TrebSec Daily Report
Sunday, November 1, 2026
Today's cybersecurity, AI, and compliance stories, each reviewed against its sources and broken down for four audiences. Use the reports index to search past editions by category and framework, and the frameworks directory for plain-language explainers of every body and standard referenced here.
8 stories in this edition.
FBI cyber alert October 31, 2026; theft on or about October 29, 2026
FBI Attributes the Record Binance Theft to North Korea TraderTraitor and Publishes Addresses to Block
Threats
The FBI confirmed on October 31 that North Korea TraderTraitor group was behind the theft of more than $6 billion in virtual assets from Binance, the largest cryptocurrency exchange theft on record, which took place on or about October 29. The Bureau, working with the U.S. Secret Service and IRS Criminal Investigation, said the actors have been converting the stolen funds mainly into ether and expects them to keep laundering through swap services and other decentralized finance tools. The alert listed over 600 Ethereum addresses, just under 20 Bitcoin addresses and a single Solana address that hold or once held funds from the hack, and urged node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with or derived from those addresses. Chainalysis said the attackers have already used thousands of addresses and that it expects tens of thousands in the coming weeks as the laundering network widens, using automated mechanisms to circulate funds between addresses. Stablecoin issuers froze over $2.4 billion of the stolen funds. Binance said it had replenished about 90 percent of the stolen assets and planned to resume customer withdrawals on Sunday, November 1. TraderTraitor is tracked as a subunit of the Lazarus Group, the same activity the FBI previously attributed the roughly $1.5 billion Bybit theft of February 2025 to.
Executives
Scale is the first fact: one theft above $6 billion, larger than every prior exchange hack, executed against the largest exchange in the sector. The second fact is the response model: law enforcement published the laundering addresses publicly and asked the whole ecosystem to block them, which makes screening a shared duty rather than one firm problem. Any organization that holds or moves crypto assets should be able to say today whether the FBI list is loaded into its screening.
CIO / CISO
Ingest the FBI address list, over 600 Ethereum addresses plus the Bitcoin and Solana entries, into wallet screening and transaction monitoring now, and expect the list to grow: Chainalysis already counts thousands of addresses in use and projects tens of thousands. Screen for transactions derived from listed addresses, not only direct transfers, per the alert wording. Binance preliminary account pointed to an initial compromise involving a DevOps engineer laptop, so review privileged workstation controls for anyone with production or wallet-adjacent access.
Engineers
Automate the blocklist update rather than pasting addresses once, because the laundering pattern described is automated circulation between addresses before onward movement. Log and alert on near matches and peel-chain patterns your analytics provider flags, and preserve any hit with full transaction context for a report to the FBI Internet Crime Complaint Center, which the alert names as a reporting channel.
Everyone (non-IT)
If you hold assets on any exchange, nothing in the FBI alert asks you to move funds or change passwords. Binance said it replenished about 90 percent of stolen assets and planned to resume withdrawals on November 1. Treat urgent messages claiming to be from an exchange about this hack with suspicion and reach the service only through its official app or site, because large public incidents reliably attract impersonation attempts.
Read the standalone brief
CISA KEV catalog version 2026.10.30; Palo Alto Networks advisory updated October 30, 2026; roundup updated November 1, 2026
KEV Deadlines Land Today: Cisco ASA and GitLab Fixes Due November 1, With PAN-OS PHP Exploitation Confirmed
Threats
Two federal remediation deadlines in CISA Known Exploited Vulnerabilities catalog fall today, November 1. CVE-2026-76418, scored 8.6, is an unchecked return value and NULL pointer dereference flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD software: where secondary authentication is configured on a tunnel group, an unauthenticated remote attacker can force the device to reload, dropping every remote access VPN session. Cisco published its advisory on October 28, said it became aware of active exploitation in October, and states there are no workarounds. CVE-2026-97229, scored 10.0, is an integer overflow in self-managed GitLab CE and EE that lets an unauthenticated user execute arbitrary code on the server through a specially crafted regular expression in a CI/CD configuration; it affects versions from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2, and GitLab fixed it on October 12 in 19.4.2, 19.3.5 and 19.2.8. GitLab.com and GitLab Dedicated are already patched. CISA also notes that other products can potentially be affected by the same underlying Ruby and Onigmo integer overflow issue. The same catalog round, updated November 1, adds a vendor confirmation on the PHP2Shell flaws: Palo Alto Networks, in an advisory updated October 30, rates CVE-2026-109618 severity 9.2 with exploit maturity listed as attacked, and states that active exploitation has been observed targeting the PAN-OS and Panorama management interface exposed to the internet, with fixed hotfixes listed for every supported branch. The next KEV deadlines are the Ivanti Connect Secure pair, due November 2 and November 13.
