8 verified findings from 2 runs · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01This pipeline told readers there was no patch to wait for; the advisory it cited names five patched versions with download links. This pipeline's 2026-08-05 entry on CVE-2026-17583 stated throughout — in its title, its summary, its cves[] status and its action item — that Thermo Fisher offered no fix for the missing integrity checking on Applied Biosystems genetic-analyzer result files, and told readers the control that closes the gap is architectural because there is no patch to wait for. That is wrong against the entry's own cited advisory. CISA ICSMA-26-216-01 carries vendor-fix remediations naming patched versions for five product lines — 3500/3500xL Data Collection Software 4.0.3, 3730/3730xL 5.0.3, SeqStudio 1.2.6, SeqStudio Flex 1.2.1 and GeneMapper ID-X 1.7.4 — and only the three end-of-life ABI PRISM and 3130 Series products have no update. The updates implement digital signatures on the instrument software so users can verify that data files have not been modified, which is the control the original entry argued was unavailable. The advisory is at revision 1 and has never been revised, so the fixes were present when the original entry was composed. →
02A twelve-year-old PRNG in crypto-js reduces a nominal 128-bit secret to a search space commodity hardware can enumerate. Coinspect's "Ill Bloom" investigation, published 2026-08-05, traced a wallet-drain campaign to CryptoJS.lib.WordArray.random() in crypto-js versions before 4.0.0, which is not a cryptographically secure generator: it is a custom Multiply-With-Carry PRNG seeded from Math.random(), introduced in 3.1.2-4 in June 2014 and present in every 3.x release except 3.2.0 and 3.2.1. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of roughly 2^39 and 2^47, and applying PBKDF2 or any hash afterwards does not restore what was never generated. Coinspect states attackers were already exploiting the weakness while its investigation was underway, and the advisory records a measured lower bound of about $5M in stolen assets across two drain waves as of 2026-07-13. The reason this reaches beyond wallet vendors is the scope rule: any application that used the function to produce a security-sensitive value — a key, token, session identifier or reset code — inherits the weakness, and no upgrade repairs a secret already generated. →
03An unauthenticated request to a PAM appliance's REST API yields product-administrator control of the vault it exists to protect. CERT-FR relayed two WALLIX vulnerabilities to its constituency on 2026-08-06 that this pipeline had not covered. WSA-2026-07-0001 is a CVSS 4.0 base 10.0 authentication bypass in the WALLIX Bastion REST API: a remote, unauthenticated attacker with network access to the API endpoint — typically HTTPS/443 on any operational appliance, in any configuration — obtains full administrative privileges, and with them the Bastion's configuration, its vault of privileged credentials and its session recordings. Bastion 12.3.0–12.3.6 and 12.4.0 are affected; 12.3.7 and 12.4.1+ are patched and versions below 12.3.0 are not affected. WSA-2026-07-0002 (CVSS 4.0 8.7) lets an attacker with network access to an Access Manager portal's SAML Service Provider obtain an authenticated administrator session without valid credentials, reaching every target and credential that portal brokers. WALLIX states the reporting researchers intend to publish full technical details in September 2026, which puts a date on the window for patching quietly. →
04The N-central build this pipeline named as the fix has been superseded; 2026.3.1.7 is no longer sufficient. N-able shipped N-central 2026.3 Hotfix 2 (build 2026.3.1.10) on 2026-08-06 and states plainly that it is required even for partners who already applied Hotfix 1, which it supersedes with additional hardening as threat actors evolve their techniques against CVE-2026-18577. That matters to anyone who acted on this pipeline's earlier coverage, which named build 2026.3.1.7 as the remediation. Reporting on 2026-08-08 adds what the attackers did with administrative access: they used N-central's own Take Control feature to reach systems inside the managed environment and registered a new service for a Cloudflare Tunnel on those devices, which keeps them in after access to the N-central server itself is revoked. Hosted NCOD instances are already mitigated and need no action. →
05One unauthenticated endpoint returns uninitialised heap memory containing user credentials — roughly 12,000 TeamDavid instances are internet-facing. InfoGuard Labs published 22 CVEs on 2026-08-07 against the Webbox web application of Tobit TeamDavid, an enterprise collaboration and unified-messaging suite marketed across the DACH region as a self-hosted alternative to Microsoft 365, which the researchers put at roughly 12,000 publicly accessible instances. The load-bearing chain needs no authentication: requesting /.well-known/mta-sts. with an extension that does not resolve makes the server return up to 4 KB of uninitialised heap memory from earlier requests, which leaks the per-user access.ini files whose stored passwords are obfuscated with a trivially reversible XOR scheme rather than hashed — giving an attacker any user's mailbox. A single unauthenticated request to /internalRestart also takes the service down until an administrator restarts it by hand. The CVE records bound every issue at TeamDavid through Rollout 524 and name no fixed release; the researchers state they cannot say which flaws are fixed, and report that the vendor stopped responding to both them and the national cyber security centre that had taken up the coordination. →
06Metabase Cloud was breached through its own 0-day; self-hosted instances stay vulnerable until manually upgraded. Metabase disclosed on 2026-08-06 that its Metabase Cloud platform was attacked through a previously unknown vulnerability in versions 1.58 and above: an unauthenticated attacker injects arbitrary SQL against the application database and obtains administrator access to the instance, from which they can rewrite configuration, steal the stored credentials for every connected database and export the data those connections reach. The only interim workaround the vendor offers is to block the /api/session/reset_password endpoint, which is also where its published attack pattern runs. Cloud instances were patched by the vendor; self-hosted deployments stay vulnerable until manually upgraded to 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 or 0.63.5. Laptop maker Framework and form builder Tally have both confirmed customer data was taken from their instances on 2026-08-03. No CVE identifier has been assigned, so a purely CVE-driven patch process will not surface this at all. →
The defect is not a bug in a cryptographic primitive but in what fed one. CryptoJS.lib.WordArray.random() in affected versions is a custom variation of George Marsaglia's Multiply-With-Carry PRNG seeded from Math.random(), introduced in 3.1.2-4 in June 2014 and present in every 3.x release except 3.2.0 and 3.2.1 (GitHub Advisory Database, 2026-08-07). The consequence is a collapse in real entropy rather than a bias a statistical test would flag: "Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities — small enough to enumerate on commodity hardware" (GitHub Advisory Database, 2026-08-07). The version history is its own trap: the generator was fixed in 3.2.0 and 3.2.1, and "That change was reverted in 3.3.0 because it was considered a breaking change, so projects tracking the 3.x line could resolve to newer versions that still contained the weak generator"; 4.0.0 replaced it with the platform's native cryptographic API (GitHub Advisory Database, 2026-08-07).
