11 verified findings from 1 run · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01GhostLock (CVE-2026-43499): 15-year-old Linux rtmutex UAF gets a public 97%-reliable root + container-escape exploit. GhostLock is a use-after-free in the Linux kernel's rtmutex priority-inheritance code, present since 2.6.39 (2011) and reachable on any kernel built with the default CONFIG_FUTEX_PI. Nebula Security published a working exploit on 7 July achieving root in ~5 seconds at 97% reliability and escaping containers to the host. Fixed upstream in April 2026 — confirm the running kernel carries the fix, not just "a recent kernel." →
02Langflow IDOR (CVE-2026-55255) hits KEV; Sysdig shows one operator chaining it with the RCE CVE-2026-33017. CVE-2026-55255 is an IDOR in Langflow's OpenAI-responses endpoint that lets any authenticated caller run another tenant's flow — and any credentials embedded in it. CISA added it to KEV on 7 July; Sysdig observed a single operator chaining it with the already-KEV'd unauthenticated RCE CVE-2026-33017. Any self-hosted Langflow below 1.9.1, especially multi-tenant, must patch now. →
03Adobe ColdFusion path-traversal RCE (CVE-2026-48282) goes from patched-no-exploitation to KEV within a week. CVE-2026-48282, one of the six CVSS 10.0 unauthenticated ColdFusion RCE flaws Adobe patched on 1 July, is now confirmed exploited in the wild and was added to CISA KEV on 7 July. Any internet-facing ColdFusion 2025.9 / 2023.20-or-earlier instance not yet on the 1 July fix should be treated as under active attack, not merely at risk. →
04NCSC-CH flags critical pre-auth bypass in BeyondTrust RS/PRA appliances (CVE-2026-40138/-40139). BeyondTrust advisory BT26-03, flagged by NCSC-CH on 7 July, discloses four flaws in Remote Support and Privileged Remote Access appliances, including two critical pre-authentication bypasses (CVE-2026-40138/-40139) that yield administrative appliance access. Affected RS/PRA ≤ 25.3.2, fixed in 25.3.3; no confirmed exploitation yet, but the product family has a documented history of exploitation to deploy web shells and backdoors. →
Unit 42 documented a financially motivated malvertising campaign, active since April 2026, distributing Vidar stealer and the XMRig cryptominer via loaders built with "Factory-v3", a malware-as-a-service Go loader-builder (Unit 42, 2026-07-07). Victims are lured to password-protected archives masquerading as cracked software; the Go loaders (43 samples, 27 unique build UUIDs — defeating hash-based detection) are signed with fraudulent Authenticode certificates impersonating real companies (JustWatch GmbH, later BleacherReport) (T1553.002), strip PE metadata, and DLL-sideload via a fake MpClient.dll export that hijacks Windows Defender's DLL search order to execute as NisSrv.exe from AppData (T1574.002). Before dropping the payload the loader patches AMSI in memory — resolving AmsiScanBuffer and overwriting its first six bytes to force an E_INVALIDARG return (T1562.001). The standout evasion is "file inflation": appending hundreds of megabytes of null bytes to push loader size to as high as 491 MB, exceeding the 50–100 MB detonation limits of many automated sandboxes. Persistence uses Run keys, scheduled tasks and startup-folder scripts, and each victim is fingerprinted via an 8-character HWID; the operator monitors yield through a Telegram channel branded "X3D MINER".