Executives
A deadline that falls on a Sunday is still a deadline, and both products due today sit on the network edge: the VPN concentrator staff connect through, and the code platform that holds source and build credentials. The Palo Alto confirmation in the same round carries the wider lesson: management interfaces exposed to the internet are being actively attacked through a flaw in a bundled component, not the headline product. Ask for a one-line status on each of the three product families today, not at the next monthly review.
CIO / CISO
Close the two due items first: upgrade self-managed GitLab to 19.4.2, 19.3.5 or 19.2.8 or later and review CI/CD configuration changes from untrusted contributors, and apply the Cisco fixed release for your ASA or FTD train, checking exposure by configuration, since a device is in scope when the SSL VPN login service is reachable and any tunnel group, including the default group, uses secondary authentication. Then work the PAN-OS item: restrict the management interface to a jump host, install the hotfix for your branch, noting that on 11.2.10 the h17 hotfix, not h16, carries both the PHP and Brotli fixes, and treat any device whose management interface was internet-reachable as possibly compromised.
Engineers
Use the read-only checks before you patch: on ASA, show version and the webvpn and tunnel-group configuration to confirm secondary authentication; on GitLab, the Admin Area dashboard or gitlab-rake gitlab:env:info gives the running version; on PAN-OS, show system info and check the management interface permitted IP list. Watch ASA crashinfo for unexpected reloads, each one is a full VPN session drop and, in this context, a possible exploitation signal rather than a hardware fault.
Everyone (non-IT)
If your work VPN drops or your code platform goes into maintenance this weekend, this deadline round is the likely reason. The fixes close flaws that are already being exploited, so a short planned outage today is preferable to an unplanned one later. Reconnect through your normal channels once your IT team confirms the work is done.
Read the standalone brief
Cisco Talos analysis published October 28, 2026; coverage October 29, 2026
KeyDrift: Talos Details Malware That Lives Inside Cisco SD-WAN Controllers and Steals the Keys to the Network
Threats
Cisco Talos reported on October 28 that a sophisticated actor it tracks as UAT-11473 exploited CVE-2026-20127, a maximum severity authentication bypass in Cisco Catalyst SD-WAN Controller instances patched in February 2026, to install a custom malware framework named KeyDrift. Observed targets span space and satellite services, defense and aerospace technology, and policy research organizations. Talos assesses with high confidence that the framework is built for long-term persistent access and automated exfiltration of sensitive keying material: it operates inside SD-WAN control-plane processes, intercepts decrypted control traffic, and extracts control-session metadata and data-plane keying material for staging or transmission in encrypted records. Its primary component, PolyFlame, is a memory-resident module injected into legitimate vdaemon processes through modified runit service scripts, providing a TinyShell-styled backdoor with command execution and file read and write, and an intermediate command-and-control mode that relays tasking to other peers over the control plane itself rather than a conventional external beacon. A second component, LittleFilch, hooks SSL_read inside vdaemon, inspects decrypted control-session buffers for predefined edge nodes, extracts a 32-byte field Talos assesses as AES-256 IPsec data-plane key material, RSA-encrypts the records to a staging file, and can send them out over UDP in records resembling DTLS application data. Talos assesses with high confidence that UAT-11473 operating infrastructure overlaps considerably with Volt Typhoon Silent Train covert access network, while making no definitive identification of the two as the same actor. Talos published MITRE ATT&CK mappings, Snort coverage, and indicators, and directs organizations to the Cisco patches for CVE-2026-20127, the Catalyst SD-WAN hardening guide, and incident response with Cisco TAC support if post-compromise signs appear.