Coinspect reached the root cause from the other end, starting in May 2026 from a wallet-drain incident across multiple networks that was initially attributed to a single product (Coinspect, 2026-08-05). Its reconstruction reimplemented the affected generator, enumerated the feasible PRNG outputs, converted candidate entropy values into valid BIP39 recovery phrases, derived addresses across the relevant derivation paths and networks, and matched them against public blockchain data to recover the private keys controlling funded addresses (GitHub Advisory Database, 2026-08-07). That method is also why the investigation ran under pressure: Coinspect states the flaw "had existed for more than a decade, making it difficult to determine how widely the vulnerable implementation had spread, and attackers were already exploiting it while our investigation was underway" (Coinspect, 2026-08-05). The advisory records coordinated drain waves against addresses derived from vulnerable phrases, with a measured lower bound of approximately $5M in stolen assets across the two events as of 2026-07-13 (GitHub Advisory Database, 2026-08-07).
For a defender outside the cryptocurrency sector the wallet framing understates the exposure. The advisory's scope rule cuts both ways: "An application is affected only if it uses the vulnerable function to generate security-sensitive values" and merely depending on crypto-js < 4.0.0 is not sufficient to be exploitable — but any use of that function for a key, token, session identifier or password-reset code produces a value inside the same enumerable space. Two properties make it worse than a normal dependency finding. The generator's weakness is not visible in an application's own source, because the call site looks like a request for cryptographic randomness; and the damage does not age out. The advisory is explicit that updating the library does not strengthen a previously generated secret, that importing the same recovery phrase into updated software does not remediate it, and that previously generated secrets may remain exploitable indefinitely (GitHub Advisory Database, 2026-08-07).
Detection is therefore a code-and-inventory exercise rather than a telemetry one: there is no network or endpoint artefact for a secret that was weak at birth, and an attacker enumerating offline generates no traffic against the victim at all. The tractable signal is the software bill of materials — a resolved crypto-js version below 4.0.0 in a build manifest, lockfile, container layer or bundled front-end asset — paired with a search of the codebase for WordArray.random at security-sensitive call sites.
Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities — small enough to enumerate on commodity hardware.
The vulnerability had existed for more than a decade, making it difficult to determine how widely the vulnerable implementation had spread, and attackers were already exploiting it while our investigation was underway.
Privileged-access management appliances concentrate exactly what an intruder wants, which is why a pre-authentication path to administrator on one is a different class of problem from the same bug on an ordinary web application. WALLIX's WSA-2026-07-0001 is that path: the vendor describes a REST API authentication layer that "can be induced to grant a privileged administrative session without valid credentials", classed CWE-290 (authentication bypass by spoofing) and CWE-287, scored CVSS 4.0 base 10.0 with the vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H (WALLIX, 2026-07-20). The vendor is explicit that no precondition narrows the exposure — the flaw "affects any operational Bastion 12.3 and 12.4.0 in any configuration" and "requires no authentication, no user interaction, and no special settings" — and that what exploitation yields is the vault: "complete control over the Bastion, including its configuration, its vault of privileged credentials, and its session recordings" (WALLIX, 2026-07-20). The affected code path entered the 12.3 branch, so 12.0.x and anything below 12.3.0 is unaffected; 12.3.7 and 12.4.1 and higher carry the fix.
The second flaw sits one layer out. WSA-2026-07-0002 (CVSS 4.0 base 8.7, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N) is an authentication bypass in the Access Manager portal's SAML Service Provider that yields an authenticated administrator session without valid credentials. WALLIX is careful about the blast radius: because the Access Manager brokers access to a fleet of Bastions, that session reaches the targets and privileged credentials the portal is configured to broker, but it does not confer administration of the Bastions themselves (WALLIX, 2026-07-20). CERT-FR's advisory adds the version boundaries that matter for the portal: Access Manager with SAML federation configured is affected below 5.1.10, in 5.2.x below 5.2.7, and in 6.x below 6.0.4 (CERT-FR, 2026-08-06). Where upgrading the portal cannot happen immediately, WALLIX names partial fencing — disabling or removing SAML federation domains not in active use, and removing or renaming Administrator-type profiles on organisations that need SAML — while stating plainly that these "reduce risk but do not fully close the flaw" (WALLIX, 2026-07-20).
What makes this urgent rather than merely severe is a clock the vendor set itself. WALLIX withholds the exploitation mechanics deliberately — "Technical exploitation details are intentionally withheld to protect customers until patch adoption is sufficiently widespread" — but states that the independent researchers who reported the flaws "intend to publish full technical details in September 2026", after which "information useful to attackers will be in the public domain" (WALLIX, 2026-07-20). Neither the vendor nor CERT-FR makes any statement either way about exploitation to date, and the advisory is pointed about why that silence is not reassurance: it tells customers to treat affected appliances as potentially compromised and warns that "Absence of evidence must not be interpreted as absence of compromise" (WALLIX, 2026-07-20). A CVSS 10.0 unauthenticated bypass on an appliance class that is routinely internet-reachable, with a published disclosure date, is the shape where what is known today says little about next month.
One version boundary is worth pre-empting, because the advisory contradicts itself on it. Its affected-products table marks Bastion 12.3.7 as Patched alongside 12.4.1 and higher, and CERT-FR's advisory independently scopes the flaw to "Bastion versions 12.3.x antérieures à 12.3.7" (CERT-FR, 2026-08-06) — but the vendor's own remediation section says "Upgrade to WALLIX Bastion 12.4.1 or higher. This is the only effective remediation" (WALLIX, 2026-07-20). Two sources agree the 12.3.7 hotfix closes it; a reader who patches to 12.3.7 and then reads that sentence should know the disagreement is in the vendor's own document.
