Threat intelligence editor

Alex Kim

Articles: 235
Desks: 7

Focuses on cloud identity, incident response, and exploitation trends.

CloudIncident responseIdentity

Coverage by Alex Kim

Data graphic: Cisco Secure Email Gateway flaw CVE-2026-76519, rated CVSS 9.8 Critical, stamped "Exploited, in CISA KEV". It is unauthenticated, needs File Reputation enabled, and has no workarounds.

Cisco Secure Email Gateway Flaw Gives Attackers Root, and It Is Being Exploited

CVE-2026-76519 lets a crafted email attachment run commands as root on Cisco Secure Email Gateways with File Reputation on. Cisco confirms exploitation; no fixed 16.0 build.

Oct 14 · 6 min

Data graphic: dot plot of Gemini usage multipliers by plan, 1x with no plan, 2x AI Plus, 4x AI Pro

elevatedResearch Gemini Ai Ultra Pricing

Gemini App Limits Cut: Free Users Get Flash-Lite Only, and AI Plus Loses Gemini Pro

From 9 October Google limits free Gemini users to Flash-Lite and takes Pro from AI Plus. Here is what each plan keeps, and where Deep Think is still unclear.

Oct 14 · 4 min

Data graphic: a large 3 GB figure labelled as OpenBMB's vendor claim for MiniCPM-V 4.7 running at 13+ tokens per second on an iPhone

watchResearch Local Llm Inference

MiniCPM-V 4.7: OpenBMB Claims a 35B Vision MoE Runs at 13 Tokens a Second in 3 GB on an iPhone

OpenBMB says its 35B-A3B vision MoE hits 13+ tok/s in about 3 GB on an iPhone 17 Pro Max. No quantisation is stated; the Q4_K_M GGUF is 21.2 GB.

Oct 14 · 4 min

Data graphic: X Subscription tiers from Free to Ultra at $200 a month, with Claude and GPT usage in Cursor billed at API list price.

elevatedResearch Cursor Pricing

The X Subscription Explained: Cursor and Grok in One Plan, and Claude or GPT Now Cost API List Price

xAI's X Subscription bundles Grok, Cursor and X Premium from $8 to $200 a month, but Claude and GPT in Cursor now bill at API list price on top.

Oct 14 · 4 min

Data graphic: dumbbell chart of LFM2.5-24B-A2B against Qwen3.6-35B-A3B on six benchmarks, LFM ahead on AutomationBench, IFBench and ToolSandbox, behind on SWE-Bench Verified, GPQA Diamond and WebArena Verified

watchResearch Open-Weight Models

Liquid LFM2.5-24B-A2B vs Qwen3.6-35B-A3B: Better at Agents, Weaker at Coding

Liquid's new 24B MoE beats Qwen3.6-35B-A3B on tool use and instruction following but trails on SWE-Bench and GPQA, per Liquid's own benchmarks.

Oct 14 · 4 min

Data graphic: attack chain from an unauthenticated /tokenize request through mm_processor_kwargs.code_revision and an attacker-controlled repository revision to processor code running under --trust-remote-code

highAI Security Vllm Serving

vLLM 0.31.0 Fixes Remote Code Execution Through Request-Controlled code_revision, Plus Four Other Advisories

vLLM 0.31.0 closes five 6 October advisories, led by a code_revision flaw that can run attacker code with --trust-remote-code. No CVE ids yet; scores disagree.

Oct 14 · 4 min

Data graphic: dot plot of vendor-reported scores for Reflection Beam, GLM 5.2 and Kimi K3 on four benchmarks

watchResearch Open Weight Coding Models

Reflection Beam: A 501B Open-Weight MoE Claims 80.9 on SWE-bench Verified, but the Weights Have Not Shipped

Reflection AI's Beam reports 80.9 on SWE-bench Verified and promises Apache 2.0 weights, but as of Oct 14 nothing is on Hugging Face and every number is vendor-reported.

Oct 14 · 3 min

Data graphic: Ivanti Connect Secure zero-day, CVSS 3.1 High 8.6, stamped "Zero-day, hit patched 22.8R2.4"; CISA deadline 16 Oct, 5,500+ exposed VPN appliances Shadowserver .

criticalExploits Cve 2026 104935

Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited; CISA Sets October 16 Deadline

Ivanti patched an authentication bypass in Connect Secure VPNs that attackers exploited as a zero-day, including on a patched 22.8R2.4 appliance. CISA added it to KEV, due 16 Oct.

Oct 13 · 6 min