Executives
The asset under attack here is not a server, it is the trust fabric of the wide area network itself: the controllers that tell every site how to reach every other site, and the encryption keys that protect traffic between them. Malware that copies those keys from inside the controller can outlast a patch, because the patch closes the door while the copied keys remain valid. For any organization running Catalyst SD-WAN, the question for leadership is whether anyone has looked for this activity, not only whether the February fix was applied.
CIO / CISO
Confirm every controller, manager and validator runs a fixed release for CVE-2026-20127, then hunt rather than assume: Talos describes persistence through modified runit service launchers for sshd and aaamgr, an injector that loads the PolyFlame module into vdaemon, and a staging file at /var/tmp/vdaemon.bin, all of which can be checked against a known-good baseline. Because LittleFilch targets data-plane key material for selected edge nodes, plan key rotation for any controller where compromise is plausible, and engage Cisco TAC early, as Talos recommends, rather than rebuilding in isolation.
Engineers
Work from the Talos component table: check the runit run scripts under the sshd and aaamgr service paths for added lines that remount the writable overlay and launch background scripts, look for an ELF binary where the legitimate aaamgr component should be a Python package, and review vdaemon process modules for the injected libraries Talos names. Apply the published Snort signatures, SIDs 67387 through 67416 for the artifacts and 65938 and 65958 for the vulnerability, and preserve images of suspect controllers before remediation.
Everyone (non-IT)
There is no action for individual users in this report, and no sign in the Talos analysis that end user accounts or passwords were the target. If your IT team schedules SD-WAN controller maintenance or asks sites to accept a brief network interruption, this key protection work is the reason.
Read the standalone brief
Proof-of-concept published October 31, 2026; Google fix in October 2026 updates for Android 14 to 17
SMS of Death: A Public Exploit Crashes Android Phones With One Invisible Text, and Android 12 and 13 Have No Fix
Threats
A security researcher, Mark Blah, has released a proof-of-concept exploit for CVE-2026-58882, dubbed SMS of Death, a zero-click denial-of-service flaw in how Android handles WAP Push messages. The malformed message is only eight bytes, sent as a data SMS to port 2948, and the victim never sees it: Android processes it before it reaches the SMS inbox. The flaw is improper validation of a header-length value in the WapPushOverSms.decodeWapPdu function: a value that converts to a negative signed 32-bit integer makes Android attempt a memory allocation of that size, triggering an exception that crashes com.android.phone, the process that manages cellular connectivity. A single message drops ongoing calls, including calls to emergency services, while the process restarts. In the researcher testing, sending about 20 malicious messages could leave a phone stuck in reboot loops, and one Android 12 test device rebooted into recovery mode roughly every 90 seconds until it was factory reset. According to the researcher, Google patched the flaw in its October 2026 Android security updates for Android 14 through 17, although the flaw is not listed in the October security bulletin, and Android 12 and 13 devices did not receive the fix and remain vulnerable. Google fix catches the exception when processing malformed messages and deletes malicious messages from the SMS database so they cannot trigger repeated crashes. A contributor has documented a removal method using Android Debug Bridge for already affected devices, which requires a computer and technical knowledge. No theft of data or takeover of the phone is claimed: the demonstrated impact is loss of availability.
Executives
Availability attacks on personal devices become organizational problems when the device is the second factor, the on-call phone, or the only way to reach a staff member in an emergency. The uncomfortable fact in this disclosure is the support cliff: Android 14 to 17 received the fix in October, Android 12 and 13 did not, so the age of a handset now decides whether a single text can take it offline repeatedly. That is a device lifecycle question, and it belongs in the same review as laptop refresh cycles.
CIO / CISO
Inventory the Android estate by version, not by model: flag every Android 12 and 13 device with access to corporate mail, VPN or authenticator apps as unpatchable for this flaw and plan replacement or restriction. Confirm Android 14 to 17 devices are on the October 2026 security update or later, remembering that carrier and manufacturer timing varies and a restart may be needed to complete installation. Brief support staff on the symptom pattern, repeated phone process crashes or reboot loops after no visible message, so the first report is recognized rather than treated as a hardware failure.
Engineers
If a device is already looping, the documented recovery path is removal of the stored malicious messages with Android Debug Bridge, with factory reset as the fallback the researcher testing required on one device. On patched builds, verify the fix behavior: the update catches the processing exception and purges the malicious messages from the SMS database. Record affected device identifiers and carrier redelivery behavior in the incident notes, because carrier redelivery attempts can re-trigger crashes on unpatched builds.