Detection is unusually tractable here because the vendor named the artefact rather than an indicator. State-changing operations on the Bastion — creating or editing users, changing configuration — are written to /var/log/wabaudit.log and forwarded to a SIEM where one is configured, in a structured line carrying action, type, object, user, client_ip and the changed fields (WALLIX, 2026-07-20). Triage: a session obtained through this flaw acts as an internal service account principal from the loopback address, so the discriminator is the actor/address pair rather than the action — a state-changing add, edit or delete recorded with client_ip="127.0.0.1", and above all a type="User" creation granting the product_administrator profile. Legitimate administrator actions are never recorded that way, because a real administrator reaches the appliance over the network from an identifiable client address. Any administrator account whose creation carries that pair is attacker-created regardless of how plausible its name looks.
A critical vulnerability has been identified in the WALLIX Bastion REST API. A remote, unauthenticated attacker with network access to the API endpoint can obtain full administrative privileges on the appliance.
Successful exploitation grants complete control over the Bastion, including its configuration, its vault of privileged credentials, and its session recordings.
Primary indicator — administrator creation performed by the internal service account identity. A session obtained through this vulnerability acts as an internal service account principal from the loopback address.
InfoGuard Labs published 22 CVEs on 2026-08-07 against the Webbox web application of Tobit TeamDavid, an enterprise collaboration and unified-messaging suite sold across the DACH region as a self-hosted alternative to Microsoft 365 and combining mail, video conferencing and chat with fax, SMS and physical letter mail; the researchers found the flaws during an external penetration test and put current Shodan and Censys data at approximately 12,000 publicly accessible instances (InfoGuard Labs, 2026-08-07). Their own summary of the impact is that successful exploitation primarily leads to complete compromise of user mail accounts, with the potential for full system compromise (InfoGuard Labs, 2026-08-07).
The chain that needs no credentials is two flaws deep. The application is largely file-based, and access to each user's mailbox is governed by an access.ini file in that user's directory holding the username and a stored password that is obfuscated rather than encrypted — each character XORed against a key derived from 128 plus its index position, which anyone holding the file can reverse, and in some instances the password is stored in plaintext outright without the researchers being able to pin down what triggers that (CVE-2026-54218) (InfoGuard Labs, 2026-08-07). Reaching those files remotely is what the second flaw provides. The unauthenticated /.well-known/mta-sts. handler treats the part of the URL after mta-sts. as a file extension and reads the corresponding file from a fixed directory; when that file does not exist it skips the read but continues processing a buffer it allocated and never zeroed, then returns the leftover heap contents as an HTTP 200 body — up to 4 KB of residual memory from earlier requests, which in the researchers' testing spilled access.ini contents, email, attachments, configuration files and SQL queries (CVE-2026-54203) (InfoGuard Labs, 2026-08-07). Poll the endpoint, recover an access.ini, decode the password, log in as that user.
Separately, an endpoint named /internalRestart does not restart anything — one unauthenticated request shuts the web server down entirely and it stays offline until an administrator brings it back by hand (CVE-2026-54213) (InfoGuard Labs, 2026-08-07). Four further buffer overflows crash the server, three of them needing no credentials at all: an overlong filename in the file-upload functions (CVE-2026-54210), a request body beginning with a number followed by at least seven characters on an API endpoint (CVE-2026-54212), and the password-change handler, which is triggered by putting the string (editini) in the request path and loads the file at that path into a fixed-size stack buffer without checking that it is actually an Archive.ini, so an unauthenticated caller can point it at any oversized file (CVE-2026-54209); the fourth, in several form parameters of the serverClient_close.html endpoint, requires an authenticated session (CVE-2026-54211) (InfoGuard Labs, 2026-08-07). The researchers observed these terminate the process with STATUS_STACK_BUFFER_OVERRUN and note that the stack cookie blocks a straightforward return-address overwrite, while stating that with a different stack state or a canary leaked through another flaw these could potentially escalate to remote code execution (InfoGuard Labs, 2026-08-07) — that escalation is explicitly hypothetical and has not been demonstrated.
The remaining flaws matter mostly for what they do to the surrounding domain. Four separate functions resolve attacker-supplied UNC paths, so the server can be made to authenticate outbound to an attacker-controlled host and hand over NetNTLM material for capture or relay whenever 445/TCP egress is permitted: the search function's pathnameroot parameter takes it without authentication, though a ../ in the URL is needed to get past the authorisation check (CVE-2026-54204), while the link-storing, @@INCLUDE messaging and archive-move paths require an authenticated session (CVE-2026-54205, CVE-2026-54206, CVE-2026-54207) (InfoGuard Labs, 2026-08-07). An authenticated user can attach arbitrary server files to an outgoing message with @@attach and download them, bypassing the filter over configuration and user directories through NTFS alternate data streams, which reaches the server's private key and other users' access.ini files (CVE-2026-54200); delete any file on the server with @@COMMENTFILE (CVE-2026-12070); and create folders anywhere on disk, including system directories and other users' private directories, through the archive-creation path (CVE-2026-54202) (InfoGuard Labs, 2026-08-07). An unauthenticated arbitrary file write in the password-change function, constrained by the target directory's own access.ini, still allows planting a .htm file that executes JavaScript when opened (CVE-2026-54208), and error logs are served with no authentication or authorisation check at a predictable URL (CVE-2026-54201) (InfoGuard Labs, 2026-08-07). A reflected and a stored cross-site scripting flaw, two open redirects and two HTTP header injections round out the set (InfoGuard Labs, 2026-08-07).
The disclosure history is the reason this is an exposure decision rather than a patching one. The researchers first contacted the vendor on 2025-11-05, submitted 13 findings on 2025-12-27, were told on 2026-01-27 that eight were patched with five scheduled for the next release, retested on 2026-02-06 and found several only partially remediated plus nine new issues, escalated to a national cyber security centre on 2026-02-17, sent CVE drafts on 2026-05-28, and by 2026-08-06 recorded that both they and that centre had been ghosted by the manufacturer despite multiple follow-up emails — publishing the next day (InfoGuard Labs, 2026-08-07). Their first recommendation is to update to the newest version while stating plainly that they do not know which vulnerabilities are fixed and which are not (InfoGuard Labs, 2026-08-07). The published CVE records bound every one of the 22 issues at TeamDavid through Rollout 524 and name no fixed release, which is why the cves[] records on this entry carry none. No in-the-wild exploitation is reported by any party.
