Skip to main content
Client access Talk to us

Latest edition

Blog · 267 analyses

Regulation, AI and cybersecurity, with sources in view.

Context for better decisions.

Analysis on AI, cybersecurity, regulation, governance and digital systems. With sources, practical consequences and one clear next action.

All analyses

All analyses

109–120 of 267

Current knowledge, organised by topic, date and practical consequence.

Conceptual editorial composition about ai act: a provider's confidential evaluation does not replace the deployer's dossier
Accept external evaluation as one dossier item and require a table linking every result to the relevant requirement, risk, and deployment configuration. If the report does not establish version, scope, or limitations, it should not independently support a compliance or production decision.AI-generated image under Velqory editorial direction.
Regulation14 min read

AI Act: a provider's confidential evaluation does not replace the deployer's dossier

The double-blind evaluation pilot announced by DeepMind offers a promising way to protect prompts and weights, but the AI Act allocates duties by role and use case. An organisation deploying a system still needs inventory, classification, instructions, oversight, logs, and controls in its own context.

Read analysis
Conceptual editorial composition about cisa kev: owncloud, linux, and artifactory enter on the same day — with two different deadlines
Portuguese organisations do not automatically inherit a US federal deadline, but confirmed exploitation changes technical priority. Triage should separate product presence, affected version, exposure, compensating controls, telemetry, and the ability to remediate or withdraw the service.AI-generated image under Velqory editorial direction.
Cybersecurity14 min read

CISA KEV: ownCloud, Linux, and Artifactory enter on the same day — with two different deadlines

CISA added CVE-2023-49105 in ownCloud, CVE-2026-53362 in the Linux kernel, and CVE-2026-66384 in JFrog Artifactory to its exploited-vulnerabilities catalogue on 27 August. The feed assigns 30 August to the first two and 10 September to the third for US federal entities covered by the directive.

Read analysis
Conceptual editorial composition about ai procurement: a blind evaluation only matters when the decision has precommitted criteria
Before comparing providers, fix use cases, weights, thresholds, data, total cost, latency, security, privacy, accessibility, oversight, and disqualifying conditions. Only then run tests under neutral identifiers and reveal identity to assess contract, support, jurisdiction, and exit risk.AI-generated image under Velqory editorial direction.
Governance12 min read

AI procurement: a blind evaluation only matters when the decision has precommitted criteria

DeepMind's double-blind pilot targets contamination and information asymmetry between evaluator and provider. For procurement, the broader lesson is to separate commercial identity and curated demonstrations from measured execution against criteria defined before seeing the result.

Read analysis
Conceptual editorial composition about kubernetes 1.37 is released: turn 67 enhancements into an upgrade gate
Open the upgrade assessment, not automatic promotion. Freeze a per-cluster matrix covering version, supported skew, distribution, add-ons, APIs, feature gates, runtime, etcd, networking, storage, observability, critical workloads, and rollback before selecting canaries.AI-generated image under Velqory editorial direction.
Digital systems14 min read

Kubernetes 1.37 is released: turn 67 enhancements into an upgrade gate

The Kubernetes project released version 1.37, Garhwal, on 26 August. The official announcement counts 67 enhancements: 16 graduating to Stable, 23 to Beta, 27 entering Alpha, and one deprecation or removal. This confirms the artefact that was still pending during Velqory's 26 August check.

Read analysis
Conceptual editorial composition about webmcp: giving web tools to agents requires less guessing and more explicit authority
Pilot only narrow, reversible tasks. Every tool should declare input, effect, identity, data read, data changed, preconditions, human confirmation, idempotency key, rate limit, error behaviour, and a verifiable receipt.AI-generated image under Velqory editorial direction.
Artificial intelligence12 min read

WebMCP: giving web tools to agents requires less guessing and more explicit authority

OpenAI opened a ten-day WebMCP challenge on 25 August, describing WebMCP as an experimental open standard that lets a website expose structured tools to agents. The page points to testing in ChatGPT’s in-app browser or Chrome through an experimental flag or origin trial; this confirms experimentation, not production maturity or standards consensus.

Read analysis
Conceptual editorial composition about ai act after the omnibus: delaying high-risk rules did not suspend the rest of the regulation
Replace any single line called ‘AI Act — 2027/2028’ with a calendar by article, role, system type, placing-on-market date, and obligation. Continue executing what already applies and use the additional high-risk time as an engineering and evidence window.AI-generated image under Velqory editorial direction.
Regulation14 min read

AI Act after the Omnibus: delaying high-risk rules did not suspend the rest of the Regulation

Regulation (EU) 2026/1744, in force since 27 July, changed the AI Act timetable. Sections 1 to 3 of Chapter III now apply on 2 December 2027 to high-risk systems under Article 6(2) and Annex III, and on 2 August 2028 to systems under Article 6(1) and Annex I. The general application date of 2 August 2026, however, did not disappear.