Everyone (non-IT)
Check your Android version and install the latest security update if your phone runs Android 14 or newer. If your phone runs Android 12 or 13, it cannot be fixed for this flaw, so talk to your carrier or employer about a replacement, especially if the phone is your main line. The attack cannot steal your data or read your messages; it crashes the phone service, which is serious enough on its own if it interrupts an emergency call.
Read the standalone brief
Discussion draft released October 29, 2026; stakeholder feedback due December 1, 2026
PATIENT AI Act Discussion Draft Would Split Healthcare AI Oversight Between FDA and ONC and Order HIPAA Guidance for AI Use
AICompliance
Senator Bill Cassidy, chair of the Senate Health, Education, Labor and Pensions Committee, released a discussion draft of the PATIENT AI Act on October 29. The full name is the Protecting Americans Through Intelligent, Ethical, and Transparent Artificial Intelligence in Health Care Act. The draft proposes to clarify whether the FDA or the Office of the National Coordinator for Health Information Technology oversees healthcare AI tools: AI applications that do not qualify as FDA-regulated devices would be added to the definition of ONC certified health IT. The FDA would get a risk-based review process for software-based devices, including authority to accept premarket software changes and review updates on a rolling basis, and HHS would certify third-party bodies to review low to moderate risk software. The draft also applies existing federal preemption of state product liability laws to integrated and software-based devices. On payment, HHS would build a coverage evaluation framework for AI-based services, propose payment methodologies, establish a process to use Healthcare Common Procedure Coding System Level II codes for them, and the Center for Medicare and Medicaid Innovation would test a payment model for AI applications that deliver care autonomously. Two provisions speak directly to governance: HHS would issue HIPAA compliance guidance for AI use, and would commission a nonprofit to recommend approaches to AI liability. This is a discussion draft, not introduced legislation, and nothing in it binds any organization today. Senator Cassidy is accepting stakeholder feedback through December 1.
Executives
Healthcare AI adoption has been running ahead of a basic question: which regulator owns which tool. This draft is the clearest federal attempt so far to draw that line, device software toward the FDA, non-device applications toward ONC certification through the EHR channel, with a payment pathway attached so adoption and oversight arrive together. Because it is a discussion draft with a December 1 comment window, organizations with strong views on the HIPAA guidance or the liability study have a short, dated opportunity to shape both.
CIO / CISO
Map your current healthcare AI inventory against the draft two lanes now, while the mapping is cheap: which tools could be regulated devices, and which would land in certified health IT through your EHR vendor. Note where your HIPAA compliance story for AI use rests on your own interpretation today, because the draft promises HHS guidance that could confirm or unsettle it, and record that dependency in the AI governance register under the NIST AI RMF Govern function. If your organization comments, the HIPAA guidance scope and the liability recommendations are the two items with direct security and privacy consequences.
Engineers
Expect the practical effect, if this direction holds, to arrive through vendor paperwork: ONC certification criteria for non-device AI would reach most providers as EHR vendor documentation and transparency disclosures. Keep your own model and tool records in a form you can hand over, intended use, data flows involving protected health information, update cadence, and human review points, because both lanes of the draft assume that evidence exists.
Everyone (non-IT)
Nothing changes for patients or staff today: this is a draft released for comment, not a law. Its practical meaning is that the rules for how AI tools in healthcare are checked, paid for, and kept within HIPAA are being written now, and December 1 is the date by which hospitals, vendors and patient groups can send their views to the Senate committee.