Triage: requests to /.well-known/mta-sts. are not inherently hostile — MTA-STS is a real mail-security mechanism and a policy fetch is ordinary. Two things separate the leak from that traffic in web-server access logs: a legitimate client fetches mta-sts.txt at the documented path, whereas exploitation requests a varying stream of extensions that do not exist, and it repeats — the leak returns whatever happens to be in reused heap, so an attacker polls rather than fetching once. A run of 200 responses to distinct non-existent extensions from one source is the signal; a single mta-sts.txt fetch is not.
Current data from Shodan and Censys indicates approximately 12,000 publicly accessible instances.
Successful exploitation primarily leads to the complete compromise of user mail accounts, with the potential for full system compromise.
Both the NCSC and our team had been ghosted by the manufacturer despite multiple follow-up emails.
Update to newest version, we don’t exactly know which vulnerabilities are fixed and which are not
Metabase, an open-source business-intelligence platform run both self-hosted and as a managed cloud service, disclosed on 2026-08-06 that its own Metabase Cloud environment had been attacked by someone using an unknown vulnerability affecting versions 1.58 and above, and that it blocked the endpoints used in the attack before identifying and patching the flaw (Metabase, 2026-08-06). The mechanism matters more than the platform: an unauthenticated caller injects arbitrary SQL against the Metabase application database, and that yields administrator access to the instance — from which the attacker can change the application configuration, steal the stored credentials Metabase holds for the databases it connects to, read anything reachable through those connections, and export it (Metabase, 2026-08-06). Neither the vendor nor the reporting locates the injection point precisely, but the vendor's stated interim workaround for anyone who cannot upgrade immediately is to block the /api/session/reset_password endpoint outright, and its published attack pattern runs through that same route (Metabase, 2026-08-06). BleepingComputer, quoting the associated security advisory, reports it is rated critical at CVSS 10.0 with active exploitation confirmed, and that no CVE identifier was assigned (BleepingComputer, 2026-08-07).
The exposure split is the part defenders need to act on. Metabase Cloud customers were upgraded and patched by the vendor, while self-hosted instances remain vulnerable until an administrator upgrades them by hand (Metabase, 2026-08-06). The minimum safe point releases are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 and 0.63.5 for their respective branches, and anything on a lower point release of those branches is still vulnerable; installations below version 58 are not affected (Metabase, 2026-08-06).
Two organisations have confirmed data theft from their own instances. Framework, the laptop manufacturer, told customers that the attackers stole full names, email addresses, login IP addresses, billing and shipping address details, phone numbers and company names, with VAT, EIN and billing email address additionally in scope for its business customers, and said Metabase notified it on 6 August that its instance had been vulnerable and was accessed on 3 August (BleepingComputer, 2026-08-07). Tally, an online form builder, notified users that its Metabase analytics environment was compromised on the same date and that the attackers reached email addresses and password hashes, while its forms and the responses submitted to them are stored separately and were not reached (BleepingComputer, 2026-08-07). Those two are the confirmed victims; no other organisation has been reported as having data taken through this flaw.
Detection is unusually well specified for a flaw with no CVE, because the vendor published the request sequence rather than indicators. The attack shows up as a call to POST /api/session/reset_password returning a 400 status code followed by a call to GET /api/user/current returning 200, and Metabase states that finding that pattern in application logs or in Metabase server ingress logs means the instance was likely compromised (Metabase, 2026-08-06). After upgrading, the vendor's own follow-up steps for any instance whose reset endpoint was publicly reachable are to revoke every active session by deleting all rows in the core_session table, review and delete unrecognised API keys, check administrator accounts for unexpected changes, rotate the credentials for every connected database, and review both data-warehouse logs and Metabase's own activity and query history for unauthorised access (Metabase, 2026-08-06).
Triage: a 400 on the password-reset route is ordinary — users mistype addresses and reset flows reject malformed requests all day, and on its own the 400 means nothing. The discriminator is what follows it from the same source: an unauthenticated client that is genuinely failing a password reset has no session and cannot then get a 200 from /api/user/current, so it is the ordering and the success of the second call that separate exploitation from noise (Metabase, 2026-08-06).
We recently identified that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above.
After gaining access to your instance, the attacker could inject arbitrary SQL against the Metabase application database, which can give them administrator access to the instance.
If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised.
This is a CRITICAL vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance,
the earlier entry's central claim was false, and the correction runs the wrong way round from the usual — a flaw this pipeline described as unfixable has a fix, and readers were told not to look for one.
CISA's advisory ICSMA-26-216-01 carries eight per-product vendor-fix records for this flaw, alongside seven mitigation records. Five of the eight name a patched version for a specific product line: "Applied Biosystems 3500/3500xL Series Data Collection Software: Update to version 4.0.3", and correspondingly 3730/3730xL Data Collection Software to 5.0.3, SeqStudio Genetic Analyzer Data Collection Software to 1.2.6, SeqStudio Flex Series Instrument Software to 1.2.1, and GeneMapper ID-X Software to 1.7.4 (CISA ICSMA-26-216-01 (CSAF), 2026-08-04). Three products are genuinely unfixed, and the advisory says why rather than staying silent: the 3130 Series, ABI PRISM 3100/3100-Avant and ABI PRISM 310 Data Collection Software each carry "Product is End of Life (EoL), no update provided" (CISA ICSMA-26-216-01 (CSAF), 2026-08-04). The original entry generalised the end-of-life products' position to the whole product set.
The substance of the fix matters as much as its existence, because the earlier entry argued that no software update could address the problem and that only an architectural control — moving completed .fsa/.hid files into append-only or signed storage — would do. The advisory says the updates do precisely that job in the instrument software: "Thermo Fisher has developed security updates to address the vulnerability. The security updates implement the use of digital signatures on the instrument software that adds an extralayer of protection. Moving forward, this will help users verify that data files have not been modified" (CISA ICSMA-26-216-01 (CSAF), 2026-08-04). The interim measures the original entry treated as the whole answer — encrypted storage media, access restriction to authorised personnel, least privilege on the instrument hosts, and firewall rules and network ACLs limiting internet connectivity to trusted sources — are in the advisory as what to do until the applicable updates are installed, not instead of them.
Nothing about the flaw itself changes: the CVSS 3.1 base score of 8.4, the local attack vector, the affected version list and the mechanism — result files written with no integrity checking, so a file altered after the run reads as authentic — were all correct in the original entry and were re-verified in this audit. What changes is the disposition. For five of the eight product lines this is a patching task on a normal change window, and the frontmatter here supersedes the earlier status: [no-patch] and its empty fixed field, both of which would otherwise leave an automated triage consumer answering "is my version patched?" with a wrong no.