Loaders in Clusters A and C append hundreds of megabytes of null bytes after the last PE section, pushing the total file size to as high as 491 MB
The builder generates a unique binary per build. For example, we observed 27 unique build UUIDs across 43 samples, defeating hash-based detection
Accenture confirmed on 7 July 2026 that it suffered a data-theft incident after a threat actor using the handle "888" began advertising roughly 35 GB of internal data for sale on a cybercrime forum (BleepingComputer, 2026-07-07). Per the actor's own screenshots, the theft artefact shown is a request against a dev.azure.com endpoint followed by a git-clone of a private Azure DevOps repository named "121123_AtriasTalentAcademy" — an internal training/talent-academy project rather than confirmed client-delivery code — and the initial-access vector into that DevOps organisation has not been disclosed (teiss, 2026-07-08). The claimed dataset spans source code, RSA and SSH keys, Azure Personal Access Tokens and storage access keys — credential classes that, if valid and unrotated, chain into further Azure tenant / CI-CD compromise (T1078.004) or into downstream vulnerability discovery via the stolen source (T1213.003, T1552.001). Accenture's on-record statement confirms an incident but does not corroborate the actor's claimed scope, and SOCRadar explicitly flags that dataset authenticity, the 35 GB figure and key validity all remain unconfirmed (SOCRadar, 2026-07-08); "888" has a documented history of scope inflation (its June 2024 Accenture claim of 32,826 employee records proved to contain only three genuine ones) (Help Net Security, 2026-07-08).
We are aware of this isolated matter, and we have remediated its source. There is no impact to Accenture operations and service delivery.
Accenture spokesperson, via BleepingComputer
Several important details remain unclear: Whether the full advertised dataset is authentic, Whether the 35GB figure is accurate, Whether the alleged data is current, Whether any keys, tokens, or credentials are still valid.
LevelBlue SpiderLabs documented a multi-stage infection chain delivering CrySome RAT — a modular .NET remote-access trojan the lab notes has been covered in prior public reporting — through spear-phishing emails impersonating freight-rate confirmations (LevelBlue SpiderLabs, 2026-07-06). Victims reach a fake portal hosting a batch-file downloader that launches PowerShell with an AMSI bypass (T1059.001, T1562.001) to fetch a stage-1 binary, which performs a UAC bypass via the ICMLuaUtil COM interface (T1548.002). Stage 2 adds Microsoft Defender exclusions and drops WinDefCtl — an open-source Defender-disruption utility masquerading as svchost.exe from %TEMP% — to disable real-time protection before launching the RAT. Persistence is a scheduled task ("CrysomeLoader") re-firing every five minutes (T1053.005); the RAT provides hidden VNC, arbitrary command execution and Chromium-browser credential theft, defeating Chrome's App-Bound Encryption via a decryptor DLL (T1555.003).
By combining an AMSI bypass, an open-source Defender tampering utility, and the modular CrySome RAT client, the operators minimize custom development while still achieving privilege escalation, defense evasion, persistence, credential theft, and remote access.
The actor then targeted host defenses by executing WinDefCtl, an open-source Defender disruption utility, masquerading as svchost.exe from %TEMP%.
Cisco Talos profiled UAT-7810, a China-nexus actor Talos assesses with high confidence is tasked with building and maintaining Operational Relay Box (ORB) networks — relay/proxy infrastructure built from compromised networking gear that secondary China-nexus APTs use to launder the origin of operations against high-value targets (Cisco Talos, 2026-07-07). Talos names UAT-5918 — previously documented targeting Taiwanese critical infrastructure — as one such downstream consumer. Initial access is exploitation of known, unpatched vulnerabilities in Ruckus wireless routers (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717) and ASUS AiCloud routers (CVE-2025-2492), a tactic UAT-7810 has used since 2025 rather than a fresh zero-day (T1190). The malware suite, internally "ff-agent", now includes LONGLEASH — an enhanced successor to the SHORTLEASH backdoor adding reverse-shell and HTTP/DNS/SOCKS/TCP/ICMP/UDP multi-protocol proxying (T1090.003) — plus DOGLEASH, a passive C-based Linux backdoor, and JARLEASH, a Java-based admin tool for file management and FTP/SFTP access; it is built with Boost.Asio, custom protobuf encoding and MbedTLS TLS proxying, compiled for MIPS/ARM/x64, and self-deletes if tampering or a suspicious connection is detected (T1070).
Talos assesses with high confidence that UAT-7810 is a China-nexus threat actor based on the infrastructure that it provides to secondary China-nexus APTs such as UAT-5918.
Talos has observed UAT-7810 primarily exploit known vulnerabilities in unpatched Ruckus wireless routers, a tactic UAT-7810 has used since 2025.
