Five things that moved in GRC. Every Monday.

21

26 October 2026

Edition 21

A special edition. Instead of five stories, the week already triaged: what is exploited, what is exposed, what it touches, and what that means for when you act.

A special edition. Instead of five stories, the week already triaged: what is exploited, what is exposed, what it touches, and what that means for when you act.

20

19 October 2026

Edition 20

700 French supermarkets defrosted through a hole documented in 2023, LG TVs rooted by a test certificate, cheap Androids shipping infected, implants in Ledger wallets, and a bug behind an OpenAI TV.

700 French supermarkets defrosted through a hole documented in 2023, LG TVs rooted by a test certificate, cheap Androids shipping infected, implants in Ledger wallets, and a bug behind an OpenAI TV.

19

12 October 2026

Edition 19

A formula for when a model tips, OpenAI's agents at 100 organisations, 8.8 million Danes exposed through a partner's lawful access, two hours from exploit code to attack, and PwC counts who acts.

A formula for when a model tips, OpenAI's agents at 100 organisations, 8.8 million Danes exposed through a partner's lawful access, two hours from exploit code to attack, and PwC counts who acts.

18

5 October 2026

Edition 18

The industry turns on the word rogue, humans grade Copilot uploads without flagging harm, SWIFT's auth extension trusted any website, Free Mobile's old breach pays better than ever.

The industry turns on the word rogue, humans grade Copilot uploads without flagging harm, SWIFT's auth extension trusted any website, Free Mobile's old breach pays better than ever.

17

28 September 2026

Edition 17

Bitget's signing process authorised a forgery, Salesforce said blocked after the data left, a rogue MFA provider survives your reset, Google can't prove compliance, and ISO 9001 audits culture.

Bitget's signing process authorised a forgery, Salesforce said blocked after the data left, a rogue MFA provider survives your reset, Google can't prove compliance, and ISO 9001 audits culture.

16

21 September 2026

Edition 16

A third swarm surfaces, Anthropic's CEO asks for the brake, an expired CDN domain still runs on thousands of sites, your Windows estate ages out, and CISA says lie to attackers.

A third swarm surfaces, Anthropic's CEO asks for the brake, an expired CDN domain still runs on thousands of sites, your Windows estate ages out, and CISA says lie to attackers.

15

14 September 2026

Edition 15

The US accuses China of industrial-scale AI theft, researchers show the anti-theft locks don't hold, your LG TV is a standby wiretap, and the FBI and NSA agree AI can't outrun the basics.

The US accuses China of industrial-scale AI theft, researchers show the anti-theft locks don't hold, your LG TV is a standby wiretap, and the FBI and NSA agree AI can't outrun the basics.

14

7 September 2026

Edition 14

Your AI chats are courtroom evidence, the EU calls ChatGPT a search engine, attackers poison AI memories, a private hospital pays 500k (a public one wouldn't), and why cyber isn't a campaign issue.

Your AI chats are courtroom evidence, the EU calls ChatGPT a search engine, attackers poison AI memories, a private hospital pays 500k (a public one wouldn't), and why cyber isn't a campaign issue.

13

31 August 2026

Edition 13

100 tech giants warn about rogue AI (and sell the cure), a researcher owns his desk with Claude, 1,200 unofficial AI apps per company, quantum is already harvesting your crypto, and the vendor trap.

100 tech giants warn about rogue AI (and sell the cure), a researcher owns his desk with Claude, 1,200 unofficial AI apps per company, quantum is already harvesting your crypto, and the vendor trap.

12

24 August 2026

Edition 12

A mainstream writer says AI's hacking skill is doubling every few months, and right on cue: password spraying up 155x, a passkey that survives your reset, a zombie Visa card, and 'shady AI.'

A mainstream writer says AI's hacking skill is doubling every few months, and right on cue: password spraying up 155x, a passkey that survives your reset, a zombie Visa card, and 'shady AI.'

