Keith, the No 10 North Cat | Parody

6 Sept

1/6 𝗦𝗧𝗔𝗥𝗧 𝗛𝗘𝗥𝗘 🐾 Keith is the ginger Persian Chief Mouser at Gothic No 10 North, Manchester. He examines government, democracy, security, law, science, and institutional absurdity in an evidence-first Senior Civil Service voice. The Office is fictional. The evidence is not. #BlepOfOffice

1/10 📑 𝗔𝗗𝗠𝗜𝗡𝗜𝗦𝗧𝗥𝗔𝗧𝗜𝗩𝗘 𝗔𝗦𝗦𝗘𝗦𝗦𝗠𝗘𝗡𝗧 𝗧𝗘𝗟𝗙𝗢𝗥𝗗 𝗚𝗨𝗡 𝗛𝗔𝗟𝗟 𝗙𝗜𝗡𝗗𝗜𝗡𝗚: Britain is making large-calibre gun barrels again. That is delivery worth crediting. A factory opening is a milestone. Replenishment is a service.

gov.ukNext-generation remote controlled artillery systems to transform British ArmyBritish soldiers will be equipped with modern guns capable of firing eight rounds per minute at targets up to 70km away – delivering the long-term close support artillery solution for the British Army...

9/10 𝗦𝗢𝗨𝗥𝗖𝗘𝗦/𝗦𝗔𝗨𝗖𝗘𝗦 𝗜𝗜𝗜 🐾 MOD: 72 RCH 155 systems ordered; Telford to manufacture weapon components; British steel intended; first deliveries expected in 2028. www.gov.uk/government/n...

10/10 𝗨𝗡𝗥𝗢𝗟𝗟 🐾 @unroll.skywriter.blue

gov.ukBritish jobs boost as tank barrel production returns to the UK for first time in 20 yearsRheinmetall UK's Telford gun hall begins production, creating 100 skilled jobs and returning large-calibre weapon manufacturing to UK soil for the first time in decades.

7/10 𝗘𝗩𝗜𝗗𝗘𝗡𝗧𝗜𝗔𝗟 𝗔𝗡𝗡𝗘𝗫 𝗦𝗢𝗨𝗥𝗖𝗘𝗦/𝗦𝗔𝗨𝗖𝗘𝗦 𝗜 🐾 MOD: production started, large-calibre manufacture returned, UK workers trained, and 100 skilled jobs supported. www.gov.uk/government/n...

rheinmetall.comRheinmetall opens the UK Gun Hall in TelfordRheinmetall officially opened the new ‘UK Gun Hall’ in Telford, thereby marking the return of independent production of large-calibre weapons to the UK.

8/10 𝗦𝗢𝗨𝗥𝗖𝗘𝗦/𝗦𝗔𝗨𝗖𝗘𝗦 𝗜𝗜 🐾 Rheinmetall: production dates, present staffing, planned workforce, stated peak capacity, and intended British-steel supply. www.rheinmetall.com/en/media/new...

5/10 𝗧𝗛𝗘 𝗔𝗦𝗦𝗨𝗥𝗔𝗡𝗖𝗘 𝗧𝗘𝗦𝗧 Publish the funded production profile: firm orders, qualified steel, trained shifts, proof and test capacity, machine maintenance, spares, supplier recovery, and surge assumptions. Installed capacity is not assured output until every dependency can sustain it.

6/10 𝗖𝗢𝗡𝗖𝗟𝗨𝗦𝗜𝗢𝗡 Credit where due: plant, people, training, and initial production now exist. Next, evidence the rate that can be sustained, for how long, and under which constraints. No 10 North welcomes the barrel. The Blep requests the production schedule. 🐾 #No10Keith

3/10 𝗧𝗛𝗘 𝗖𝗔𝗣𝗔𝗖𝗜𝗧𝗬 Rheinmetall states that peak capacity is up to 245 barrels and more than 50 breeches a year. It currently employs 35 people in the gun hall and expects more than 100 as production develops. Those are company statements, not yet evidenced annual output.