NCSC-CH's Cyber Security Hub (GovCERT.ch, TLP:CLEAR) flagged BeyondTrust's 7 July 2026 advisory BT26-03 covering four vulnerabilities in Remote Support (RS) and Privileged Remote Access (PRA) appliances — the vendor's remote-support/PAM software used by IT service desks including government administrations (NCSC-CH, 2026-07-07). CVE-2026-40138 and CVE-2026-40139 (both CVSS 4.0 9.2, CRITICAL) sit in the shared authentication subsystem: CVE-2026-40138 stems from improper validation of authentication data and CVE-2026-40139 from improper processing of authentication requests, both letting a network-positioned unauthenticated attacker bypass access controls and obtain administrative access — but only where a specific, non-default authentication configuration (unspecified by the vendor) is enabled. CVE-2026-40140 is an unauthenticated DoS in the network-communication subsystem, and CVE-2026-40141 lets a low-privilege authenticated user reach resources beyond their authorization scope. Affected versions are RS/PRA 25.3.2 and earlier, fixed in 25.3.3; BeyondTrust cloud-hosted customers were already patched on 21 April 2026, so self-hosted customers not on auto-update must apply the April security rollup (BleepingComputer, 2026-07-07). Neither BeyondTrust nor NCSC-CH reports confirmed in-the-wild exploitation or a public PoC as of this run.
Successful exploitation allows unauthenticated attackers to bypass access controls and gain administrative access.
Exploitation of the critical authentication bypasses requires specific, non-default authentication configurations, which have not been made public, to be enabled on the target appliance.
NCSC-NL published advisory NCSC-2026-0221 on 7 July 2026 covering Ubiquiti's Security Advisory Bulletin 066 (vendor-published 2026-07-02): 25 vulnerabilities spanning the UniFi Connect, Talk, Access, Network and Protect applications plus the UniFi OS platform itself across the Dream Machine / Cloud Gateway / Cloud Key / Network-Video-Recorder / Enterprise-Fortress-Gateway hardware families (NCSC-NL, 2026-07-07). This is a distinct, larger disclosure from the CVE-2026-34908/-34909/-34910 UniFi OS chain covered on 2026-06-24 — different CVEs, broader scope. The most severe, CVE-2026-50746 (CVSS 10.0), is an improper-access-control flaw in UniFi Connect (< 3.4.20) letting a network-adjacent unauthenticated attacker execute OS command injection on the host device; CVE-2026-50747 (CVSS 9.9, authenticated SQLi in Talk), CVE-2026-50748 (CVSS 9.9, command injection in Access), CVE-2026-54402 (CVSS 9.9, command injection in UniFi OS) and CVE-2026-55115 (CVSS 9.9, SSRF in Protect) round out the critical set, and CVE-2026-54403 (CVSS 8.6, path traversal in UniFi OS) bypasses authentication outright and is explicitly flagged by Ubiquiti as chainable to drop the low-privilege prerequisite of the others. SOCRadar confirms no functional public PoC and no confirmed in-the-wild exploitation as of 2026-07-08 (SOCRadar, 2026-07-08).
CVE-2026-55255 is an insecure-direct-object-reference flaw (CWE-639) in Langflow's OpenAI-Responses-compatible endpoint POST /api/v1/responses: the helper get_flow_by_id_or_endpoint_name (helpers/flow.py) resolves a flow by UUID with no user_id ownership check, so any authenticated caller who obtains another user's flow UUID can execute that user's flow — including whatever LLM-provider or cloud credentials are embedded in it (Sysdig, 2026-06-26). NVD scores it 8.4; the GitHub Security Advisory (GHSA-qrpv-q767-xqq2) and Sysdig rate the scope-changed vector at 9.9. Sysdig's Threat Research Team observed a single financially-motivated operator on 25 June 2026 run a scripted playbook against one exposed instance — enumerate flow UUIDs via GET /api/v1/flows/, then the IDOR with an input resembling a prompt-injection string — followed by repeated waves of the already-KEV-listed unauthenticated RCE CVE-2026-33017 (build_public_tmp) to plant a loader. CISA added CVE-2026-55255 to KEV on 7 July 2026 (BleepingComputer, 2026-07-08). Sysdig's load-bearing lesson is that the lower-scoring RCE dominated actual attacker effort because it needs no valid flow ID and is a strict superset of the IDOR on a single-tenant deployment; the IDOR matters distinctly only on multi-tenant/managed Langflow, where it crosses the tenant boundary at the application layer with no sandbox escape.
