The Record
Cybersecurity: Threats and Defences
What we told you to watch, what each side claimed, and what we got wrong. Every verdict shows its evidence.
Open 60 · Corrections 120
What we told you to watch
Still open · 60
Show the 10 most recentWhether the UK Cyber Resilience Pledge attracts signatories before its summer launch, or stays voluntary theatre.
From the 29 May briefing
Whether MuddyWater's Langflow access produces a named downstream breach before the 4 June KEV deadline.
From the 29 May briefing · Deadline: 4 June
Whether **Microsoft** ships an out-of-band patch for Exchange CVE-2026-42897 before CISA's 29 May federal deadline, and whether CISA acknowledges in writing that the deadline preceded the patch.
From the 20 May briefing · Deadline: 29 May
Whether **RansomHouse** publishes the full Trellix source-code dump, and whether **Cisco** confirms the scope of the 300+ stolen repositories beyond the named AI Defense and AI Assistant projects.
From the 20 May briefing
Whether **GTIG** or partner Computer Emergency Response Teams name additional AI-infrastructure CVEs in the LiteLLM, BerriAI, or vector-store stack within the next reporting window.
From the 20 May briefing
Whether the **ICO** opens further enforcement against UK water companies on the South Staffordshire template, or whether the Cyber Security and Resilience Bill reaches the Lords before the next enforcement action lands.
From the 20 May briefing
Will **Palo Alto Networks** ship the **PAN-OS** patch on 13 May, or does the gap widen, and does **CISA** issue a follow-up **KEV** note acknowledging the deadline-before-patch precedent.
From the 8 May briefing · Deadline: 13 May
RansomHouse: publishes **Trellix** source code, or quiet extortion, and whether peers cite the 21-day delay during the **CS&R Bill** Second Reading in the Lords.
From the 8 May briefing
Whether the **'Sorry'** ransomware crew or another ransomware-as-a-service operation scales the **cPanel** **CRLF** flaw beyond opportunistic encryption into bulk credential harvesting against the 1.5 million exposed hosts.
From the 8 May briefing
Whether **GTIG** or partner CERTs name additional npm packages compromised by **UNC1069** beyond **Axios**, given the maintainer-targeting tradecraft suggests a broader operation.
From the 8 May briefing
Whether **Shadowserver** or **Censys** publishes ASA/FTD anomaly counts that would put a number on FIRESTARTER mass-exploitation beyond the unnamed federal agency.
From the 30 Apr briefing
**Cisco** customer guidance on hardening, advisory updates and whether the vendor moves to a planned-outage eviction template.
From the 30 Apr briefing
**PRA** and **MoD** clearance review timelines for the **Airbus**/**Ultra Cyber** acquisition, and whether **Financial Conduct Authority (FCA)** or **PRA** sign-offs delay the **Beazley/Zurich** integration.
From the 30 Apr briefing
Whether the next emergency Cisco CVE shrinks the **CISA KEV** federal deadline below the 23 April three-day mark.
From the 30 Apr briefing · Deadline: 23 April
**Stokes** extradition timeline from Helsinki to Chicago, and downstream **Scattered Spider** charges off the same indictment.
From the 30 Apr briefing
**CitrixBleed 3** (CVE-2026-3055) escalating from active reconnaissance to mass exploitation within 30 days, repeating the CitrixBleed 2023 arc that landed LockBit and state groups inside enterprise SAML brokers.
From the 17 Apr briefing · Deadline: within 30 days
**OFAC** secondary PAIPA designations against other exploit brokers now that the first action has set the legal template, and whether Gulf-based shell vehicles are explicitly named in any follow-on tranche.
From the 17 Apr briefing
The **$707m CISA cut** surviving Congressional markup through the FY27 appropriations process, or whether hearings and committee amendments restore some of the counter-ransomware and election-security programmes.
From the 17 Apr briefing
Whether the **UK Cyber Security and Resilience Bill** returns from the House of Lords with material amendments to the **24-hour incident reporting** window, and whether the Lords push back on data-centre classification as essential services.
From the 17 Apr briefing
Whether additional **MDM-level, identity-only wipes** follow the Handala playbook against other multinationals, and whether Microsoft tightens Intune's default Conditional Access and break-glass posture in response.
From the 17 Apr briefing
What each side claimed
Claims are what a named side said at the time. We record them as said and judge them only against later evidence.
No claims recorded yet.
What we got wrong
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
The August KEV counts (37 additions, 24 three-day deadlines) were read from the cisagov/kev-data GitHub mirror, presented as CISA data one hop from source.
What was trueThat count was wrong against every source. CISA's official KEV feed v2026.10.08 shows 38 additions and 27 three-day deadlines; the mirror at v2026.09.02 itself held 38 additions.
- MinorCorrected 12 Oct 2026We said
A third of the August additions carried a deadline slower than three days.
What was true11 of 38, nearly three in ten, carried a slower deadline.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
The three-day KEV deadline applies under Binding Operational Directive 22-01.
What was trueBOD 22-01 was revoked on 10 June 2026; the August deadlines were set under BOD 26-04.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
The August KEV counts (37 additions, 24 three-day deadlines) were read from the cisagov/kev-data GitHub mirror, presented as CISA data one hop from source.
What was trueThat count was wrong against every source. CISA's official KEV feed v2026.10.08 shows 38 additions and 27 three-day deadlines; the mirror at v2026.09.02 itself held 38 additions.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
The August KEV counts (37 additions, 24 three-day deadlines) were read from the cisagov/kev-data GitHub mirror, presented as CISA data one hop from source.
What was trueThat count was wrong against every source. CISA's official KEV feed v2026.10.08 shows 38 additions and 27 three-day deadlines; the mirror at v2026.09.02 itself held 38 additions.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- MinorCorrected 12 Oct 2026We said
CISA added 37 entries to the KEV catalogue between 3 August and 2 September 2026, 24 of them (65 per cent) with three-day deadlines.
What was trueCISA added 38 entries in that window, 27 of them (71 per cent) with three-day deadlines.
- SignificantCorrected 3 Aug 2026We said
BlackFog's State of Ransomware report for June 2026 again named Qilin the most active ransomware brand, at 16% of undisclosed attacks and 8% of disclosed, a second consecutive monthly lead.
What was trueBlackFog's June 2026 report names the newly emerged '2019' group as the month's leader with 12 claimed victims. Qilin led May 2026 with 11 victims; there was no second consecutive Qilin lead. BlackFog's June summary reports 102 disclosed attacks across 21 countries and 31 groups claiming victims, emphasising fragmentation rather than a dominant brand. Verified 3 August 2026 against the report text at https://www.blackfog.com/the-state-of-ransomware-june-2026/