4/10 𝗪𝗛𝗬 𝗜𝗧 𝗠𝗔𝗧𝗧𝗘𝗥𝗦 The UK had lacked domestic large-calibre gun manufacturing for two decades. The Telford line is intended to support Challenger 3, future artillery, and 72 ordered RCH 155 howitzers. Sovereign machinery reduces one dependency. It does not remove the rest.

2/10 𝗪𝗛𝗔𝗧 𝗪𝗔𝗦 𝗗𝗘𝗟𝗜𝗩𝗘𝗥𝗘𝗗 Rheinmetall says an empty Telford facility became operational in eight months. Breech production began in May, and barrel production in June. The hall can manufacture 120mm and 155mm systems. British staff received specialist training in Germany.

1/11 📑 𝗔𝗗𝗠𝗜𝗡𝗜𝗦𝗧𝗥𝗔𝗧𝗜𝗩𝗘 𝗔𝗦𝗦𝗘𝗦𝗦𝗠𝗘𝗡𝗧: 𝗣𝗛𝗣 𝗙𝗜𝗡𝗗𝗜𝗡𝗚: Taking a vulnerable public service offline may be competent defence. Doing so without an alternative route, deadline policy, user mitigation and named owner is not resilience. It is a secure server and an abandoned public.

thephp.foundationToday's PHP Security Release, and How We're Strengthening PHP SecurityDescribing the story behind how critical security vulnerabilities were found and fixed.

10/11 𝗦𝗢𝗨𝗥𝗖𝗘𝗦/𝗦𝗔𝗨𝗖𝗘𝗦 𝗜𝗜𝗜 🐾 PHP Foundation calls the delay a “structural failure” involving decision process and limited resources. Faster discovery still needs skilled humans and authority. thephp.foundation/blog/2026/10...

11/11 𝗨𝗡𝗥𝗢𝗟𝗟 🐾 @unroll.skywriter.blue

ncsc.gov.ukCritical security issue affecting PHPUpdated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

8/11 𝗘𝗩𝗜𝗗𝗘𝗡𝗧𝗜𝗔𝗟 𝗔𝗡𝗡𝗘𝗫 𝗦𝗢𝗨𝗥𝗖𝗘𝗦/𝗦𝗔𝗨𝗖𝗘𝗦 𝗜 🐾 NCSC: identify affected systems, patch them, use temporary mitigations where necessary and consider taking systems offline if neither can be done promptly. www.ncsc.gov.uk/news/critica...

hansard.parliament.ukCyber Security: PHP Vulnerability - Hansard - UK ParliamentHansard record of the item : 'Cyber Security: PHP Vulnerability' on Thursday 22 October 2026.

9 of 11 𝗦𝗢𝗨𝗥𝗖𝗘𝗦/𝗦𝗔𝗨𝗖𝗘𝗦 𝗜𝗜 🐾 Lords record: 32 services unavailable, four partly. No confirmed central government compromise was known. A question about remedies received a restoration update. hansard.parliament.uk/Lords/2026-1...

6/11 𝗧𝗛𝗘 𝗣𝗟𝗔𝗡 Name the service owner, technical owner, isolation trigger, safe degradation, alternative public route, evidence to preserve, communications, restoration criteria, and decision authority. The Blep may sit on the plan until each owner signs it. The Blep may not accept residual risk.

7/11 𝗨𝗦𝗘𝗥 𝗖𝗢𝗡𝗧𝗜𝗡𝗨𝗜𝗧𝗬 Assess in advance what shutdown does to deadlines, payments, appointments, legal rights, accessibility and emergency access. For each, pre-agree mitigation, decision-maker, funding and public message. Patch the component. Protect the person.

4/11 𝗧𝗛𝗘 𝗚𝗔𝗣 Lord Bellingham asked about the impact of delays and remedies for members of the public who suffered consequences. The answer described restoration. It did not say how missed deadlines, disrupted appointments or consequential costs would be handled.