On June 25, 2026, the Sysdig Threat Research Team (TRT) observed the first known active exploitation of a CVSS 9.9 "critical" Langflow vulnerability, tracked as CVE-2026-55255.
When a flow is resolved by UUID, the lookup queries the database with no user_id ownership check, so any authenticated caller can execute any user's flow by passing its UUID.
CISA published ICS advisory ICSA-26-188-01 for the backend of Hydro-Québec's "Le Circuit Électrique" EV-charging network, disclosing three flaws reported by an anonymous researcher (CISA, 2026-07-07). The headline flaw, CVE-2026-20744 (CVSS v3.1 9.8, CWE-284 Improper Access Control), is in the charging-station WebSocket endpoint that speaks OCPP (Open Charge Point Protocol, the industry-standard charge-point-to-backend management protocol): the endpoint accepts connections with no authentication, letting a remote unauthenticated actor escalate privileges against the backend (T1190). Two companion flaws compound the exposure — CVE-2026-42952 (CVSS 7.5, CWE-307, no throttling on repeated authentication attempts → brute-force/DoS) and CVE-2026-44383 (CVSS 7.5, CWE-613, the backend allows multiple simultaneous connections under the same charging-station identifier, enabling session-exhaustion DoS via duplicate OCPP clients). There is no version-numbered software patch; Hydro-Québec's remediation is operational — OCPP has been disabled on most charging stations and authentication added for the remainder still using it — and CISA reports no known public exploitation (CISA CSAF, 2026-07-07).
The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Two unrelated third-party Joomla page-builder extensions were both added to CISA KEV on 7 July 2026 for near-identical unauthenticated file-upload-to-RCE flaws, both already exploited as zero-days. CVE-2026-48908 (JoomShaper SP Page Builder, CVSS 10.0, CWE-434) sits in the component's asset.uploadCustomIcon task, reachable at index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon with no authentication and no file-type validation, affecting versions through 6.6.1 (fixed 6.6.2); mySites.guru observed live attacks planting hidden Super Administrator accounts (typically @secure.local) for persistence surviving the entry-point patch (mySites.guru, 2026-07-08). CVE-2026-56290 (Joomlack Page Builder CK, CVSS 10.0, CWE-284) is a front-end upload handler that validated only a CSRF token — no authentication, no authorization — and accepted an attacker-controlled destination folder and filename including the extension, letting a PHP file be written and executed anywhere web-accessible; it affects up to 3.5.10, fixed in 3.6.0 with back-ports to 3.1.1 (Joomla 3) and 3.4.10 (Joomla 4), and the vendor's own suspect-content tooling flagged a live web shell within hours of the fix landing (mySites.guru, 2026-07-07). The Hacker News corroborates both as KEV-listed and actively exploited (The Hacker News, 2026-07-08).
Already exploited in the wild. The payload plants a hidden Super Administrator account, usually with an @secure.local email.
CVE-2026-48908, on the other hand, is said to have been exploited as a zero-day to upload a PHP file by means of an HTTP POST request to the 'index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon' endpoint.
The 2026-07-02 entry covered Adobe's APSB26-68/69 cluster — six CVSS 10.0 unauthenticated ColdFusion RCE paths plus a Campaign Classic flaw — while Adobe stated it was "not aware of any exploits in the wild." That status has now changed for one member of the cluster. CVE-2026-48282, the CWE-22 path-traversal path, is the first of the six confirmed exploited: KEVIntel reported in-the-wild exploitation captured across its honeypot network within under two hours of the technical details going public (BleepingComputer, 2026-07-06). CISA added CVE-2026-48282 to its Known Exploited Vulnerabilities catalog on 7 July (CISA KEV, 2026-07-07), and BleepingComputer reports Shadowserver telemetry putting internet-exposed ColdFusion instances at roughly 800 (BleepingComputer, 2026-07-08). The remaining five cluster CVEs (CVE-2026-48276/-48277/-48281/-48283/-48316) remain unconfirmed for exploitation as of this run — but the sub-two-hour weaponisation of the first path is the operational signal that the whole cluster is being probed.
