The Record
Cybersecurity: Threats and Defences
What we told you to watch, what each side claimed, and what we got wrong. Every verdict shows its evidence.
Open 60 · Corrections 120
What we told you to watch
Still open · 60
Show the 10 most recentWhether the UK Cyber Resilience Pledge attracts signatories before its summer launch, or stays voluntary theatre.
From the 29 May briefing
Whether MuddyWater's Langflow access produces a named downstream breach before the 4 June KEV deadline.
From the 29 May briefing · Deadline: 4 June
Whether **Microsoft** ships an out-of-band patch for Exchange CVE-2026-42897 before CISA's 29 May federal deadline, and whether CISA acknowledges in writing that the deadline preceded the patch.
From the 20 May briefing · Deadline: 29 May
Whether **RansomHouse** publishes the full Trellix source-code dump, and whether **Cisco** confirms the scope of the 300+ stolen repositories beyond the named AI Defense and AI Assistant projects.
From the 20 May briefing
Whether **GTIG** or partner Computer Emergency Response Teams name additional AI-infrastructure CVEs in the LiteLLM, BerriAI, or vector-store stack within the next reporting window.
From the 20 May briefing
Whether the **ICO** opens further enforcement against UK water companies on the South Staffordshire template, or whether the Cyber Security and Resilience Bill reaches the Lords before the next enforcement action lands.
From the 20 May briefing
Will **Palo Alto Networks** ship the **PAN-OS** patch on 13 May, or does the gap widen, and does **CISA** issue a follow-up **KEV** note acknowledging the deadline-before-patch precedent.
From the 8 May briefing · Deadline: 13 May
RansomHouse: publishes **Trellix** source code, or quiet extortion, and whether peers cite the 21-day delay during the **CS&R Bill** Second Reading in the Lords.
From the 8 May briefing
Whether the **'Sorry'** ransomware crew or another ransomware-as-a-service operation scales the **cPanel** **CRLF** flaw beyond opportunistic encryption into bulk credential harvesting against the 1.5 million exposed hosts.
From the 8 May briefing
Whether **GTIG** or partner CERTs name additional npm packages compromised by **UNC1069** beyond **Axios**, given the maintainer-targeting tradecraft suggests a broader operation.
From the 8 May briefing
Whether **Shadowserver** or **Censys** publishes ASA/FTD anomaly counts that would put a number on FIRESTARTER mass-exploitation beyond the unnamed federal agency.
From the 30 Apr briefing
**Cisco** customer guidance on hardening, advisory updates and whether the vendor moves to a planned-outage eviction template.
From the 30 Apr briefing
**PRA** and **MoD** clearance review timelines for the **Airbus**/**Ultra Cyber** acquisition, and whether **Financial Conduct Authority (FCA)** or **PRA** sign-offs delay the **Beazley/Zurich** integration.
From the 30 Apr briefing
Whether the next emergency Cisco CVE shrinks the **CISA KEV** federal deadline below the 23 April three-day mark.
From the 30 Apr briefing · Deadline: 23 April
**Stokes** extradition timeline from Helsinki to Chicago, and downstream **Scattered Spider** charges off the same indictment.
From the 30 Apr briefing
**CitrixBleed 3** (CVE-2026-3055) escalating from active reconnaissance to mass exploitation within 30 days, repeating the CitrixBleed 2023 arc that landed LockBit and state groups inside enterprise SAML brokers.
From the 17 Apr briefing · Deadline: within 30 days
**OFAC** secondary PAIPA designations against other exploit brokers now that the first action has set the legal template, and whether Gulf-based shell vehicles are explicitly named in any follow-on tranche.
From the 17 Apr briefing
The **$707m CISA cut** surviving Congressional markup through the FY27 appropriations process, or whether hearings and committee amendments restore some of the counter-ransomware and election-security programmes.
From the 17 Apr briefing
Whether the **UK Cyber Security and Resilience Bill** returns from the House of Lords with material amendments to the **24-hour incident reporting** window, and whether the Lords push back on data-centre classification as essential services.
From the 17 Apr briefing
Whether additional **MDM-level, identity-only wipes** follow the Handala playbook against other multinationals, and whether Microsoft tightens Intune's default Conditional Access and break-glass posture in response.
From the 17 Apr briefing
What each side claimed
Claims are what a named side said at the time. We record them as said and judge them only against later evidence.
No claims recorded yet.
What we got wrong
- MinorCorrected 12 Oct 2026We said
ThreatVectr is a commercial tracker counting ransomware leak-site claims
What was trueThreatVectr is a cybersecurity news site run by Imicus Group; its monthly ransomware tracker counts leak-site claims seen through ransomware.live, so it is not an independent count
- MinorCorrected 12 Oct 2026We said
The sentence tied September's 815 to ThreatVectr's upward revisions, implying 815 was ThreatVectr's figure
What was true815 is ransomware.live's September count (the event's own fact and FOOTNOTE:1, api.ransomware.live/v2/victims/2026/09); ThreatVectr reported 861 for September per the enricher
- MinorCorrected 12 Oct 2026We said
ThreatVectr is a commercial tracker that counts postings on criminal leak sites
What was trueThreatVectr is a cybersecurity news site run by Imicus Group; its monthly ransomware tracker counts leak-site claims seen through ransomware.live, so it is not an independent count
- MinorCorrected 12 Oct 2026We said
China's 2021 rules make researchers and companies report flaws within two days
What was trueArticle 7(2) puts the two-day duty on network product providers (cac.gov.cn/2021-07/13/c_1627761607640342.htm)
- MinorCorrected 12 Oct 2026We said
BlackFog's June 2026 report named Qilin the most active ransomware brand for a second consecutive month, at 16% of undisclosed and 8% of disclosed attacks, after Operation Saffron disrupted around 25 gangs
What was trueBlackFog's June 2026 report names the newly emerged 2019 group the month's leader with 12 claimed victims; 102 disclosed attacks across 21 countries and 31 groups. Qilin led May with 11 and did not repeat. The report text carries no 16% or 8% figures. Operation Saffron took down the First VPN service; it did not disrupt 25 gangs.
- MinorCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- MinorCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- MinorCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- MinorCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- MinorCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.