The Record
Cybersecurity: Threats and Defences
What we told you to watch, what each side claimed, and what we got wrong. Every verdict shows its evidence.
Open 60 · Corrections 120
What we told you to watch
Still open · 60
Show the 10 most recentWhether the UK Cyber Resilience Pledge attracts signatories before its summer launch, or stays voluntary theatre.
From the 29 May briefing
Whether MuddyWater's Langflow access produces a named downstream breach before the 4 June KEV deadline.
From the 29 May briefing · Deadline: 4 June
Whether **Microsoft** ships an out-of-band patch for Exchange CVE-2026-42897 before CISA's 29 May federal deadline, and whether CISA acknowledges in writing that the deadline preceded the patch.
From the 20 May briefing · Deadline: 29 May
Whether **RansomHouse** publishes the full Trellix source-code dump, and whether **Cisco** confirms the scope of the 300+ stolen repositories beyond the named AI Defense and AI Assistant projects.
From the 20 May briefing
Whether **GTIG** or partner Computer Emergency Response Teams name additional AI-infrastructure CVEs in the LiteLLM, BerriAI, or vector-store stack within the next reporting window.
From the 20 May briefing
Whether the **ICO** opens further enforcement against UK water companies on the South Staffordshire template, or whether the Cyber Security and Resilience Bill reaches the Lords before the next enforcement action lands.
From the 20 May briefing
Will **Palo Alto Networks** ship the **PAN-OS** patch on 13 May, or does the gap widen, and does **CISA** issue a follow-up **KEV** note acknowledging the deadline-before-patch precedent.
From the 8 May briefing · Deadline: 13 May
RansomHouse: publishes **Trellix** source code, or quiet extortion, and whether peers cite the 21-day delay during the **CS&R Bill** Second Reading in the Lords.
From the 8 May briefing
Whether the **'Sorry'** ransomware crew or another ransomware-as-a-service operation scales the **cPanel** **CRLF** flaw beyond opportunistic encryption into bulk credential harvesting against the 1.5 million exposed hosts.
From the 8 May briefing
Whether **GTIG** or partner CERTs name additional npm packages compromised by **UNC1069** beyond **Axios**, given the maintainer-targeting tradecraft suggests a broader operation.
From the 8 May briefing
Whether **Shadowserver** or **Censys** publishes ASA/FTD anomaly counts that would put a number on FIRESTARTER mass-exploitation beyond the unnamed federal agency.
From the 30 Apr briefing
**Cisco** customer guidance on hardening, advisory updates and whether the vendor moves to a planned-outage eviction template.
From the 30 Apr briefing
**PRA** and **MoD** clearance review timelines for the **Airbus**/**Ultra Cyber** acquisition, and whether **Financial Conduct Authority (FCA)** or **PRA** sign-offs delay the **Beazley/Zurich** integration.
From the 30 Apr briefing
Whether the next emergency Cisco CVE shrinks the **CISA KEV** federal deadline below the 23 April three-day mark.
From the 30 Apr briefing · Deadline: 23 April
**Stokes** extradition timeline from Helsinki to Chicago, and downstream **Scattered Spider** charges off the same indictment.
From the 30 Apr briefing
**CitrixBleed 3** (CVE-2026-3055) escalating from active reconnaissance to mass exploitation within 30 days, repeating the CitrixBleed 2023 arc that landed LockBit and state groups inside enterprise SAML brokers.
From the 17 Apr briefing · Deadline: within 30 days
**OFAC** secondary PAIPA designations against other exploit brokers now that the first action has set the legal template, and whether Gulf-based shell vehicles are explicitly named in any follow-on tranche.
From the 17 Apr briefing
The **$707m CISA cut** surviving Congressional markup through the FY27 appropriations process, or whether hearings and committee amendments restore some of the counter-ransomware and election-security programmes.
From the 17 Apr briefing
Whether the **UK Cyber Security and Resilience Bill** returns from the House of Lords with material amendments to the **24-hour incident reporting** window, and whether the Lords push back on data-centre classification as essential services.
From the 17 Apr briefing
Whether additional **MDM-level, identity-only wipes** follow the Handala playbook against other multinationals, and whether Microsoft tightens Intune's default Conditional Access and break-glass posture in response.
From the 17 Apr briefing
What each side claimed
Claims are what a named side said at the time. We record them as said and judge them only against later evidence.
No claims recorded yet.
