Three Cyber Documents Circulating This Week Describe a War That Is Months Old

Cloudflare’s blog published “Shutdowns, power outages, and conflict: a review of Q1 2026 Internet disruptions” roughly six days ago, according to the search engine’s own age estimate. The publication date is recent; the data window is the first quarter of 2026, between three and six months behind the current fighting. The Times of Israel’s “Iranian cyberattacks on Israel surged in 2026, cyber chief says” carries an age estimate of about a month, and has already been carried onward into a second market by Pakistan’s Express Tribune. Palo Alto Networks' Unit 42 threat brief on Iranian cyber risk is marked “Updated April 17” — a living document that presents as current and is not. This desk has not opened any of the three. Their dates are what is being reported here, not their contents.

On Predatory Sparrow, the group whose Iranian infrastructure operations defined earlier rounds, the most recent material this desk located is Picus Security’s analysis of 6 April 2026 and Joe Slowik’s “Predatory Sparrow, Out In The Cold?” at Pylos, dated 25 May 2026. Nothing newer surfaced. The Pylos headline implies a lull rather than proving one, and a two-month-old question mark is not evidence of either resumption or dormancy. Whether the group has been active during the current war is, on the record available to this desk today, unknown. The same applies to Iranian connectivity: a Wikipedia entry exists for a 2026 internet blackout in Iran, and whether it is ongoing, partial or lifted requires live NetBlocks, IODA or Cloudflare Radar data that this desk did not query.

Assessment: The pattern to watch is not any single stale page but the mechanism: cyber coverage travels without its dateline. A vendor retrospective, an official’s percentage and an “updated” threat brief are the three shapes that most reliably reappear as this morning’s news, and the Express Tribune pickup shows the second hop already happening. When a figure crosses into a new market it usually loses its original date. The corrective is unglamorous — demand the date of the measurement, not the date of the post. Readers who saw a cyber statistic this week should assume it is a quarter old until the publisher says otherwise.