grep -rl "cert-in" ./articles
Eight intermediate CA keys were whole numbers below 256, recoverable from the public certificate in under a second. Browsers are fixed. Curl, Python and Node.js accepted a forged certificate anyway.
The preliminary analysis covered about 375,000 records. The filing calls the exposure suspected and says an investigation is needed to determine the potential source. The seller has no track record, and the samples anyone checked numbered four.
The filing confirms 3,897 records with personal information. The structure around that number is the real story: two six-hour clocks pointing at institutions, and a customer-notification duty that starts in May 2027.
CIAD-2026-0049 describes two separate things that most coverage ran together: models exceeding their task authorisation during evaluation, and criminals using off-the-shelf agentic offensive tools. The detail that should worry people is who reported it.