Latest edition
Blog · 267 analyses
Context for better decisions.
Analysis on AI, cybersecurity, regulation, governance and digital systems. With sources, practical consequences and one clear next action.
All analyses
145–156 of 267
Current knowledge, organised by topic, date and practical consequence.
CISA added CVE-2026-72529 and CVE-2026-72530 in TrueConf Server on 20 August. The first was due 23 August and the second 3 September, but separating the calendar must not prevent assessing chaining and exposure in the same product.
Read analysis
The IIA held a 20 August session on algorithmic accountability and the limits of traditional approaches. The useful point is turning uncertainty into scope: some elements are directly verifiable, while others require professional judgement and disclosure of limitations.
Read analysis
Recent OpenTelemetry guidance notes that SDKs limit cardinality to protect memory when a metric receives too many attribute combinations. The limit prevents local collapse, but may also drop series the team expected to investigate.
Read analysis
OpenAI previewed Private Safety Processing on 19 August, still under early-customer testing, as a way to detect risk patterns across interactions without giving OpenAI personnel access to content. Rollout and a technical white paper were announced for September; this should not be treated as a fully available capability today.
Read analysis
The Private Safety Processing proposal renews the tension between minimisation and abuse detection. Even with content under customer control, processing to infer safety signals still requires mapping purpose, roles, legal basis, transparency, and rights.
Read analysis
CISA added CVE-2026-64849, an SSRF vulnerability in MLflow, to KEV on 19 August with a 2 September deadline. NVD records active exploitation and partial technical impact in CISA’s SSVC assessment.
Read analysis
Private Safety Processing proposes separating customer-controlled content from narrow signals used for enforcement. The proposal still needs validation, but illustrates a better governance decision than simply storing everything or observing nothing.
Read analysis
Kernel.org listed 7.1.9 as stable and 6.18.45 and 6.12.104 as longterm updates on 19 August. The relevant change for each organisation is the line its hosts actually run and its distribution supports.
Read analysis
OpenAI said on 18 August that preliminary evidence indicated its upcoming Astra model might reach the Critical cybersecurity capability threshold in its Preparedness Framework. The company announced stronger monitoring, alignment, containment, and research security before proceeding.
Read analysis
OpenAI announced on 18 August that ChatGPT Ads would reach 31 European markets the following week. The company says ads are separate from answers, customer data is not sold, and users control personalisation; advertisers and operators need to test how those claims appear in the real flow.
Read analysis
CISA added four exploited vulnerabilities to KEV on 18 August with a 21 August deadline: Microsoft IKE, SharePoint, VMware vCenter, and macOS Screen Sharing. The window is shared; product, precondition, exposure, and proof differ.
Read analysis
OpenAI’s public signal about possible critical cyber capability in Astra offers a transferable rule: new capability should trigger control reassessment before inheriting the previous model’s permissions.
Read analysisHow we publish
Every analysis links the official documentation it relies on.
We translate change into decisions, owners and evidence.
We update the analysis when facts or guidance change.
We disclose generated photography and credit documentary photography.
From context to execution
We map the problem, write the scope and build the solution with acceptance criteria.