Within under two hours of CVE-2026-48282 public details being released, KEVIntel captured in-the-wild exploitation within our global honeypot network.
KEVIntel, via BleepingComputer
can be exploited by remote threat actors without privileges in low-complexity attacks to gain code execution on unpatched systems
GhostLock (CVE-2026-43499) is a stack use-after-free in the Linux kernel's rtmutex priority-inheritance code, discovered by Nebula Security's automated bug-hunting tool VEGA (Nebula Security, 2026-07-07). The defect lives in remove_waiter() (kernel/locking/rtmutex.c): the helper unconditionally clears current->pi_blocked_on, an assumption valid on the normal self-blocking path but broken on the proxy-lock rollback path — rt_mutex_start_proxy_lock() can enqueue (and, on -EDEADLK, roll back via remove_waiter()) a waiter on behalf of a different task, so the helper scrubs the wrong task's state and leaves a dangling pointer into an already-freed kernel stack frame. The only prerequisite is CONFIG_FUTEX_PI=y, the default on essentially every mainstream distribution — no special capability, user namespace, or unusual configuration, so any unprivileged local user is in scope.
The flaw was introduced in Linux 2.6.39 (commit 8161239a8bcc, a 2011 rtmutex PI-algorithm rework) and shipped for over fifteen years until it was reported to security@kernel.org on 18 April 2026, fixed two days later in commit 3bfdc63936dd, and backported by 4 May 2026 — meaning most currently-maintained kernels already carry the fix, but any distribution build not rebased onto a post-April-2026 source tree remains exposed. Nebula turned the primitive into a full exploit: reclaim the freed stack frame, use a prefetch-based side channel plus the DirtyMode /proc/sys write-what-where technique to hijack a function pointer, and reach root in roughly five seconds at 97% reliability in testing; the same primitive escapes containers, letting a compromised container break out to the host kernel. Google awarded $92,337 through kernelCTF, and Nebula published full exploit source alongside the write-up on 7 July — no in-the-wild exploitation is reported, but public working code against a 15-year exposure window makes this a same-week verification item (The Hacker News, 2026-07-08).
Kill chain and detection: the exploit is a local privilege-escalation and container-escape primitive — T1068 Exploitation for Privilege Escalation, with the container-escape variant also mapping to T1611 Escape to Host. Because the trigger is a legitimate futex-PI syscall pattern, there is no clean single syscall signature; hunt instead for the downstream effects — unexpected uid=0 transitions from processes with no setuid provenance, kernel oops/BUG: KASAN/general protection fault entries referencing rtmutex/remove_waiter in dmesg on hosts running untrusted code, and, on container platforms, a container process acquiring host-level capabilities or writing under host /proc/sys. Hardening short of the kernel patch: CONFIG_RANDOMIZE_KSTACK_OFFSET defeats the specific stack-reuse step (turning a deterministic overlap into roughly a 1-in-32 guess) and CONFIG_STATIC_USERMODE_HELPER closes the specific DirtyMode write-what-where path this PoC relied on — both raise cost but are not fixes. The durable remediation is confirming the running kernel includes commit 3bfdc63936dd, with priority on multi-tenant, shared-CI-runner and container-host fleets across Swiss/EU public-sector and cloud/Kubernetes estates where untrusted local code is most likely to run.
GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by VEGA that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege.
Until patched, determine whether the non-default authentication configuration required for CVE-2026-40138/-40139 (likely a SAML/OIDC integration) is enabled and disable it if not operationally required; restrict appliance management-plane access to a trusted admin segment.
Update UniFi Connect ≥ 3.4.20, Talk ≥ 5.2.2, Access ≥ 4.2.29, Protect ≥ 7.1.83 and UniFi OS ≥ 5.1.19; no interim mitigation is documented for any of the 25 CVEs.