5/11 𝗥𝗘𝗤𝗨𝗜𝗥𝗘𝗗 𝗖𝗢𝗡𝗧𝗥𝗢𝗟 Every software component in an online public service should have a written critical-flaw plan, proportionate to dependency and impact, covering flaws that cannot immediately be resolved. If written after disclosure, it is incident improvisation with a template.

2/11 𝗪𝗛𝗔𝗧 𝗪𝗘𝗡𝗧 𝗥𝗜𝗚𝗛𝗧 Departments were warned before public disclosure. Government established a cross-government response. NCSC coordinated with vendors and issued 50,000 proactive notifications. That is competent preparation and should be recognised as such.

3/11 𝗪𝗛𝗔𝗧 𝗛𝗔𝗣𝗣𝗘𝗡𝗘𝗗 At the Lords statement, 32 government services were unavailable and four partially unavailable, largely through precautionary action. No confirmed central government compromise was known then. Security action can be correct. Availability remains a security property.

1/19 📑 𝗔𝗗𝗠𝗜𝗡𝗜𝗦𝗧𝗥𝗔𝗧𝗜𝗩𝗘 𝗔𝗦𝗦𝗘𝗦𝗦𝗠𝗘𝗡𝗧 𝗚𝗢𝗢𝗚𝗟𝗘 𝗖𝗟𝗢𝗨𝗗: 𝗧𝗛𝗘 𝗗𝗘𝗣𝗘𝗡𝗗𝗘𝗡𝗖𝗬 𝗪𝗔𝗦 𝗡𝗔𝗧𝗜𝗢𝗡𝗔𝗟 𝗙𝗜𝗡𝗗𝗜𝗡𝗚: A London cloud outage disrupted banking and court video services. Critical infrastructure needs evidence that essential services survive a failure. Not merely confidence that a large supplier rarely has one.

theguardian.com‘Too big to not fail’: Google outage exposes UK reliance on a handful of cloud providersOur dependence on internet services of a few key tech companies leaves us vulnerable to cloud failures, bugs and more, experts say

18/19 𝗦𝗢𝗨𝗥𝗖𝗘𝗦 / 𝗦𝗔𝗨𝗖𝗘𝗦 🐾 VI Reporting on disruption to banking and court video services. www.theguardian.com/uk-news/2026...

19/19 @unroll.skywriter.blue

docs.cloud.google.comDesign reliable infrastructure for your workloads in Google Cloud | Cloud Architecture Center | Google Cloud DocumentationProvides architectural recommendations to design reliable infrastructure for your cloud workloads.

16/19 𝗦𝗢𝗨𝗥𝗖𝗘𝗦 / 𝗦𝗔𝗨𝗖𝗘𝗦 🐾 IV Google’s reliability guidance: single points of failure, multi-zone and multi-region designs, and capacity planning. docs.cloud.google.com/architecture...

docs.cloud.google.comPerform testing for recovery from failures | Cloud Architecture Center | Google Cloud DocumentationWell-Architected Framework reliability principle about testing for recovery from failures.

17/19 𝗦𝗢𝗨𝗥𝗖𝗘𝗦 / 𝗦𝗔𝗨𝗖𝗘𝗦 🐾 V Google’s recovery-testing guidance: regional failover, backup restoration, realistic load, and recovery objectives. docs.cloud.google.com/architecture...

committees.parliament.ukcommittees.parliament.uk

14/19 𝗦𝗢𝗨𝗥𝗖𝗘𝗦 / 𝗦𝗔𝗨𝗖𝗘𝗦 🐾 II Treasury Committee letter, 20 October: designation, notification, affected firms, regulatory response, and lessons. committees.parliament.uk/publications...

fca.org.ukCritical Third Parties: Strengthening UK Financial ServicesRegulators jointly oversee services provided by designated critical third parties (CTPs) to reduce systemic risks to the UK Financial System.

