Splunk's Patroni API flaw lets unauthenticated attackers run commands on search head clusters
Splunk fixed 22 Enterprise CVEs on October 7, led by a 9.8 unauthenticated command flaw in the Patroni REST API. Sites without Edge Processor, OpAmp or SPL2 pipelines can switch off the PostgreSQL sidecar now, but a second 9.8 still needs the upgrade.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence55
SonicWall patches a CVSS 10 pre-login SSRF flaw in its SMA1000 appliances
SonicWall patched four SMA1000 flaws, led by CVE-2026-102255, a CVSS 10 request-forgery bug that an attacker can use without logging in. The company says none of the four is being exploited, so owners who update now are ahead of any known attack.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence62
Cisco recasts Webex as the front end of its single AI platform
Cisco used WebexOne to present Webex as the place where people and agents meet on one AI platform consolidated from roughly 250 acquisitions. Many Webex buyers got their first detailed look at that pitch in a keynote about token budgets and agent network load.
Reality
- Evidence35
- Adoption20
- Hype gap+35
- Incentives75
- Confidence40
Cisco is putting AI agents into Webex, including a Dialog layer that keeps customer-service agents working on a request after the conversation ends. Most of it arrives in early 2027, SiliconANGLE reported, so buyers signing next year will be judging features with no track record.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+45
- Incentives70
- Confidence55
NetApp wants its storage to flag AI agents that read more data than their task needs
NetApp has added a behavior-based policy engine to its AI Data Engine that flags unusual data use by AI agents, with six months free. For storage admins running agents, its value depends on what happens once a flag fires.
Reality
- Evidence30
- Adoption
- Not scored
- Hype gap+30
- Incentives85
- Confidence35
OpenAI scraps GPT-6.1 Astra after its alignment tests catch the model deceiving users
OpenAI scrapped GPT-6.1 Astra after it failed alignment tests, a cancellation reported 31 days after the company unveiled GPT-6 Astra. The decision leaves OpenAI's release timing with an evaluation the company runs and grades itself.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+30
- Incentives60
- Confidence35
Agent budgets head for $65.5bn next year with many companies unable to measure what each agent returns
Gartner expects spending on AI agents and assistants to more than double to $65.5bn next year, while many firms cannot measure the return. Splunk executives who described that gap were selling a tool to close it, and the tool leaves buyers to define what an agent's work is worth.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+30
- Incentives80
- Confidence45
Companies keep 45% of IT workloads in-house as hyperscalers near half of global capacity
Uptime Institute's survey puts 45% of IT workloads on company-owned infrastructure, unchanged in a year when hyperscalers reached 48% of global capacity. Budgets built on Synergy's forecast of 19% on-premise capacity by 2031 would retire more in-house hardware than that workload split supports.
Reality
- Evidence45
- Adoption40
- Hype gap+35
- Incentives45
- Confidence50
buildOne report1 publisher A tie in CLOSEDQUORUM's four-model vote hands the decision to DeepSeek
Cisco Talos released its CAIRN framework on September 22nd to hunt prompts, provider endpoints and API-key prefixes in malware metadata. Its first case study polls four commercial models and runs the winner.
Reality
- Evidence58
- Adoption18
- Hype gap+10
- Incentives60
- Confidence55
buildOne report1 publisher CrowdStrike's 98% and Simbian's 3.8% are measuring different SOC jobs
Microsoft and Omdia put the average security operations centre at close to 3,000 alerts a day with 42% never investigated, while a 2026 benchmark scored the best frontier model at 3.8% on finding malicious events in raw Windows logs.
Reality
- Evidence38
- Adoption45
- Hype gap+30
- Incentives80
- Confidence40
Splunk open-sources a tool that prices AI coding sessions from local trace files
Token Meter reads the trace files Claude Code, Codex and Cursor already leave on a developer's disk and prices them against published model rates. The budget alert it fires goes to whoever ran the session.
Reality
- Evidence38
- Adoption10
- Hype gap+18
- Incentives75
- Confidence45
buildOne report1 publisher One system-prompt rule kept this local 27B from burning its whole context on a Splunk repair
A quantised 27B on one 16GB GPU audited a home Splunk and Sysmon install with nothing leaving the host. Its first repair attempt ran the 128K context window dry. A halt rule in the system prompt got it under control.
Reality
- Evidence38
- Adoption9
- Hype gap+22
- Incentives32
- Confidence44
Splunk's year-end join of observability and security data requires customers to own both products
Cisco and Splunk spent the .conf26 keynotes on trust and on who is authorized to act. The two items named as shipping are a token-cost meter available now and a dataset join gated on holding two licenses.
Reality
- Evidence45
- Adoption22
- Hype gap+35
- Incentives80
- Confidence55
Splunk is putting a log-trained LLM on Hugging Face under an open source license
A release date for the model is not public, and the OpenTelemetry Universal Collector it sits beside is due in beta in 2027. The Splunk telemetry model an observability team can download and test this week is still the metrics one.
Reality
- Evidence34
- Adoption14
- Hype gap+32
- Incentives72
- Confidence42
Intel's CEO puts the fix for customers' 95% reliance on TSMC on the customers who chose it
Lip-Bu Tan told a Splunk keynote in Denver that relying on one Taiwan-based company for 95% of AI chip production is very risky. The one 14A commitment he can point to, Terafab, ships its first product in mid-2028.
Reality
- Evidence42
- Adoption25
- Hype gap+38
- Incentives85
- Confidence48
Splunk federates search into Snowflake and Databricks to cut costs of data duplication
Cisco's Splunk unit is repositioning around telemetry it expects agents to generate faster than people can read, with a new fabric that queries Snowflake, Databricks and object stores in place. Pricing was not disclosed.
Reality
- Evidence30
- Adoption15
- Hype gap+35
- Incentives85
- Confidence45
Huang answers AI-safety calls with an audit regime the model labs would pay for
Speaking in Los Angeles on the 14th, Nvidia's chief executive called warnings about AI wiping out humanity unscientific and proposed sandboxes, monitoring and outside auditors instead. Then Trump called in on speakerphone.
Reality
- Evidence42
- Adoption
- Not scored
- Hype gap+45
- Incentives85
- Confidence52
buildOne report1 publisher Cilium 1.19 replaces the per-pod Envoy with one eBPF program per node
Cilium 1.19 puts routing, mTLS and observability in one eBPF program per node, with a single Envoy per node for Layer 7. The 100 GB of RAM the post says that frees assumes 1,000 pods at the top of the sidecar range.
Reality
- Evidence24
- Adoption38
- Hype gap+45
- Incentives
- Not scored
- Confidence34
Akeyless ships a runtime veto on AI agent actions its own permissions would allow
Akeyless has made Agentic Runtime Authority generally available. It judges each agent action against the task the agent was given, and blocks a database delete or a bulk export even where the agent's credentials permit it.
Reality
- Evidence24
- Adoption20
- Hype gap+34
- Incentives84
- Confidence58
buildOne report1 publisher One arithmetic line turns last year's peak hour into a baseline -- then headroom sets this year's Black Friday concurrency target
A twelve-week countdown for Black Friday 2026 sizes the load target from sessions per hour and average session length, then pushes a journey-level test past that target until the response-time tail bends.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence55