ivanti face KEV deadlines.
Akari's week-in-review for the week ending October 25, 2026, updated Monday morning: Black October — the critical PHP flaws, AI agents doing the attacking, the LiteLLM supply-chain compromise, new CISA exploited vulnerabilities, the Denmark breach — plus today's patch deadline, PHP2Shell's wider spread, the Tailscale Tailworm flaw, Cloudflare's Brotli rules, and AI news from OpenAI, Moonshot, and Anthropic.
Akari's Thursday briefing: the Zyxel GS1900 zero-day behind 996 compromised switches, Sekoia's APT29 mobile watering-hole campaign and the Apple flaw CISA just listed, a root flaw in Debian and Ubuntu's APT package manager, and DigiCert's archived-data breach.
ICHI Daily: one email on weekdays, after each new daily episode is published (no episode, no email).
ICHI Weekly: one email on Sundays after 9 p.m. US Eastern time, once the new edition is published. If you choose both the weekly podcast and the written brief, they arrive together in that one email.
No new episode, no email. Every email links to the episode on ICHI; audio is never attached.
ICHI Daily and ICHI Weekly are editorial commentary on ICHI’s evidence. They never change the VECTORS score, incident evidence classifications or intelligence rankings.