15/19 𝗦𝗢𝗨𝗥𝗖𝗘𝗦 / 𝗦𝗔𝗨𝗖𝗘𝗦 🐾 III FCA: Critical Third Party oversight complements firms’ continuing responsibility for managing supplier risk. www.fca.org.uk/firms/critic...

12/19 𝗖𝗢𝗡𝗖𝗟𝗨𝗦𝗜𝗢𝗡 Require an evidenced account: what failed, what still worked, who was harmed, and which fixes have owners, funding, and deadlines. Test continuity and the longer-term exit route. The supplier may own the servers. The service owner still owns the consequences. 🐾 #No10Keith

status.cloud.google.comIncident details | Google Cloud Service Health

13/19 𝗦𝗢𝗨𝗥𝗖𝗘𝗦 / 𝗦𝗔𝗨𝗖𝗘𝗦 🐾 I Google’s incident record: power event, zone unavailability, wider errors, recovery updates, and promised analysis. status.cloud.google.com/incidents/Xs...

10/19 𝗖𝗢𝗡𝗖𝗘𝗡𝗧𝗥𝗔𝗧𝗜𝗢𝗡 𝗛𝗜𝗗𝗘𝗦 Different suppliers may depend on the same cloud underneath. Map the chain beyond the contract. A second cloud can reduce some shared risks and introduce others. Test its independence, capacity, and operability. Two invoices are not evidence of two escape routes.

11/19 𝗔 𝗚𝗥𝗘𝗘𝗡 𝗗𝗔𝗦𝗛𝗕𝗢𝗔𝗥𝗗 𝗜𝗦 𝗡𝗢𝗧 𝗧𝗛𝗘 𝗘𝗡𝗗 After infrastructure returns, reconcile transactions, clear queues, restore missed appointments, and support affected users. The Treasury Committee has asked regulators for the incident timeline and lessons. Measure recovery through to the customer.

8/19 𝗠𝗘𝗔𝗦𝗨𝗥𝗘 𝗧𝗛𝗘 𝗦𝗘𝗥𝗩𝗜𝗖𝗘 Define the maximum tolerable disruption, minimum usable capacity, and acceptable data loss. Can people pay? Can urgent hearings proceed? Can staff prioritise safely? A supplier’s availability percentage cannot answer those questions for the service owner.

9/19 𝗧𝗘𝗦𝗧 𝗧𝗛𝗘 𝗘𝗦𝗖𝗔𝗣𝗘 𝗥𝗢𝗨𝗧𝗘 Exercise zone loss, regional loss, and unavailable management tools under realistic load. Time detection, authority to switch, recovery, and safe return. Verify data integrity. Google recommends recovery testing. A successful backup is not a successful restore.

6/19 𝗙𝗢𝗟𝗟𝗢𝗪 𝗧𝗛𝗘 𝗗𝗘𝗣𝗘𝗡𝗗𝗘𝗡𝗖𝗜𝗘𝗦 Check databases, identity, keys, networks, name resolution, and management tools. Can the recovery team act when the failed service is unavailable? Two application servers are little comfort if both require the same unavailable database or login.

7/19 𝗥𝗘𝗖𝗢𝗩𝗘𝗥𝗬 𝗠𝗨𝗦𝗧 𝗕𝗘 𝗣𝗘𝗥𝗠𝗜𝗧𝗧𝗘𝗗 A recovery location needs usable capacity, current data, working connections, and authority to operate. Resolve data-location and security requirements before the incident. An overseas fallback that is forbidden by policy is a problem, not a recovery plan.

4/19 𝗥𝗘𝗚𝗨𝗟𝗔𝗧𝗜𝗢𝗡 𝗜𝗦 𝗡𝗢𝗧 𝗥𝗘𝗗𝗨𝗡𝗗𝗔𝗡𝗖𝗬 Google Cloud EMEA became a designated Critical Third Party on 13 July. That brings financial-sector oversight. It does not certify every customer’s recovery design. The FCA is explicit: firms retain responsibility for their own third-party risks.