Segregate every UniFi management-plane interface (controller UI, Connect, Talk, Access) from general LAN/internet exposure regardless of patch state — several flaws need only network adjacency and no or low privilege.
Tune sandbox/EDR heuristics for PE file-inflation (section-table size vs. file-size mismatch; anomalously large files) so 491 MB null-padded loaders are not silently skipped past detonation size limits.
Flag Authenticode signer/product mismatches (e.g. binaries signed as JustWatch GmbH or BleacherReport that are not those products) and MpClient.dll load-path anomalies / NisSrv.exe running from %AppData%.
Confirm every internet-facing ColdFusion 2025/2023 instance is on 2025 Update 10 / 2023 Update 21; treat any unpatched instance as compromised and hunt before patching.
Upgrade every self-hosted Langflow to ≥ 1.9.1 now; rotate any LLM-provider or cloud credentials embedded in flows on instances that were internet-exposed.
On multi-tenant/managed Langflow, additionally authorize or restrict the /api/v1/flows/ listing endpoint — the IDOR is inert without the UUID enumeration it provides.
Confirm the running kernel includes commit 3bfdc63936dd (backported 2026-05-04) — a build date of 'recent' is not sufficient; verify the specific fix on every multi-tenant, CI/CD and container-host Linux fleet.
Where immediate patching is not possible, enable CONFIG_RANDOMIZE_KSTACK_OFFSET and CONFIG_STATIC_USERMODE_HELPER to raise exploit cost (not a fix), and prioritise hosts where untrusted local code runs (shared build runners, container platforms).
Rotate long-lived Azure DevOps PATs and storage access keys to short-lived Entra Workload Identity Federation / OIDC tokens; run Advanced Security secret scanning + push protection across all repos; enforce IP-restricted Conditional Access on the DevOps organization.
Enforce Microsoft Defender tamper protection via policy so exclusion paths cannot be added by a standard admin token; alert on ICMLuaUtil/CMSTPLUA COM instantiation outside expected system processes.
Hunt for scheduled tasks named 'CrysomeLoader' on a 5-minute trigger, svchost.exe running from %TEMP%, and batch→PowerShell chains carrying AMSI-bypass indicators (Sysmon EID 1).
Any OCPP central-system operator: verify the WebSocket upgrade enforces mutual TLS or HTTP Basic Auth per OCPP Security Profile 2/3 rather than accepting unauthenticated ws:// upgrades.
Rate-limit repeated OCPP BootNotification/Authorize attempts per source, and reject duplicate concurrent connections claiming the same ChargePointId (closes the session-exhaustion class); since charge-point hardware carries no endpoint agent, detect on backend session-churn/connection-count anomalies per charge-point ID.
Hunt for newly created Joomla Super User / Super Administrator accounts (especially @secure.local addresses) and web shells written under the site web root; patching the entry point does not remove an already-planted admin account.
Patch or retire EoL Ruckus wireless APs and ASUS AiCloud routers exposed to CVE-2020-22653/-22658, CVE-2023-25717 and CVE-2025-2492; disable unneeded remote-management interfaces on edge/CPE devices.
Baseline and alert on multi-protocol relay/fan-out behaviour (simultaneous HTTP/DNS/SOCKS/TCP/ICMP/UDP) from a single consumer-grade router or AP; treat inbound connections from residential/SOHO ranges into VPN/remote-access portals as a stronger signal than IP reputation alone.
2026-07-08T2009Z-intel· Claude Opus 4.8 · window 64 h · 11 entries published
Verification & coverage notes
Catch-up intel run — gap ~62 h to the previous fire (2026-07-06T06:09Z-intel; both 2026-07-06 runs were quiet, zero entries). window_hours=64 (gap+2, catch-up class), developing_window_hours=86. Coverage window: catch-up of 62 h (previous run 2026-07-06T0609Z-intel). Dedup (PD-8) ran against the full 14-day prior_coverage.json (140 records — every brief in the window loaded into context) plus the store-wide CVE index (484 ids). Prompt version v3.11. Outcome: 11 entries (10 new + 1 update), one deep-dive (GhostLock, linux-lpe), no critical. Composition: 7 vulnerability (incl. the ColdFusion update + the GhostLock deep-dive), 3 threat, 1 incident — a diverse landscape, not a per-vendor patch feed.
