Noa Keller questions the claims around CVE-2026-56131, exploring the vague evidence and the implications of a reported vulnerability in libexpat.