5/19 𝗔 𝗭𝗢𝗡𝗘 𝗜𝗦 𝗡𝗢𝗧 𝗔 𝗥𝗘𝗚𝗜𝗢𝗡 Google supports designs spanning multiple zones within a region. Losing one zone need not mean losing the service. Losing a region is a different scenario. A second copy in the same failure domain is duplication with matching exposure.

2/19 𝗪𝗛𝗔𝗧 𝗙𝗔𝗜𝗟𝗘𝗗 Google reports a power event in europe-west2-b on 20 October, with unavailability in that zone and errors affecting some services across the London region. Its recorded incident lasted 7h 52m. The closing update still noted a small number of affected customers.

3/19 𝗪𝗛𝗔𝗧 𝗥𝗘𝗠𝗔𝗜𝗡𝗦 𝗨𝗡𝗞𝗡𝗢𝗪𝗡 Google has promised an incident analysis. A “power event” does not explain which protection failed or why disruption spread. Nor does an affected bank’s outage prove it used only one zone. Demand the failure chain. Do not invent the architecture.

1/4 📕 𝗡𝗢 𝟭𝟬 𝗡𝗢𝗥𝗧𝗛: 𝗪𝗘𝗘𝗞𝗟𝗬 𝗥𝗘𝗗 𝗕𝗢𝗫 19 OCTOBER 2026 Three published findings: • Russia changed delivery mechanism, not tasking • NHS ward policy exports risk to the bedside • A leap-second problem became an unowned leap-hour liability No padding. The Blep notes restraint. 🐾

4/4 𝗜𝗜𝗜. 𝗧𝗛𝗘 𝗟𝗘𝗔𝗣 𝗛𝗢𝗨𝗥 Ending leap seconds resolves a real software problem by permitting UTC to drift by up to an hour. The second is managed. The hour is bequeathed. 𝗦𝗢𝗨𝗥𝗖𝗘𝗦 / 𝗦𝗔𝗨𝗖𝗘𝗦 🐾 bsky.app/profile/no-1... #No10Keith

Keith, the No 10 North Cat | Parody@no-10-north.uk

1/11 📑 𝗔𝗗𝗠𝗜𝗡𝗜𝗦𝗧𝗥𝗔𝗧𝗜𝗩𝗘 𝗔𝗦𝗦𝗘𝗦𝗦𝗠𝗘𝗡𝗧: 𝗧𝗛𝗘 𝗟𝗘𝗔𝗣 𝗛𝗢𝗨𝗥 𝗙𝗜𝗡𝗗𝗜𝗡𝗚: The leap second exposed bad software. The approved cure lets the discrepancy compound to one hour, then leaves a future civilisation to decide what happens next. A control failure has become a legacy programme.

@unroll.skywriter.blue

bbc.co.ukMI5 tackling more state threats than during Cold War, warns intelligence chiefSir Ken McCallum says operations to tackle terrorism and state threats are now roughly of an "equal scale".

2/4 𝗜. 𝗥𝗨𝗦𝗦𝗜𝗔𝗡 𝗣𝗥𝗢𝗫𝗜𝗘𝗦 Allied expulsions damaged Russia’s covert footprint. Moscow adapted with criminals and disposable proxies. The personnel changed. The tasking did not. 𝗦𝗢𝗨𝗥𝗖𝗘𝗦 / 𝗦𝗔𝗨𝗖𝗘𝗦 🐾 bsky.app/profile/no-1...

Keith, the No 10 North Cat | Parody@no-10-north.uk

1/7 📑 𝗔𝗗𝗠𝗜𝗡𝗜𝗦𝗧𝗥𝗔𝗧𝗜𝗩𝗘 𝗔𝗦𝗦𝗘𝗦𝗦𝗠𝗘𝗡𝗧 𝗙𝗜𝗡𝗗𝗜𝗡𝗚: Allied expulsions eviscerated Russia’s covert footprint. Moscow’s use of criminals demonstrates weakness, but the requirement remains. The personnel changed. The tasking did not. www.bbc.co.uk/news/article...