No critical this run — by construction. The two actively-exploited KEV items (ColdFusion CVE-2026-48282, Langflow CVE-2026-55255) are high, not critical: both have patches available and neither is mass-exploitation-imminent for this constituency (ColdFusion ~800 internet-exposed instances globally; Langflow a single observed operator). No candidate cleared the extreme critical bar (newly weaponised + active-ITW/mass-exploitation-imminent + hour/day-critical defender action).
Deep-dive: GhostLock (CVE-2026-43499), category linux-lpe — selection criterion 3 (substantive new technical analysis with a public, actionable exploit). No linux-lpe deep-dive in the prior 30 days (rotation clear); deep_dives_today=0. Public 97%-reliable root + container-escape exploit against a 15-year-exposure kernel UAF present on the default CONFIG_FUTEX_PI justifies the long-form treatment.
Borderline drops (recoverable audit trail)
borderline-drop: Compass Security (Swiss lab) CRA compliance methodology (IP-camera IEC 62443-4-2 SL2 assessment) (S2) — single-source first-party methodology/compliance-assessment piece; genuinely Swiss and well-executed, but it is procurement/compliance guidance, not operational threat/detection intel. Fails PD-11 actionability (changes no patch/hunt/block/detect decision for a Tier 2/3 responder). No ATT&CK/detection surface.
borderline-drop: Krebs on Security — IRIS C2 exploit-acquisition startup run by convicted fraudsters (S3) — vendor/procurement-risk investigative journalism; no technical vulnerability, TTP or detection content. Interesting for public-sector procurement/vendor-risk teams but not actionable for a SOC responder (PD-11 actionability gate).
borderline-drop: Swiss Post 2026 e-voting bug bounty (6–24 July, outer network-security layer removed for a test cohort, up to EUR 230k) (S2) — direct Swiss-federal-e-gov nexus and a real "don't mis-triage authorised adversarial traffic" angle, but fundamentally a program-announcement / awareness news item (PD-11 "drop without ceremony"); single-source (Swiss Post's own post 301-redirected during the run; only SwissCybersecurity.net was fetched) and no clean operational entry-kind fit. Logged here for recoverability — if anomalous traffic against Swiss federal e-voting segments is observed in-window, this is the authorised-testing context.
Out-of-window drops (S3 flagged these as strong near-misses for a catch-up window; all fail recency PD-7 — primary source before the 86 h developing cutoff of 2026-07-05T06:09Z)
Check Point "Browser-Only Ransomware" LLM-hallucination-to-attack technique (primary 2026-07-01).
"Bad Epoll" CVE-2026-46242 Linux epoll UAF LPE, ~99% reliable exploit (primary/THN 2026-07-03) — the in-window Linux-LPE-with-public-exploit beat is already carried by GhostLock, so no blind spot.
Single-source (research-lab primary, reported as the lab's own original analysis): CrySome (LevelBlue SpiderLabs), UAT-7810 (Cisco Talos), Factory-v3 (Palo Alto Unit 42) — each verification: single-source with a sourcing_note; same-day outlet rewrites are not independent corroboration.
Single-source-national-cert: Hydro-Québec OCPP (CISA ICSA-26-188-01) — national-authority carve-out; the CSAF JSON is the same authority's structured record.
Accenture (incident): the incident is confirmed multi-source (Accenture's own statement + four outlets), but the claimed SCOPE (35 GB, credential classes, specific repo) is the actor's unverified advertisement — "888" has a documented scope-inflation history (a June 2024 Accenture claim of 32,826 employee records proved to contain only three genuine ones). Framed as an actor claim throughout; confidence: medium, classification: B3.