Triage: an instrument host still reporting a Data Collection Software version at or below the affected boundary after the update window is the discriminator between "unpatchable end-of-life product" and "patchable product nobody updated" — the two look identical in an asset inventory that records only the product family, and only the version string separates them.
Thermo Fisher has developed security updates to address the vulnerability. The security updates implement the use of digital signatures on the instrument software that adds an extralayer of protection. Moving forward, this will help users verify that data files have not been modified.
Applied Biosystems 3500/3500xL Series Data Collection Software: Update to version 4.0.3
Applied Biosystems 3130 Series Data Collection Software: Product is End of Life (EoL), no update provided
The remediation named in this pipeline's earlier coverage is no longer the endpoint. N-able published N-central 2026.3 Hotfix 2, build 2026.3.1.10, on 2026-08-06, and states that it is not a duplicate of the previous communication: Hotfix 2 is required even for partners who already applied the earlier hotfix, and it supersedes Hotfix 1 with additional hardening measures (N-able, 2026-08-06). The vendor frames it as proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques, rather than as a fix for a newly identified flaw (N-able, 2026-08-06). On-premises instances can upgrade directly to 2026.3.1.10 from 2025.4, 2026.1, 2026.2, 2026.3 or the 2026.3.1 Hotfix 1 build, and hosted N-central (NCOD) environments have already had the mitigations applied and require no customer action; the hotfix itself does not require agents to be upgraded to protect against CVE-2026-18577 (N-able, 2026-08-06).
The second half of the delta is the blast radius. The Hacker News reports on 2026-08-08 that in the attacks N-able observed, the flaw let attackers obtain administrative access remotely and then use N-central's own Take Control feature to connect to systems inside the managed environment, where they registered a new service for a Cloudflare Tunnel that kept them in even after access to the N-central server was revoked (The Hacker News, 2026-08-08). N-able detected the unusual activity in a customer environment on 2026-07-31 and has confirmed a limited number of customers were affected; it has published an expanded set of network indicators and a custom service template that checks Windows endpoints in N-central against known indicators, while cautioning that a clean result should not be read as a guarantee that an environment was not impacted and should sit alongside a review of logs and account activity (The Hacker News, 2026-08-08).
Triage: a Cloudflare Tunnel client running as a service is not inherently malicious — it is ordinary infrastructure in plenty of estates, and RMM platforms legitimately install services on managed endpoints all day. The discriminator here is provenance and timing: the service appears on endpoints during or after the window in which the N-central server was exploitable, it was created through the RMM's own remote-control session rather than through a change ticket or a deployment policy, and it keeps beaconing after the management platform's access has been cut. Any one of those alone is weak; the sequence is the signal.
This is not a duplicate of our previous communication — Hotfix 2 is required, even if you already applied the earlier hotfix. Hotfix 2 supersedes Hotfix 1 with additional hardening measures to further protect you and your customers.
Upon gaining access to those devices, the threat actors registered a new service for a Cloudflare Tunnel, enabling persistence even after access to the N‑central server was revoked.
the delta is a single clause in that entry's summary, and it is one a reader could have acted on.
The entry described four classes of internet-facing enterprise software crossing into confirmed in-the-wild exploitation during ISO week 29, "every one KEV-listed". Eight of the ten identifiers involved bear that out. The SonicWall SMA1000 pair was added on 2026-07-14, Oracle E-Business Suite Payments on 2026-07-15, the AD FS and SharePoint elevation-of-privilege flaws on 2026-07-14, the wider SharePoint remote-code-execution flaw on 2026-07-16, and the two further SharePoint identifiers the entry quoted from CISA's own alert on 2026-04-14 and 2026-07-01 — all before the entry was published. The two Progress ShareFile Storage Zone Controller identifiers, CVE-2026-2699 and CVE-2026-2701, are not in the catalogue and never have been. Because CISA does not remove entries once added, their absence today is not a later withdrawal; the claim did not hold on 2026-07-19 either.
The exploitation claim underneath it is unaffected, and the distinction is the point. The original entry's own sourcing for ShareFile was Shadowserver honeypot telemetry — "first recorded active, in-the-wild attacks attempting to exploit CVE-2026-2699 on Friday", the same day Progress ordered every on-premises Storage Zone Controller powered off (BankInfoSecurity, 2026-07-13). That evidence stood on its own and still does. What the round-up added, and should not have, was a second and independent-looking confirmation from a catalogue that never carried these identifiers. This pipeline's per-CVE coverage made no KEV claim about either identifier at any point — the error entered only in the weekly synthesis, where ten identifiers from four stories were summarised in one clause.
Honeypots run by nonprofit cybersecurity organization Shadowserver Foundation first recorded active, in-the-wild attacks attempting to exploit CVE-2026-2699 on Friday.
CERT Polska published a follow-up analysis on 2026-08-08 of the coordinated 29 December 2025 attacks on Poland's energy sector, adding a victim its January report did not carry: a smaller combined heat and power plant supplying heat to roughly 50,000 residents, whose industrial control systems came under attack at about 07:00 that morning (CERT Polska, 2026-08-08). The analysis took more than three months, which is why the case was held back from the initial report published on 30 January 2026 (CERT Polska, 2026-08-08). The head of CERT Polska, Marcin Dudek, presented the case at DEF CON in parallel with publication (CERT Polska, 2026-08-08). The report carries no actor attribution.
The finding that generalises beyond Poland is the access path. Substations that connect renewable generation to the distribution grid commonly carry cellular routers whose SIM cards sit in a private APN — a carrier-operated private mobile network the distribution system operator uses to reach the remote terminal unit at each site, in this case over DNP3.0 (CERT Polska, 2026-08-08). The operator's requirements covered the serial path to the RTU but said nothing about the router's own administrative interface, so the Teltonika RUTX50 at the compromised wind farm sat with its serial link to the RTU on one interface and an Ethernet link into a VLAN behind the already-compromised central firewall on the other (CERT Polska, 2026-08-08). CERT Polska states this is the first instance it knows of in which a private APN was the route into an OT network, made possible by a configuration that let arbitrary devices inside the APN talk to one another — a configuration its surveys found common in Poland and which it believes is widely deployed in other countries (CERT Polska, 2026-08-08).