11

17 August 2026

Edition 11

The US lets private firms go on the cyber-offensive, defenders weaponise prompt injection, Trezor's breach wasn't Trezor's, Belgium's top-trust eID was Swiss cheese, and a tool to map ad-tech.

The US lets private firms go on the cyber-offensive, defenders weaponise prompt injection, Trezor's breach wasn't Trezor's, Belgium's top-trust eID was Swiss cheese, and a tool to map ad-tech.

10

10 August 2026

Edition 10

AI agents secretly teamed up to hack their way out of a test, Europe folds frontier AI into DORA, a worm poisons 440 npm packages, and NIS2 goes live in two more countries.

AI agents secretly teamed up to hack their way out of a test, Europe folds frontier AI into DORA, a worm poisons 440 npm packages, and NIS2 goes live in two more countries.

09

3 August 2026

Edition 09

The Hugging Face autopsy lands (17,600 tries, all mundane bugs), the EU makes 'anonymous' contextual, ISO 27000 slims down, CISA rebuilds the SBOM, and I am launching GRCBOARD.IO.

The Hugging Face autopsy lands (17,600 tries, all mundane bugs), the EU makes 'anonymous' contextual, ISO 27000 slims down, CISA rebuilds the SBOM, and I am launching GRCBOARD.IO.

08

27 July 2026

Edition 08

An AI escapes its sandbox and hacks Hugging Face, Suno hides a 55M breach for eight months, WordPress falls in a day, Google shrugs off a billion, and Meta patents your feelings.

An AI escapes its sandbox and hacks Hugging Face, Suno hides a 55M breach for eight months, WordPress falls in a day, Google shrugs off a billion, and Meta patents your feelings.

07

20 July 2026

Edition 07

622 fixes in a single day, the Pentagon pausing its own cyber certification, Brussels planning for capacity it doesn't have, and Lidl's data walking out of a building Lidl doesn't own.

622 fixes in a single day, the Pentagon pausing its own cyber certification, Brussels planning for capacity it doesn't have, and Lidl's data walking out of a building Lidl doesn't own.

06

13 July 2026

Edition 06

Chat Control back on a procedural trick, four governments in court over NIS2, 281 leaking free VPNs, Meta taking your face by default, and an OS that watches unless you stop it.

Chat Control back on a procedural trick, four governments in court over NIS2, 281 leaking free VPNs, Meta taking your face by default, and an OS that watches unless you stop it.

05

6 July 2026

Edition 05

A 1,200-person survey proves an old point, Fable 5 returns with strings, quantum stops being a someday problem, ChatGPT's guardrails fall, and Meta guts a privacy control.

A 1,200-person survey proves an old point, Fable 5 returns with strings, quantum stops being a someday problem, ChatGPT's guardrails fall, and Meta guts a privacy control.

04

29 June 2026

Edition 04

A North Korean Mac backdoor, a 10M-install browser risk, a CISO ethics reckoning, and the AI license Washington just revoked.

A North Korean Mac backdoor, a 10M-install browser risk, a CISO ethics reckoning, and the AI license Washington just revoked.

03

22 June 2026

Edition 03

A Checkmarx report, 86,000 Fortinet logins, a forgotten GitHub token, and a mailbox that cost 176,000 euros.

A Checkmarx report, 86,000 Fortinet logins, a forgotten GitHub token, and a mailbox that cost 176,000 euros.

02

14 June 2026

Edition 02

Five things that moved in governance, risk & compliance this week. My honest take on each. No press-release recaps.

5 short insights this week: A record $409M privacy fine, and not a hacker in sight · A 9.8 zero-day in PeopleSoft, no login required · npm is finally turning off the feature that kept getting you hacked…

01

8 June 2026

Edition 01

Five things that moved in governance, risk & compliance this week. My honest take on each. No press-release recaps.

5 short insights this week: The EU just took seven governments to court over resilience · DORA just stopped being paperwork · Hackers didn't breach Instagram. They asked the bot nicely.…