ColdFusion update discipline (PD-8): CVE-2026-48282 shipped as update_of: 2026-07-02/cve-2026-48276-48277-48281-48282-48283-48316-adobe-coldfusio — delta only (exploitation-status change: patched-no-exploitation → actively-exploited + KEV within a week); the original entry (which correctly stated "no exploitation reported yet") is untouched.
Ubiquiti dedup: SAB-066 (CVE-2026-50746 et al.) is a distinct, larger disclosure from the 2026-06-24 UniFi OS chain (CVE-2026-34908/-34909/-34910) — different CVEs, broader product scope — so a new entry, not an update.
Contradictions: none.
Completeness sweep (PD-11)
Re-read all four findings sets including every borderline/near-miss candidate. Everything genuinely relevant and in-window is published: the two actively-exploited KEV clusters, the home-authority (NCSC-CH) BeyondTrust advisory, the NCSC-NL Ubiquiti bulletin, the public-exploit kernel LPE, the OT/EV-charging transferable weakness, three substantive research-lab TTP analyses, and the one in-scope supply-chain incident (Accenture). The three borderline drops are awareness/compliance/procurement items that fail the actionability gate, not blind spots; the out-of-window set is genuinely stale (all primaries before the 86 h developing cutoff), and where a theme could have left a gap (Linux LPE) an in-window item (GhostLock) already covers it. No relevant item was thinned to control volume — volume here reflects a genuinely eventful 62 h catch-up (a same-day CISA KEV batch of exploited CVEs plus two national-CERT advisories), not padding.
Coverage gaps
industrialcyber-co (recurring UA-403 on WebFetch + bridge + jina — recorded in fetch_failures; WebSearch substitute found nothing in-window). Standard-tier, not essential.
Slow-cadence / quiet sources (fetched clean, no in-window content — not failures): cert-eu (newest 2026-06-10), cert-at (2026-06-01), cert-pl (2026-06-12), enisa (2026-07-01 NIS360), trendmicro-research (2026-06-29), snyk-research (2026-06-29), mozilla-mfsa (2026-07-05 moderate iOS spoofing, below bar), sekoia (2026-07-01 ChocoPoC, out of window), truesec (2026-07-03 repackage of Sysdig JADEPUFFER, already covered), socprime (2026-06-19), withsecure-labs (month-granularity, newest May 2026), shadowserver (2026-06-25).
Recipe-quality gaps (host healthy, extraction weak): ncsc-uk (reports-advisories index returned page chrome only this pass), prodaft (Next.js SPA shell, no dated /blog list), trellix (JS-only blog listing never surfaces post links even via jina — recommend a sitemap.xml probe recipe), oracle-cpu (security-alerts index nav-only; next quarterly CPU due mid-July, not yet published).
Recipe note (fixed-forward): sans-newsbites — the jina/url bridge failed (connection reset / 422) but plain WebFetch succeeded on the canonical issue URL; recommend the recipe prefer WebFetch over jina for this host.
Standard-tier not attempted this run (time budget prioritised essentials + strong KEV/NCSC pivots): shadowserver (S1), socprime (S1), trustwave-spiderlabs (S1 — note S3 reached it as LevelBlue), sonatype, flatt-security, jpcert, exodus-intelligence. Recommended for priority pickup next rotation.
Essential-coverage: no miss — every essential-tier source was attempted and resolved (CERT/KEV/regulator set incl. bridged CISA hosts and NCSC-CH/NCSC-NL).
Watchlist: not reported — config/org-profile.yaml configures no product or supplier watchlists; the S1 product-sweep and S4 supplier-sweep were documented no-ops.
Source-health (standing repair order): python3 tools/source_health.py ran to completion (the first attempt hit a 320 s wrapper timeout and was re-run with a longer budget; state/source_health.json was untouched by the killed attempt and regenerated cleanly by the retry). Result: 95 ok · 58 bridge-ok · 1 jina-ok · 154× action none — zero UNSOLVED / needs-bridge / needs-demote. Nothing to repair this run; even industrialcyber-co (the run's one live fetch_failure at 403) probes as handled, and the previously-flagged ccn-cert-es transport-block fix is holding. No demotions (rule A1).