The chain ran as follows. Every compromised wind-farm substation in the original wave — more than 30 grid connection points — used a FortiGate as both VPN concentrator and firewall, with the VPN interface reachable from the internet and accepting accounts defined on the device itself without multi-factor authentication; the attacker held administrative privileges on the device and likely used them to obtain a VPN account with reach across all network segments (CERT Polska, 2026-08-08). From inside, the attacker logged into the Teltonika router over SSH repeatedly during December 2025 and tunnelled from it into the private APN; how the router password was obtained could not be determined, and whether a flaw in the device was used is likewise unresolved (CERT Polska, 2026-08-08). From 18 December the attacker scanned the APN for VNC and HTTP services and for the S7 and Modbus industrial protocols, and found a WAGO PFC200 controller exposing a web administration interface on its WAN side, reachable from the APN and still on the default credentials for the admin account; SSH was not enabled on that interface by default, and the sequence in the carrier's logs indicates the attacker enabled it through the web interface before tunnelling onward into the heat plant's OT network, to which the controller had connectivity for both the SCADA systems and the segments holding process-control devices (CERT Polska, 2026-08-08).
Reconnaissance inside the plant ran from 18 to 25 December. Repeated attempts to reach the firewall's LAN-side web interface using the account names admin, user and a username belonging to the company that deploys telecontrol systems at renewable sites all failed, and were retried three days later without success (CERT Polska, 2026-08-08). On Sunday 21 December, eight days before the attack, the attacker scanned for S7 on 102/TCP, Modbus on 502/TCP, CODESYS on 11740/TCP and RTSP on 554/TCP alongside RDP, VNC and web services — and in one subnet the scan began at the address of the SCADA system itself, which CERT Polska reads as evidence of earlier reconnaissance having already identified the high-value targets (CERT Polska, 2026-08-08). On Christmas Day the attacker established successful S7 connections to three Siemens PLCs, most plausibly to prepare the destructive step (CERT Polska, 2026-08-08).
On 29 December activity inside the plant network ran from about 05:30 to about 10:10, meaning the operator's recovery work beginning around 07:30 started while the attacker was still present (CERT Polska, 2026-08-08). The first action after tunnelling through the WAGO controller was to open the SCADA server's web interface, then reach an S7-300 over the S7 protocol, repeating the sequence against an S7-1200 and an S7-1500 (CERT Polska, 2026-08-08). According to statements from plant personnel the PLCs were switched to STOP mode and protected with a password blocking both operating-state changes and control-logic modification, shutting down the steam turbine and the process-water treatment system and interrupting cogeneration; prompt operator response held it to a short outage with no interruption to customer heat or electricity supply (CERT Polska, 2026-08-08). The attacker also reconfigured seven Moxa serial device servers and three Moxa switches — factory reset, password changed, addresses moved to unreachable values such as 127.0.0.1 — and the timing of the HTTP requests supports a high-confidence assessment that this was automated (CERT Polska, 2026-08-08). Connections to two ABB ACS variable frequency drives were observed with no determinable effect, and attempts against Schneider Electric ATV 6xx drives failed because the attacker targeted 80/TCP while those interfaces listened elsewhere (CERT Polska, 2026-08-08).
Two recovery lessons sit in the anti-forensics. The attacker corrupted the partition table of the WAGO controller used as the gateway, and the operator's own factory reset did not repair it, leaving the device unbootable and its logs unrecoverable; the Teltonika router was factory-reset about thirty minutes after the last plant activity and its address set to 127.0.0.1, and the FortiGate was factory-reset last of all, destroying the logs from the initial entry point (CERT Polska, 2026-08-08). The investigation only recovered router evidence because RutOS versions before 7.07 keep the event database through a factory reset (CERT Polska, 2026-08-08). On the plant side, restoring the Siemens controllers to factory settings and reloading logic backups shortened the outage but deleted the controllers' own logs, and Siemens ProductCERT confirmed they could not be recovered (CERT Polska, 2026-08-08).
Triage: an engineering contractor doing legitimate remote maintenance also logs into a cellular router and reaches PLCs over S7, so neither event alone separates the two. The discriminators here are direction and sequence — the session enters from the APN side of a device whose administrative interface was never meant to face it, port scanning precedes the PLC access by days, and the run-state change is followed within minutes by configuration writes to unrelated serial servers and switches. This plant's operators initially read the shutdown as contractor error during scheduled maintenance and reported it for information only; CERT Polska opened an investigation anyway because it knew of similar events, which is what turned an unexplained failure into a confirmed intrusion (CERT Polska, 2026-08-08).
To the best of our knowledge, the use of a private APN to gain access to the OT network was the first instance of this attack vector being observed in a real-world cyberattack.
The attack was made possible, among other factors, by a misconfiguration that allowed arbitrary devices within the private APN network to communicate with one another.
Surveys conducted among organizations using similar solutions indicated that this configuration was commonly encountered in Poland.
Update the genetic-analyzer software this entry names to 4.0.3, 5.0.3, 1.2.6, 1.2.1 or 1.7.4 as applicable, rather than treating the flaw as unpatchable — and for the three end-of-life ABI PRISM and 3130 Series lines, where no update exists, keep the archival control the earlier entry described, because for those products it remains the only option.
Run a software-composition sweep for crypto-js below 4.0.0 across application dependencies, container images and bundled JavaScript, then — for each hit — determine whether WordArray.random() fed a key, token, session identifier or reset code, because that use, not the dependency itself, is the exposure.
Where the answer is yes, regenerate and rotate the affected secrets rather than only upgrading the library: an upgrade changes nothing about a value already produced, and the advisory states previously generated secrets may remain exploitable indefinitely.
Inventory every WALLIX Bastion and move any instance on 12.3.0–12.3.6 or 12.4.0 to 12.3.7 or 12.4.1+; the flaw needs no credentials and no configuration to be present, so an operational appliance on an affected build is exposed by existing at all.
On any Bastion that ran an affected build while reachable, grep /var/log/wabaudit.log (and the SIEM copy) for state-changing actions carrying client_ip="127.0.0.1" — above all an action="add" of type "User" creating a product_administrator — and treat a hit as vault compromise, not just appliance compromise.