Read analysis
Conceptual editorial composition about oracle http server and weblogic proxy in kev: the 27 august deadline requires inventory today
Before the deadline, discover not only WebLogic servers but also the proxy layer in Apache and IIS, confirm version and patch state, reduce exposure, and investigate prior requests; if mitigation is unavailable, remove the component from the public path.AI-generated image under Velqory editorial direction.
Cybersecurity12 min read

Oracle HTTP Server and WebLogic proxy in KEV: the 27 August deadline requires inventory today

CISA added CVE-2026-21962 to KEV on 24 August and set 27 August as the operational deadline. NVD describes unauthenticated HTTP network access, a CVSS 3.1 score of 10.0, and confidentiality and integrity impact in Oracle HTTP Server and the WebLogic Server Proxy Plug-in.

Read analysis
Conceptual editorial composition about ai-enabled influence operations: verifying the institution is now as important as verifying the text
Editorial and risk review should verify four separate layers: entity identity and existence, authorship and material provenance, index methodology and data, and distribution coordination. Plausible text does not compensate for a fabricated institution.AI-generated image under Velqory editorial direction.
Governance13 min read

AI-enabled influence operations: verifying the institution is now as important as verifying the text

OpenAI reported on 25 August that it banned a cluster of accounts it assesses as very likely originating in Russia. According to the company, the accounts generated social promotion for an apparent institution while the associated site contained copied or misattributed academic work and a proprietary index favourable to Russia. These are OpenAI’s investigative findings, not an independent Velqory determination.

Read analysis
Conceptual editorial composition about kubernetes 1.37 was planned for today: without the final artefact, the upgrade remains blocked
Do not turn the planned date into a release fact. Prepare inventory and tests now, but open the upgrade wave only when the final version, changelog, checksums, images, and documentation appear in official channels and match the managed distribution.AI-generated image under Velqory editorial direction.
Digital systems13 min read

Kubernetes 1.37 was planned for today: without the final artefact, the upgrade remains blocked

The Kubernetes project had planned version 1.37 for 26 August. At this edition’s verification time, the official releases page still showed 1.36 as the latest line and the blog did not contain the final 1.37 announcement. The sneak peek remains useful for test preparation but warns that features and status could change before the actual release.

Read analysis
Conceptual editorial composition about ai administration: the new plugin turns a conversation into a privileged surface
Treat the plugin as a new privileged console: separate read from write, require confirmation for member removal, access changes, and spending, and bind every execution to the human identity, original request, applied policy, and observed result.AI-generated image under Velqory editorial direction.
Artificial intelligence11 min read

AI administration: the new plugin turns a conversation into a privileged surface

OpenAI announced on 25 August an administration plugin for ChatGPT Work and Codex that can inspect activity and credits, manage members and groups, review permissions, and execute supported actions, including approving or denying spending requests. The company says the tool inherits the user’s role, shows what changed, and allows higher-impact actions to be reviewed before application.

Read analysis
Conceptual editorial composition about e-evidence now applies: receiving a european order requires a clock, scope, and chain of custody
In-scope providers should operate a 24/7 path that authenticates the certificate, identifies the entity and data category, preserves without alteration, escalates conflicts, and meets the applicable deadline without responding beyond the validated request.AI-generated image under Velqory editorial direction.
Regulation13 min read

E-evidence now applies: receiving a European order requires a clock, scope, and chain of custody

Regulation (EU) 2023/1543 has applied since 18 August 2026. It allows a judicial authority to issue European Production or Preservation Orders to a provider’s designated establishment or legal representative in another Member State, regardless of the data location, within the criminal proceedings defined by the Regulation.

Read analysis
Conceptual editorial composition about gitea cve-2026-60004 entered kev: repository write access can become server execution
Treat all Gitea instances as an urgent population: resolve version and exposure, identify who had write access, preserve telemetry before remediation, and rotate credentials reachable by the service account on exposed systems.AI-generated image under Velqory editorial direction.
Cybersecurity12 min read

Gitea CVE-2026-60004 entered KEV: repository write access can become server execution

CISA added CVE-2026-60004 to the KEV catalog on 25 August with a 28 August deadline. The official description says an attacker with repository write access can submit a malicious patch to the diffpatch endpoint, plant an executable Git hook, and run shell commands as the Gitea service account.

Read analysis

How we publish

Each analysis links to the official source and says what changes in practice.

  1. 01Sources in view

    Every analysis links the official documentation it relies on.

  2. 02Operational context

    We translate change into decisions, owners and evidence.

  3. 03Continuous review

    We update the analysis when facts or guidance change.

  4. 04Identified imagery

    We disclose generated photography and credit documentary photography.

From context to execution

Is there an obligation or a system that needs to become operational?

We map the problem, write the scope and build the solution with acceptance criteria.