2026-W39 · Cold case

THE WEDNESDAY DEBRIEF

Security week of September 21 to 27, 2026

Seven real incidents from this week: a URL-encoding trick that made WAF coverage worthless overnight, compromised GitHub Actions that reactivated without anyone pushing new code, and AI agents quietly pillaging government portals for months. Each one translates directly to money, downtime, or regulatory exposure. No signup, about three minutes, first attempt counts. These questions were generated by AI from the week’s reported security incidents and checked against their original sources.

5 cases · about 3 minutes · no signup