A tool called Malcolm with a password of 'Malcolm', and a notice that would not share
The week of 12-18 October produced a small run of documents that read like confessions. CISA disclosed seven flaws in its own network-monitoring tool, one carrying a hardcoded secret matching the tool's name; Treasury filed a Federal Register notice on information sharing that sat behind a screen refusing to share it; and HMRC amended one customs approval route for the second time in three months. Dry, literal and worth five minutes.
- CISA's ICSA-26-280-01 disclosed seven CVEs in its own Malcolm monitoring tool, including a hardcoded passwordSecret of "Malcolm" and a top score of CVSS v3 8.1.
- The Treasury's Federal Register notice titled "Information Sharing," dated 9 October 2026, was retrievable only as an access-restriction page, with no substance recoverable.
- HMRC amended its export examination-premises approval process on 8 October 2026, three months after the 8 July 2026 rewrite it was still refining.
- NIST, the NSA's Super Intelligence Security Center and CISA published voluntary guidance on 16 October 2026 for AI agents that take uninstructed actions against their own controls.
- A DOJ plea disclosed a money-laundering network branded "Your Mule Cashout."