Read the standalone brief
OpenAI Evals read-only October 31, 2026; Evals shutdown and Claude Sonnet 4.5 retirement November 30, 2026
Two November 30 Deadlines for AI Governance: OpenAI Evals Goes Read-Only and Claude Sonnet 4.5 Retires
AICompliance
Two vendor clocks that AI governance teams track reach the same date this month. OpenAI announced on June 3, 2026 that it is shutting down its Evals platform: existing evals became read-only on October 31, 2026, and the dashboard and API shut down entirely on November 30, 2026. Separately, Anthropic notified developers on September 30, 2026 that Claude Sonnet 4.5 is scheduled to retire on November 30, 2026, under its commitment to at least 60 days of notice before retiring a publicly released model. OpenAI notice periods are longer on paper, at least 6 months for generally available models and at least 3 months for specialized variants, with shorter periods possible where safety or compliance concerns require faster action. The operational risk sits in the overlap, as an analysis of model switching costs published this week spells out: a team that kept its test cases only inside the OpenAI Evals platform must migrate its testing setup at the same time as it may be forced to revalidate a workflow on a successor model, and the two migrations compound. A cheaper or newer model is a configuration change only in appearance; the real cost is revalidation, checking that a workflow still meets its agreed standard on the new model, with evidence that survives the switch: examples of acceptable and unacceptable work, the criteria used to judge them, the workflow configuration, and the results the current setup produces on those examples. Teams that hold that evidence in systems they control can re-run it on any successor; teams that held it only inside a retiring vendor platform start from reconstruction, under a deadline the vendor set.
Executives
Vendor retirement dates are governance dates. November 30 now carries two of them at once: the evaluation platform some teams use to prove their AI workflows work, and a widely used model those workflows may run on. The leadership question is narrow and answerable this week: for each production AI workflow, can a named owner show the test evidence, stored in our own systems, that would let us revalidate on a successor model inside a notice period. If the answer is no, that gap, not the model price list, is the real switching cost.
CIO / CISO
Export anything still held in OpenAI Evals before the November 30 shutdown, while the read-only window remains open, and store test cases with the workflow configuration and expected outputs in version control you own. Inventory workflows running on Claude Sonnet 4.5 and schedule revalidation against its successor with time to spare before the same date. Under the NIST AI RMF Measure and Manage functions, treat each forced migration as a recorded decision, owner, standard, evidence, and sign-off renewed, rather than a silent endpoint change.
Engineers
Run the evidence test now on one consequential workflow: gather five or more real past inputs with outputs you consider acceptable, plus any output you consider wrong, and record the results the current model produces on them today. That set becomes the regression pack for the successor model. When you switch, add a case for every new failure you discover, and keep inspecting production results for a period after deployment, because passing the existing cases does not prove the new model fails in no new ways.
Everyone (non-IT)
If an AI tool you use at work behaves slightly differently in December, a scheduled model retirement like this one is a common reason: vendors replace models on published dates, and responsible teams re-check their tools afterward. You do not need to do anything, but reporting a clear change in output quality to your IT or AI governance contact genuinely helps, because drift is easier to catch from real examples than from dashboards.
Read the standalone brief
KB5127936 preview update reported October 31, 2026; September 2026 updates caused the failures
Microsoft Fixes the Always On VPN Failures Its September Updates Caused, in the KB5127936 Preview for Windows 11
Threats
Microsoft has fixed the Always On VPN connection failures that its September 2026 security updates caused on Windows 11, according to the release notes of the KB5127936 preview update for Windows 11 versions 25H2 and 26H2. The failures hit systems where Always On VPN profiles used automatic protocol selection with IKEv2 and SSTP: affected connections could remain stuck in a Connecting state or fail after an initial attempt, and later attempts could display the error that the specified port is already in use. Microsoft first acknowledged the problem in a service alert to IT administrators in late September, then marked the issue as resolved in the October 2026 cumulative updates, then reopened it when the problem proved to still be present. The fix is available now to devices that install the optional October preview update; devices that skip the preview stay affected until the November Patch Tuesday cumulative updates. Organizations that cannot deploy the preview have a documented interim mitigation: change the Always On VPN profile from automatic protocol selection to a single protocol, SSTP only or IKEv2 only, chosen for the environment, and revert the profile once the fixed cumulative update is installed, since the mitigation removes the protocol fallback that automatic selection provides. KB5127936 also resolves a separate known issue in which non-admin users could not connect through Remote Desktop when the Administrator protection feature was enabled after the September preview update or later. Microsoft has not said whether the November cumulative release will include further changes to the VPN fix beyond what ships in KB5127936.
Executives
A broken always-on tunnel is a quiet productivity and security problem at once: staff who cannot connect either stop working or work around the managed connection. This episode also carries a process warning: the issue was marked resolved once, in the October cumulative updates, before being reopened, so a vendor resolved status is a claim to verify on a pilot group, not a closure. The choice this week is explicit: deploy the preview fix to affected devices now, or hold the single-protocol mitigation until the November cumulative update.
