Moonshot graded its own filter; Kaspersky found the bootkit

Today's record holds ten items, and the thread running through them is not what happened but who produced the number. Most of today's figures were supplied by the organisation they reflect on. The few that came from outside read differently.

The figures their subjects chose

Capcom put the CAPCOM ID breach it detected on October 19 at 11,774,247 records of email addresses and login metadata, with 43 accounts also exposing date of birth, gender, country and nickname and 196 accounts whose passwords were changed without authorization and have been reset (Help Net Security). The precision is the tell: only Capcom can count Capcom's rows, so the figure arrives exact and unverifiable at the same time.

Keystone reported scope rather than volume. After reviewing its own Shopify API activity it confirmed that customer names, contact details, shipping addresses and order details were taken, and that payment details, recovery phrases, private keys and wallet passwords were not (Bitcoin.com News). The second half of that sentence is the part buyers need and the part no outside party has checked.

Moonshot AI graded its own safety work. Kimi K3.1 Pro, a mixture of experts model with 2.8 trillion total and 104 billion active parameters, shipped with cyber training data stripped, and the company reports 81% on its internal exploit benchmark against 90.5% for an unfiltered checkpoint (MarkTechPost). Own filter, own benchmark, own score.

Block published no number at all. Dessa, a full duplex speech to speech model it says was trained on recorded human conversation with no text, is a research preview open to a small group of AI safety researchers, with a public waitlist, no published parameter count and no paper (Voice AI Space).

The figures nobody volunteered

Kaspersky found BlackX, a UEFI bootkit that defeats Secure Boot on fully updated Windows machines using the patched Baton Drop flaw CVE-2022-21894, which still works because the Windows Production PCA 2011 revocation has to be enabled by hand; it was running in diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan, and is tied to APT41 with medium confidence (The Hacker News). No vendor statement produced that finding.

Group-IB and NyxLab counted more than 70,000 exposed credentials in a campaign against Fortinet FortiGate and FortiWeb devices and Palo Alto GlobalProtect portals, using the PAN-OS authentication bypass CVE-2026-0257 that Palo Alto confirms is being exploited, with many victims later appearing on the Qilin and The Gentlemen leak sites (The Hacker News). That count exists because researchers did it.

Mississippi's Department of Environmental Quality supplied the one figure today that its subject would rather not print: notices to SpaceXAI's MZX Tech subsidiary for starting construction at three data center sites before stormwater permit coverage, with preliminary penalty exposure of about $6.1 million at up to $25,000 per day, disclosed in an SEC filing (Data Center Dynamics).

Who is allowed to check

The UK government committed £100 million to an independent non-profit AI biosecurity lab, with OpenAI adding £100 million of compute and model credits and Anthropic up to £100 million including technical support, and named no director, no site and no start date (Bloomberg). Independence underwritten in compute by two of the labs it would study is a structure worth noting, and the ledger's own figures for those two are self-published as well: OpenAI's $852B valuation and Anthropic's $965B both come from the companies.

Italy is the day's one mandated outsider. Legislative Decree 179/2026, in force since October 23, bars employers from resting hiring, contract changes, dismissal, discipline or performance decisions on automated processing alone, voids any dismissal decided that way, and requires a person with effective and autonomous authority rather than a formal sign-off (Actuia). Automated screening of candidates before a human review falls outside the rule.

One date on today's record moves a number out of its author's hands: Moonshot AI promised open weights by November 4, at which point that 81% stops being a claim and becomes a test anyone can run.