London's first robotaxi is now real — but a driver is still legally in charge of it.
On 2 September, Uber and Wayve began carrying fee-paying passengers in London, the headline moment this fortnight.
Six sectors, covered end to end.
Two pages each, no filler — what actually moved in aviation cyber, UK construction cyber and compliance, counter-UAS, autonomous vehicles, cloud and AI platform change, and international affairs, and what it means for the people who have to act on it.
On 2 September, Uber and Wayve began carrying fee-paying passengers in London, the headline moment this fortnight.
CISA's 2 September update included the first AI-infrastructure flaw it has ever listed as exploited: an authentication bypass in LiteLLM's MCP gateway, chained with a second bug to steal…
Cisco confirmed CVE-2026-20079, a CVSS 10 authentication bypass in Secure Firewall Management Center, is being exploited by both a Sandworm-linked implant and Qilin ransomware affiliates.
Manchester Airports Group's backend booking platform gave up 8.7 million customer records across three airports; the data was published on 2 September after MAG refused to pay.
Interior Minister Dobrindt named Russia on 1 September for the 4-5 August drone at Leipzig/Halle, the same day a second incursion crossed into Estonia.
Germany's 1 September attribution and the EU-NATO pledge to escalate landed days before Steve Witkoff and Jared Kushner met Putin in Moscow, then Zelensky in Kyiv.
An indefinite Groundforce strike at Barcelona and a parallel Swissport dispute at Palma put roughly two million seats at risk and spilled into Heathrow, Schiphol and Frankfurt on 11 August.
Waymo named Munich its first EU robotaxi city this fortnight and registered entities in Spain, France, the Netherlands and Switzerland.
VMware's vCenter flaw went from patch to 361 compromised servers in nine days; Microsoft's SharePoint bypass was exploited hours after a public proof-of-concept.
CISA added CVE-2026-55040 on 18 August: an unauthenticated attacker can forge a valid token against on-premises SharePoint, bypassing login entirely.
VMware vCenter, SharePoint and Windows IKE were each added to the exploited-vulnerability catalogue on 18 August, vCenter alone compromised at 361 organisations within five days of its fix.
Two Eurofighters and two F-16s scrambled after the drone crossed into Latvia; an Italian jet destroyed it near Balvi.
Latvia downed a drone on 14 August; Italy's Colleferro shell plant burned on 13 August, sabotage unconfirmed.
These briefings are the thought leadership end of what we do. Beyond them sits guidance on what to prioritise, and the teams to make your remediation plans actually happen.
Get in touch