Red Hat

Community OKD documentation, not the OpenShift Container Platform product docs (not opened this run). Page is undated. Support statements may differ for the OpenShift 5 product.

Sponsored segment with vendor speakers. The SRE metric is anecdotal and comes from Red Hat's own managed service, not customers. Preview status relies on a third-party report.

Sponsored vendor interview. OpenShell maturity is preview, and identity features are forward-looking. The independent cross-check is from before this edition's window and is used only to confirm current support status.

One outlet's document review. The GA/preview split is second-hand from Virtualization Review (already archived), and the data-handling statements come from Lightspeed 1.0 docs, not OpenShift 5 docs. Secondary documents were not opened for this edition.

Vendor blog. Core agent features are developer preview without production support. GA timing is inconsistent across sources. The efficiency motivation relies on external studies, not Developer Hub measurements.

Vendor marketing. Agent Sandbox and ACS MCP are Technology Preview with limited support. The survey figure lacks a method, and the exploit-intelligence accuracy is unmeasured.

Vendor announcement; all capability and benefit language is vendor claim. Per-feature support status is not stated. No public-sector references or measured outcomes.

An advisory lists CVEs but does not by itself state exploitability in a given configuration. The cross-reference between advisory and CVE record was inconsistent at retrieval. I did not check NVD.

Gartner concerns are paraphrased by the reporter; the underlying report was not inspected. Executive quotes are vendor claims. Not SLED-specific.

Trade press summarizing vendor claims; RHEL releases planned for coming weeks; self-managed assistant is developer preview; business figures are vendor-reported.

Trade-press summary of vendor posts, not an independent evaluation; support-status details may differ by distribution (OKD docs label update assessments Technology Preview). No customer outcomes.

Undated living documentation; contents can change as fixes ship. Some items are from early-access builds (EA1/EA2) and may not apply to GA deployments. Vendor-reported; no independent validation or incident data. Severity and exploitability are not rated here.

Corporate journalism summarizing vendor initiative; quantitative 400+ figure originates in prior IBM/Red Hat announcement, not independently audited here. Broader IBM watsonx content remains out of stream scope—this item is included because Red Hat co-runs Lightwell. No measured SLED deployment metrics.

Trade press summary of vendor messaging. No independent evaluation. Partner-channel availability claims are unverified. Not evidence of a U.S. SLED deployment.

Vendor CNA assessment, not an independent exploit write-up. Packages remain Under investigation—no Red Hat errata at inspection time. CME mitigation block is AI-assisted courtesy guidance Red Hat says customers must evaluate themselves. Transferability depends on whether the estate uses multi-user shared pipelines.

Vendor assessment; Under investigation without errata. Does not claim cluster-admin escalation. Severity Moderate—pair with Important CVE-2026-88984 rather than treating alone as the headline.

Vendor-hosted event; Red Hat speakers have a commercial interest in open-weight self-hosting. Federal sample; no state/local data. No total-cost-of-ownership comparison, no accuracy evaluation, and the VA figures are self-reported by the operator. Event date is reported only as October 2026.

Trade reporting summarizing upstream release notes—not a benchmark or government evaluation. ODH timing ≠ supported OpenShift AI channel timing. No SLED customer outcomes measured.

Documentation review, not a live deployment test. Last checked 4 Nov—one day before this edition’s pipeline CVE wave, so those CVEs are not integrated into the check. Independent site; verify against current Red Hat release notes before contractual use.

Benchmarks are project/lab results on GB300/Rubin and AMD configurations; transferability to typical state/university GPU fleets is unproven. Moonshot/Kimi provenance and export-control review is out of scope of this post. Not a Red Hat product advisory.

Vendor self-assessment with terse advisories; the reason for the Critical rating is not stated. Package states were observed once (Nov. 3 evening CT) and may change. KEV does not say exploitation targeted AI platforms.

Vendor advisories are terse; no exploitation evidence found (no vLLM entries in CISA KEV as checked Nov. 4); package states observed once; severity differs between Red Hat and third-party scoring.

Vendor roadmap blog without dates, benchmarks or customer evidence; display date and metadata date differ; NIST deadlines are federal and not binding on SLED entities.

No Red Hat sizing or evaluation data; developer benchmarks unverified; legal effect of Entity List on model use is not addressed by any source opened; trade analysis is unbylined.

Vendor/partner blog, not a Red Hat advisory. Limited to IBM Cloud VPE. No measured security or performance outcome. Broader IBM watsonx platforms are out of scope except as adjacent hosting context.

Vendor self-benchmark; not peer reviewed or independently reproduced. Results depend on model, block size, concurrency and storage tail latency. CephFS used size-1 replication, so durability differs from production defaults. No energy or cost measurements. Not a SLED deployment.

Vendor self-assessment; fix states observed once (Nov. 2 to 3 UTC) and may change. CISA KEV does not say exploitation has targeted AI platforms. Red Hat release-note docs were still pending update. Severity labels differ by source: the Oct. 29 advisory is labeled Critical, while the Nov. 2 advisory and the CVE are Important.

Event recap built on a vendor executive's quotes and federal GAO data. No state, local or education speakers are quoted, and no measured AI outcomes are reported. Transferability to SLED is interpretive.

Vendor documentation, undated page; describes intended controls, not tested behavior; no independent security assessment of the MCP server was found.

The page is undated, so the publication date is unknown. It is an operator FAQ with no quantitative impact data. The Red Hat product role is inferred from listed services (OpenShift, RHOAI).