CIO / CISO
Scope by profile, not by fleet: the affected configuration is automatic protocol selection with IKEv2 and SSTP on Windows 11 25H2 and 26H2. Pilot KB5127936 on that group first and confirm connections succeed across an initial failure and retry, which is where the port-in-use error appeared. If you applied the single-protocol mitigation, record which devices carry it, because the fallback loss is a resilience change that should be reverted when the cumulative fix lands, and unattended mitigations have a habit of becoming permanent configuration.
Engineers
Reproduce before and after on one test device: automatic selection profile, a forced first-attempt failure, then a retry, checking that the connection completes rather than stalling in Connecting or reporting the port in use. Note the second fix in the same package, Remote Desktop connections for non-admin users under Administrator protection, when you write the change record, so helpdesk staff connect both symptom sets to the same update.
Everyone (non-IT)
If your work laptop VPN has been sticking on Connecting since September, this is the fix for that exact problem, arriving first as an optional preview update your IT team may push to you. Install it when offered and restart if asked. If your connection was switched to a single protocol as a workaround, nothing is wrong: that was the documented temporary measure, and it is reverted once the full fix is in.
Read the standalone brief
Monthly review published November 1, 2026, covering October 2026; counts attributed to the review author and the named sources
October by the Numbers: 17,060 New CVE Records, 36 KEV Additions, and One Theft Behind Almost All Crypto Losses
ThreatsCompliance
A monthly review published November 1 counts October 2026 as a record month on three separate ledgers that measure different things. On disclosure, by the review author count from the National Vulnerability Database API queried on November 1, 17,060 new CVE records were published in October, excluding rejected records, up from 4,273 in October 2025 and 3,564 in October 2024; including rejected records would raise the October figure to 17,481. The January to October total for 2026 stands at 89,859 records on the same count, against 39,639 in the same period of 2025. On confirmed exploitation, the increase is far smaller: CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, against 31 in October 2025 and 17 in October 2024, bringing the 2026 year-to-date total to 282 by October 30, already above the 245 additions for all of 2025. Five October KEV additions involved older flaws first published between 2015 and 2023. On losses, CertiK figures cited by the review put October crypto losses at $3.47 billion after frozen and returned funds, against $68 million in October 2025, with the Binance theft accounting for 96.7 percent of the October total. The review is explicit about what the numbers cannot prove: a CVE record documents a disclosed flaw, not an attack, the count depends on assignment and publication practices, and the AI-linked research it documents, including at least 65 Microsoft October entries crediting AI tools or firms by its count, does not establish that AI caused the wider increase. All headline figures in this story are the review author counts and the cited sources figures, presented as reported, not as independently verified totals.
Executives
Read the three ledgers separately, because they argue for different decisions. Disclosure quadrupled, which mostly measures how much is being found and published. Confirmed exploitation rose modestly, 36 KEV additions, and that short list is where patching urgency actually lives. Losses spiked because of one incident at one exchange, which is a concentration lesson, not a sector trend. A board that merges these into one scary number will misallocate the next quarter budget; a board that separates them knows to fund KEV-driven patching speed and vendor concentration review.
CIO / CISO
Use the ratio as a prioritization argument inside your own program: 36 exploited flaws against 17,060 disclosures is the standing case for KEV-first sequencing, with edge devices, remote access gateways and developer platforms at the front, which is where October additions clustered. Track your own mean time to remediate KEV items against their federal due dates as the metric that matters, and treat disclosure volume as a scanning and triage capacity question rather than a patching mandate.
Engineers
Expect scanner noise to keep rising with disclosure volume: deduplicate by product and exploitability, suppress records for components you do not run, and keep the KEV feed as a separate high-signal queue that bypasses normal scoring debates. The five October KEV additions for flaws published between 2015 and 2023 are a reminder to check legacy and embedded components, where old code survives inside current products.
Everyone (non-IT)
A record number of published flaws does not mean your own devices are suddenly less safe this week than last. The practical translation stays the same as every month: install updates when they are offered, especially for phones, browsers, VPN and remote access tools, and let the short exploited list, not the long disclosed list, decide what your IT team drops everything for.
Read the standalone brief