The Record
Cybersecurity: Threats and Defences
What we told you to watch, what each side claimed, and what we got wrong. Every verdict shows its evidence.
Open 60 · Corrections 120
What we told you to watch
Still open · 60
Show the 10 most recentWhether River Financial resolves the materiality and personal-data question in a further 8-K amendment, or lets the loop stay open.
From the 14 Jul briefing
A second slow KEV fortnight running, which would push the exploitation-lull-versus-triage question toward the triage reading.
From the 14 Jul briefing
Whether River Financial files its scope-amendment 8-K within four business days, resolving the PII-exfiltration question.
From the 4 Jul briefing
Whether the FortiBleed set surfaces as a public dark-web dump or drives a named Lynx deployment at one of the exposed blue-chips.
From the 4 Jul briefing
Whether CISA names any agency non-compliant on the SharePoint or SimpleHelp deadlines, the first enforcement test of the triage model.
From the 4 Jul briefing
Whether Microsoft patches RoguePlanet (CVE-2026-50656) or the Chaotic Eclipse series adds a sixth confirmed zero-day.
From the 4 Jul briefing
Whether CISA issues guidance or a follow-up directive for the case BOD 26-04 still omits, a vendor that formally declines to patch a KEV-listed flaw.
From the 24 Jun briefing
Whether any federal Splunk or Ubiquiti instance missed the 3-day deadlines, and whether CISA names non-compliance under the new risk model.
From the 24 Jun briefing
Whether the FortiBleed dataset moves from private holding to a dark-web dump, the signal that profiling has turned to exploitation.
From the 24 Jun briefing
Whether Microsoft credits or patches any Nightmare Eclipse flaw, and whether the Chaotic Eclipse series adds a sixth confirmed zero-day.
From the 24 Jun briefing
Whether the Lords reinstate any ransomware-payment ban or reporting duty stripped from the bill before it left the Commons.
From the 14 Jun briefing
Whether federal Arista customers can clear the 23 June KEV deadline through access-control lists alone, given no patch is coming.
From the 14 Jun briefing · Deadline: 23 June
Whether Qilin or other affiliates scale the Check Point VPN flaw beyond the few dozen organisations hit before the hotfix.
From the 14 Jun briefing
Whether CISA issues guidance for KEV entries where the vendor formally declines to patch, closing the BOD 22-01 gap Arista exposed.
From the 14 Jun briefing
Whether the UK Cyber Security and Resilience Bill clears the Commons on 10 June and which penalty tier survives Third Reading.
From the 7 Jun briefing · Deadline: 10 June
Whether WebLogic exploitation reaches a named critical-infrastructure victim before the 22 June federal deadline.
From the 7 Jun briefing · Deadline: 22 June
Whether Leonardo completes the Becrypt acquisition inside Q2, moving a UK Top Secret crypto supplier to Italian ownership.
From the 7 Jun briefing
Whether June Patch Tuesday on 9 June ships any actively exploited zero-days after May broke a 22-month streak with none.
From the 7 Jun briefing · Deadline: 9 June
Whether GitHub's post-incident review forces publisher-verification changes on the Visual Studio Code Marketplace.
From the 29 May briefing
Whether any of UNC6780's stolen Cisco AI Defense or GitHub repositories surface as working exploits.
From the 29 May briefing
What each side claimed
Claims are what a named side said at the time. We record them as said and judge them only against later evidence.
No claims recorded yet.
What we got wrong
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
The August KEV counts (37 additions, 24 three-day deadlines) were read from the cisagov/kev-data GitHub mirror, presented as CISA data one hop from source.
What was trueThat count was wrong against every source. CISA's official KEV feed v2026.10.08 shows 38 additions and 27 three-day deadlines; the mirror at v2026.09.02 itself held 38 additions.
- MinorCorrected 12 Oct 2026We said
A third of the August additions carried a deadline slower than three days.
What was true11 of 38, nearly three in ten, carried a slower deadline.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
The three-day KEV deadline applies under Binding Operational Directive 22-01.
What was trueBOD 22-01 was revoked on 10 June 2026; the August deadlines were set under BOD 26-04.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
The August KEV counts (37 additions, 24 three-day deadlines) were read from the cisagov/kev-data GitHub mirror, presented as CISA data one hop from source.
What was trueThat count was wrong against every source. CISA's official KEV feed v2026.10.08 shows 38 additions and 27 three-day deadlines; the mirror at v2026.09.02 itself held 38 additions.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
The August KEV counts (37 additions, 24 three-day deadlines) were read from the cisagov/kev-data GitHub mirror, presented as CISA data one hop from source.
What was trueThat count was wrong against every source. CISA's official KEV feed v2026.10.08 shows 38 additions and 27 three-day deadlines; the mirror at v2026.09.02 itself held 38 additions.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- SignificantCorrected 3 Aug 2026We said
BlackFog's State of Ransomware report for June 2026 again named Qilin the most active ransomware brand, at 16% of undisclosed attacks and 8% of disclosed, a second consecutive monthly lead.
What was trueBlackFog's June 2026 report names the newly emerged '2019' group as the month's leader with 12 claimed victims. Qilin led May 2026 with 11 victims; there was no second consecutive Qilin lead. BlackFog's June summary reports 102 disclosed attacks across 21 countries and 31 groups claiming victims, emphasising fragmentation rather than a dominant brand. Verified 3 August 2026 against the report text at https://www.blackfog.com/the-state-of-ransomware-june-2026/