Upgrade on-premises N-central to 2026.3.1.10 even where 2026.3.1.7 was already applied — the vendor states Hotfix 2 is required regardless and supersedes Hotfix 1; hosted NCOD instances need no action.
Extend the compromise assessment from the N-central server to the endpoints it manages, looking specifically for a newly registered service running a Cloudflare Tunnel client, which the vendor reports survives revocation of access to the N-central server.
Establish whether any TeamDavid Webbox in your estate or your suppliers' is reachable from the internet, and put it behind a VPN or a filtering reverse proxy that blocks /internalRestart and /.well-known/mta-sts. — a single unauthenticated request to the first drops the service, and repeated requests to the second return heap memory containing other users' credentials.
Rotate the passwords of every account on an exposed TeamDavid instance rather than only the ones you can prove were leaked: credentials are stored reversibly on disk, so any prior file-system or heap exposure has already handed over usable plaintext.
Block outbound 445/TCP from the TeamDavid server, which is what turns the UNC-path handling in its search and messaging functions into NetNTLM capture or SMB relay against your own domain.
Audit the client-isolation setting on every private APN your OT estate reaches, and enable it: this intrusion crossed from a wind-farm substation to an unrelated heat plant only because arbitrary devices inside the operator's private APN could open connections to each other.
Enumerate what answers on the APN-facing interface of each device connected to that APN and close or re-credential its administrative services — the pivot device here was a WAGO PFC200 whose WAN-side web interface was reachable from the APN on default 'admin' credentials, and SSH was then turned on through that interface.
Upgrade every self-hosted Metabase to at least 0.58.24 / 0.59.21 / 0.60.17 / 0.61.11 / 0.62.9 / 0.63.5, then — where /api/session/reset_password was publicly reachable — revoke all active sessions by clearing the core_session table, delete unrecognised API keys, and rotate the credentials Metabase holds for every connected database, because administrator access exposes them.
Search reverse-proxy and Metabase ingress logs across the entire pre-upgrade exposure window for a POST to /api/session/reset_password returning 400 followed by a GET to /api/user/current returning 200 from the same source, and treat any hit as a compromised instance rather than a failed reset attempt.
2026-08-09T1315Z-audit· audit · Opus 5 · window 168 h · 4 entries published
Verification & coverage notes
Audit window 2026-08-02T13:09:58Z → 2026-08-09T13:15:57Z (168.1 h): 80 entries across the 10 run records whose start falls inside it (the 80 entries carry 9 distinct run ids; one weekly was a zero-entry stand-down). 65 of 80 verified clean against primary sources; 14 imprecisions; 1 factual error.
Four retrospective truth passes covered every window entry in batches of 20, alternating models, each fetching ground truth rather than re-reading the entries' own citations. Three independent coverage re-sweeps re-researched the window as if for the first time. The full findings are in docs/audits/2026-08-09-weekly-quality-audit.md; this record carries the operational summary.
The one factual error is defender-consequential and this run corrected it. The 2026-08-05 entry on CVE-2026-17583 told readers, in its title, summary, cves[] status and action item, that Thermo Fisher offers no fix for the missing integrity checking on Applied Biosystems genetic-analyzer result files, and that the only available control is architectural. The advisory it cited carries five vendor fixes naming patched versions with download links, and those updates implement digital signatures on the instrument software — the exact control the entry argued was unavailable. Only the three end-of-life ABI PRISM and 3130 Series products are genuinely unfixed. The advisory is at revision 1 and was never revised, so the fixes were available when the entry was composed. Root cause: the HTML rendering of the CISA advisory dropped the mitigations block on two of the three transports the run tried; the machine-readable CSAF JSON carries all fifteen remediation records, the eight per-product vendor fixes among them. That transport lesson is recorded for future runs.
A published claim that a reader could have acted on was wrong, and this run corrected it too. The 2026-07-19 weekly round-up said four classes of exploited internet-facing software were "every one KEV-listed". Eight of the ten identifiers involved are in the catalogue and were added before that entry published; the two Progress ShareFile identifiers never were. Entries are not removed from the catalogue once added, so the claim was already false when written. The exploitation itself was real and separately sourced — the error was an aggregate claim asserting more than its weakest member supported.
Coverage: the research and KEV surfaces came back clean; two genuine misses were recovered. All six in-window KEV additions were already published. Thirteen of the twenty-one items the research-blog sweep surfaced were confirmed already covered. The carried-forward Gladinet CentreStack gap turned out to have been published on 2026-08-03, closing that watch item. Recovered and published here: the WALLIX Bastion REST API authentication bypass (CVSS 4.0 base 10.0, unauthenticated, yielding the appliance's privileged-credential vault, relayed by CERT-FR on 2026-08-06 with the reporting researchers committed to publishing full technical details in September), and CVE-2026-71851 in crypto-js, a twelve-year-old generator that reduces a nominal 128-bit secret to roughly 2^39 possibilities and was under active exploitation while its discoverers were still investigating.
Eight further items cleared the relevance gate and were queued rather than dropped, alongside eight recoverable residuals seeded from the 2026-08-03 stand-down — sixteen open rows in total. Seven were queued because they could not be composed inside this run's wall clock; the eighth, Wazuh, was queued for a substantive reason given below, not for time. They are written to state/coverage_backlog.md, which this run also created: verified-but-unpublished items previously had nowhere to go, and the audit found that the nine residual items a stood-down weekly listed on 2026-08-03 were never published by anything, because the next intel run's window is 24–26 h and the next weekly's is the following ISO week. Both recency gates made them permanently unreachable. Every intel run now reads that file in preflight and works it down.
One item was deliberately not published despite clearing the gate. The Wazuh 4.14.6 advisory set — two critical cluster-protocol file-write-to-root chains and a pre-authentication stack overflow on the enrollment daemon's default listener, in a SIEM platform this constituency's own SOCs run — could not have its CVE-identifier-to-advisory pairing confirmed from the advisory pages read in this run. An unconfirmed pairing is a guess rather than a transcription, and publishing one would have repeated the defect class this audit is reporting. It is on the backlog with that verification named as the precondition.
Coverage gaps: the OT/ICS research-lab surface (dragos, nozomi-networks, claroty-team82, sans-ics, industrialcyber-co) contributed nothing across the whole window, and five essential-tier sources (cert-at, cert-eu, enisa, enisa-euvd, ncsc-uk) likewise, all while reporting successful fetches. inside-it.ch returned 403 on both direct and reader transports, leaving one home-region claim uncorroborated. tenable-research feed recipe needs fixing.
