Primary Domain
Security
Within the Primary Domain facet, Security intelligence groups reporting by primary domain so readers can follow a focused area of internet infrastructure, governance, connectivity markets, or digital capital. The page brings together related articles, public evidence, institutions, companies, people, regional exposure, operating dependencies, and market context that may otherwise sit across separate category pages. It explains the domain, the likely actor class, the market or governance context, and the source material readers should use when comparing signals. Operators, analysts, and governance readers can see how the same domain appears across events, profiles, market shifts, public-source evidence, regional dependencies, and longer-cycle infrastructure decisions over time.
Creators
Barry O’Donovan’s CRA test: one software team, two roles—one product at a time
At RIPE 93, the INEX developer argued that the Cyber Resilience Act can assign different roles to the same organization across different products. For network operators, the label changes who handles security work upstream.
North America Cloud Services
Fortinet Set Aside $30m for Excess Parts. Its Firm Supply Commitments Total $1.93bn.
The small liability and the large promise sit in the same filing. Fortinet is paying for faster access to network-security hardware components while the final customer mix is still moving.
IETF
ECH's spare key carries an off switch
A proposal for signed connection retries makes a useful distinction: keeping a service reachable and protecting its visitors' privacy are different responsibilities.
Story
APNIC’s Honeynet Table Hits 115%. At Least 2,869 IPs Crossed Sensors.
APNIC counted 98,958 unique source IPs across six honeypots in one week. Add the sensor rows and the total jumps to 113,299 address-sensor appearances—a minimum of 2,869 addresses seen more than once.
Leaders
Alistair Woodman’s 370-CVE Year Has No Public Fix Clock
EEF’s own index lists 370 CVE records dated 2026 by 30 October, after nine the year before. Woodman says AI made discovery easier; the work that follows still depends on maintainers who have time to repair and verify their packages.
Global Cloud Services Trends
Tenable’s after-hours AI leaves one hard question: who approved the fix?
Tenable says Hexa AI can keep finding exposures and coordinating remediation while security teams are offline. Its investor deck puts approval with the team and execution with the agent; the action-by-action boundary is not in the release.
Africa National Telecom Trends
Kenya’s 2.7bn cyber events need a counting rule
The National KE-CIRT/CC recorded 2,696,335,021 detected events in July–September 2026. Its report gives the total and six tidy subtotals, but no data dictionary linking a detection to an advisory, an incident or a defended service.
Leaders
The Advisory Series Without a Signature: What CERT-MU's Published Record Does Not Establish About Kaleem Ahmed Usmani
Mauritius's national computer emergency response team published three dated technical notices in 2026 — a vulnerability note, an advisory and a security alert — each with a reference number, a class label and a date. None of the three names a person. The statute that would say…
CASE FILE
CrowdStrike's Channel File 291 remedy is a gate list without a test record
Two quoted sentences survive from the vendor's own root-cause text. What followed survives only as summaries — and a control that has been announced is not yet a control that has been demonstrated.
Europe and Middle East Cloud Services Trends
A Yandex.Cloud stream stopped. The customer still received familiar bots.
Cloudflare's account of the October outage contains two very different losses: search crawlers stopped arriving, while a suspicious stream changed hosting networks. Following the requests reveals what the traffic charts alone cannot.
North America Cloud Services
Proofpoint’s Varonis bid tests the link between threat signals and data access
A security alert becomes useful when an organisation can connect the person or agent that acted, the data it could reach, the permissions that made the action possible, and the remedy that actually changed exposure. Proofpoint’s proposed purchase of Varonis promises to join more…
Story
CEDIA’s FIRST Talk Leaves Critical CSIRT Decisions With People
At the LACNIC 46 co-located symposium, a 21 October session will describe DALIA’s AI-assisted triage and correlation while reserving critical decisions and containment for people. The abstract does not say how that boundary is enforced.
IETF
The Rule Matched the Body. Which Body Did It See?
One mail server found the phrase. Another, running the same rule against the same message, did not. RFC 5173 makes that result less mysterious: `:raw`, `:content` and `:text` do not expose one canonical body. They construct different evidence surfaces before the comparator ever…
IETF
The Child Token Was Valid. The Chain Still Had to Authorize It.
A delegated token can carry a perfect signature and still have no usable authority. The proposed OAuth chain works only when every parent, every narrowing step, the leaf key, current status and the resource server’s own policy agree on the same bounded operation.
IETF
The Manufacturer Signed the New Trust Roots. The Delivery Server Was Still Untrusted.
A factory-installed key can let a device accept a new operational CA bundle from an endpoint it cannot yet authenticate. That is not a paradox if every grant stays narrow: the signature authorizes the entity, the entity changes a local trust store, and only a fresh validated…
IETF
The Prefix Was Registered. The Interpreter Was Still Local.
One readable literal enters two production gates. The first interpreter recognizes its prefix and constructs a value. The second recognizes the same name but refuses to run the extension because the operator never allowed it. Nothing in the source file changed. The disagreement…
IETF
The String Was Exact. The Authority Was Still Local
A service can now hand a customer a precise DNS change instead of a paragraph of instructions. That removes one class of ambiguity. It does not tell the DNS operator who authored the request, whether the customer may alter the named zone, whether local policy should accept the…
IETF
The AS2 Names Matched. The Signer Was Still a Local Decision
A certificate rollover can leave every visible signal green—TLS connected, names reflected, signature valid, MIC matched—while one decisive fact remains outside the protocol transcript: who authorized this key to speak for this partner, in this direction, now?
CASE FILE
The Draft Had Eight Numbers. The Registry Still Had None
On 1 October 2026, an OpenPGP implementer could place two official-looking documents side by side and receive two different answers. Revision 05 of a working-group draft called eight composite algorithms 37 through 44. The live IANA registry still called the entire range from 37…
IETF
The ACME Key Rotated. Yesterday's DNS Authorization Still Works
The newest ACME DNS persistence draft turns routine key rotation into an accounting problem. A retired signing key may be unable to place another order while its public thumbprint still keeps an earlier DNS authorization usable.