Analysis – Page 24

Trust & Security

Active Directory Will Execute Code From a Packet That Never Authenticated. Microsoft’s File Carries 8.1, Not 9.8.

CVE-2026-70229 reaches Active Directory Domain Services unauthenticated over the network – and the 9.8 circulating in secondary summaries is not Microsoft's number. The record carries CVSS 3.1 8.1 with high attack complexity, no observed exploitation, and the fix in Tuesday's update; the gap between those two figures decides how fast this gets patched, not whether.

◆ Heath CallahanOct 14

Money & Markets

Philippines Central Bank Restricts Coins.ph Inbound Rails Over Gambling Ties

Philippine regulators just restricted the inbound banking rails for the country's largest stablecoin gateway. The move reveals where the actual power over machine-settled commerce lives: at the pipe, not the license.

◆ Nolan PrattOct 14

Trust & Security

Keycloak Lets a Delegated Admin Move the Token URL Without Re-Entering the Secret. The Stored Secret Follows.

An OIDC identity-provider update that leaves the client secret as the masked sentinel while the token URL changes re-binds the real stored credential to the new endpoint. Fixed in Keycloak 26.8.1: configuration changes now force the secret to be re-submitted instead of reused.

◆ Heath CallahanOct 14

Money & Markets

Capital in Agentic AI Is Not Flowing. It Is Being Funnled Through Three Doors.

The equity door concentrates capital in follow-ons. The compute-debt door anchors $518 billion in non-cancelable commitments. The margin door races to zero. The public window reprices when the Anthropic prospectus lands around Oct 25.

◆ Nolan PrattOct 14

Infrastructure

The Consent Layer Is Getting Built – But Not by the Bodies That Own the Specs.

PACT ships an open consent layer. Salesforce labels itself 'A2A-compliant.' AAIF pushes identity-first as a foundation pillar. The A2A Registry formal spec never shipped. Trust infrastructure is being assembled from shipping code, not from consensus standards.

◆ Blair HayesOct 14

Models

The $0.05 Floor: Why StepFun’s Cache-Read Rate Changes the Persistent Agent Equation

Step-5 Preview lists $0.05 per million for re-reading context – 4x below the $0.20 tier Anthropic, Meta, and Google occupy on the same axis. The missing write terms turn the arithmetic into a risk calculation.

◆ Lena ParkOct 14

Agents at Work

Kyndryl and Toyota Finance Deploy Agentic AI Inside IT Operations. The Numbers Can Wait.

The third major IT services firm in 48 hours announces a named production customer for agentic AI. Only one of the three has shared performance data.

◆ Dana EllisonOct 14

Trust & Security

IBM Security Verify Access Deserialization CVE-2026-78401

The management interface of IBM Security Verify Access processes untrusted data in a way that allows an unauthenticated remote attacker to execute arbitrary code. It is not an authentication bypass; the system processes the malicious payload directly.

◆ Heath CallahanOct 14

Commerce

Ripple and Privy Just Gave AI Agents Their Own Wallets on the XRP Ledger

The first major L1 to embed programmable wallets for AI agents bypasses the merchant-of-record debate by building underneath it. The accountability gap, however, remains wide open.

◆ Tessa VaughnOct 14

Commerce

Amex ‘Proof of Intent’: The Issuer Side Enters the Agentic Checkout Wars

Amex's "Proof of Intent" token is the sixth definition of "agentic checkout" and the first from the issuer side. It moves the evidence issuers hold, not the merchant-of-record loss default.

◆ Tessa VaughnOct 14