What we got wrong
- MinorCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- MinorCorrected 12 Oct 2026We said
CVE-2021-22893 got a 21-day remediation window on CISA's predecessor watchlist
What was trueCISA Emergency Directive 21-03 (20 April 2021) required federal agencies to act by 23 April 2021; KEV did not exist until November 2021
- SignificantCorrected 12 Oct 2026We said
Integrity Technology Group operates the KV Botnet
What was trueThe KV Botnet is Volt Typhoon's
- MinorCorrected 12 Oct 2026We said
OFAC sanctioned Integrity Technology Group in December 2025
What was trueOFAC designated it on 3 January 2025 (Treasury jy2769); the UK listed it on 9 December 2025
- SignificantCorrected 12 Oct 2026We said
Integrity Technology Group operates the KV Botnet
What was trueThe KV Botnet is Volt Typhoon's
- SignificantCorrected 12 Oct 2026We said
Flax Typhoon and Integrity Technology Group operate the KV Botnet
What was trueThe KV Botnet is attributed to Volt Typhoon; Integrity Technology Group is tied to Raptor Train (FBI advisory 18 Sept 2024)
- MinorCorrected 12 Oct 2026We said
CISA added CVE-2025-53521 to KEV on 28 March, the day of reclassification
What was trueCISA added it to KEV on 27 March 2026 per the KEV catalogue
- MinorCorrected 12 Oct 2026We said
CISA added CVE-2025-53521 to KEV on 28 March
What was trueCISA added CVE-2025-53521 to KEV on 27 March 2026 (KEV dateAdded 2026-03-27)
- MinorCorrected 12 Oct 2026We said
CISA added CVE-2026-3055 to KEV on 28 March
What was trueAdded 30 March 2026 per the KEV catalogue
- MinorCorrected 12 Oct 2026We said
CISA added CVE-2026-3055 to KEV on 28 March
What was trueAdded 30 March 2026 per the KEV catalogue
- MinorCorrected 12 Oct 2026We said
CISA added CVE-2026-3055 to KEV on 28 March
What was trueCISA added CVE-2026-3055 to KEV on 30 March 2026 (KEV catalogue v2026.10.08, dateAdded 2026-03-30)
- MinorCorrected 12 Oct 2026We said
Bolded the acronym NPA
What was trueThe entity link belongs on the full name; the bare acronym collides with other agencies
- MinorCorrected 12 Oct 2026We said
Bolded the acronym NPA
What was trueThe entity link belongs on the full name; the bare acronym collides with other agencies
- MinorCorrected 12 Oct 2026We said
The August KEV counts (37 additions, 24 three-day deadlines) were read from the cisagov/kev-data GitHub mirror, presented as CISA data one hop from source.
What was trueThat count was wrong against every source. CISA's official KEV feed v2026.10.08 shows 38 additions and 27 three-day deadlines; the mirror at v2026.09.02 itself held 38 additions.
- MinorCorrected 12 Oct 2026We said
The August KEV counts (37 additions, 24 three-day deadlines) were read from the cisagov/kev-data GitHub mirror, presented as CISA data one hop from source.
What was trueThat count was wrong against every source. CISA's official KEV feed v2026.10.08 shows 38 additions and 27 three-day deadlines; the mirror at v2026.09.02 itself held 38 additions.
- MinorCorrected 12 Oct 2026We said
The August KEV counts (37 additions, 24 three-day deadlines) were read from the cisagov/kev-data GitHub mirror, presented as CISA data one hop from source.
What was trueThat count was wrong against every source. CISA's official KEV feed v2026.10.08 shows 38 additions and 27 three-day deadlines; the mirror at v2026.09.02 itself held 38 additions.
- MinorCorrected 12 Oct 2026We said
The August KEV counts (37 additions, 24 three-day deadlines) were read from the cisagov/kev-data GitHub mirror, presented as CISA data one hop from source.
What was trueThat count was wrong against every source. CISA's official KEV feed v2026.10.08 shows 38 additions and 27 three-day deadlines; the mirror at v2026.09.02 itself held 38 additions.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
The August KEV counts (37 additions, 24 three-day deadlines) were read from the cisagov/kev-data GitHub mirror, presented as CISA data one hop from source.
What was trueThat count was wrong against every source. CISA's official KEV feed v2026.10.08 shows 38 additions and 27 three-day deadlines; the mirror at v2026.09.02 itself held 38 additions.