Watchlist: none configured — the product and supplier sweeps are no-ops.
Closed-source intake: intel/ carries only its README; no drops in window, no intake sub-agent spawned.
Essential-coverage: all essential sources in every slice were attempted; the zero-contribution finding above is a readability question, not a fetch miss.
Sources: one new candidate added this run — coinspect-research, the publisher that broke the CryptoJS "Ill Bloom" active-exploitation story this audit recovered.
2026-08-09T0412Z-intel· Claude Opus 5 · window 26 h · 4 entries published
Verification & coverage notes
A quiet weekend window. The gap to the previous fire was 24 h, giving a 26 h window that covers Saturday 2026-08-08 and the small hours of Sunday 2026-08-09. Every national authority in the essential floor — the CISA KEV catalog and advisory feeds, ENISA EUVD, NCSC-NL, BSI CERT-Bund, ANSSI/CERT-FR, CERT-EU, CERT-PL, NCSC-CH, NCSC-UK, CERT.at — was fetched and confirmed to have published nothing after Friday 2026-08-07. That is normal business-day cadence, not a coverage failure, and the KEV catalog has added nothing since Progress Kemp LoadMaster on 2026-08-07, which the previous run already covered. Four entries publish — three new findings and one update, the last of them recovered by the verification pass rather than by the research sweep.
Out-of-window inclusion, stated openly. The TeamDavid entry was published on 2026-08-07 and therefore sits roughly a day outside this run's window. It is included as first coverage anyway, and the reason is a defect in this pipeline rather than a judgement about the item: the InfoGuard Labs source record carried a listing-extraction fault that hid every publication date on that site, so no previous run could ever have seen it. The research sub-agent found and fixed the feed recipe during this fire and flagged the disclosure explicitly rather than letting it disappear behind the recency rule. Dropping it would have left a silent blind spot on roughly 12,000 internet-facing instances of a collaboration suite sold specifically to German-speaking organisations that want to avoid a hyperscale cloud — which is the home region and, for many public bodies, the estate itself. The entry carries event_date: 2026-08-07 and a sourcing note stating the lag, so no reader is misled about freshness.
A name collision, caught late, that would have manufactured a third victim. One research agent reported LexisNexis as a third confirmed Metabase data-theft victim; another traced the same thread to an unrelated earlier breach and dropped it. A re-read of BleepingComputer supported neither: it reports LexisNexis warning customers about a cyberattack at a third-party vendor affecting its Diligence, Metabase API and Newsdesk services, without stating a link to the Metabase flaw and without establishing whether customer data was exposed. The first draft of the entry carried that as a carefully hedged clause. Verification then established the fact that changes the disposition entirely: LexisNexis's "Metabase API" is LexisNexis's own news-aggregation product, which shares nothing with Metabase the business-intelligence platform except the word, and the two sibling services named alongside it in the same sentence are LexisNexis products too. Even hedged, the clause invited a reader to infer a third compromised Metabase instance from what is a coincidence of naming. It has been removed rather than disambiguated, and the entry now names Framework and Tally as the only confirmed victims. The source sentence is also self-contradictory on its face — it says the company did not specifically state a link to the Metabase API and then that it did say its Metabase API was impacted — so the original entry's "BleepingComputer is explicit that…" attribution claimed more than the sentence can carry, and is gone with it.
Sourcing corrections made during composition. The Metabase GitHub security advisory is quoted second-hand through BleepingComputer rather than cited directly: GHSA-vwf4-m7j8-wcjf is absent from OSV and github.com is not reachable from this environment, so the advisory page was never fetched and is not listed in sources[]. The CVSS 10.0 rating and the active-exploitation wording rest on BleepingComputer's reproduction of it, which the entry states. For the TeamDavid entry, the discloser groups several CVE identifiers under single headings without saying which identifier names which flaw; pairing them by position would have been a guess, so every identifier, base score, per-flaw mapping and the affected bound were read from the individual published CVE records instead. Those records are the same researchers' findings with a second publisher, not an independent assessment, so the entry is marked single-source and its credibility stays at 2 rather than being lifted to 1 by republication. One internal inconsistency is disclosed in the entry: the record for CVE-2026-54211 describes an authenticated attacker while its own CVSS vector carries PR:N, and the entry follows the description, which agrees with the discloser.
One verification finding was considered and declined. The second verification pass argued the Metabase entry should be critical with an immediate-action block, on the strength of this store's own precedent: the criticals it sampled all share the same shape — unauthenticated, CVSS around 10, confirmed exploitation, patch available. The argument is a good one and the precedent is real, but the bar for that priority requires every one of its elements to hold, and the first does not: the flaw was disclosed on 2026-08-06, outside this run's window, and this entry is late first coverage carried under the developing-window allowance rather than a fresh disclosure or a fresh weaponisation. Where the remaining doubt sits — is the action time-critical to the hour or the day, three days after a fix shipped and with no reporting of ongoing mass exploitation — the rule resolves it downward, not upward. It stays high. The disagreement is recorded here rather than resolved silently, because the next audit should be able to see that the question was asked and on what grounds it was answered.
The CERT Polska deep dive is single-source under the national-CERT carve-out — the national CSIRT reporting its own forensic investigation in its own jurisdiction. Its report makes no actor attribution, and the entry says so rather than importing the contested cluster labelling attached to the wider December 2025 campaign from the pipeline's earlier coverage. The report PDF could not be read usefully by local text extraction, which silently truncated sentences mid-clause; the reader transport returned it intact, and every quote was checked as a literal substring of the fetched text before the entry was written.
borderline-drop: MSI Radix AXE6600 Wi-Fi router command-injection CVEs (CVE-2026-71990 / -71991 / -71992 / -71993, EUVD-listed 2026-08-08/09 at CVSS 9.3) — consumer and gaming SOHO networking hardware sits outside the critical-infrastructure, government and public-sector asset profile, and no exploitation is reported that would override that.
out-of-window: Retelit SpA compromise claimed by Qilin (IrpiMedia investigation) — underlying compromise early June 2026, leak-site claim 2026-07-11, investigative article 2026-08-04; outside even the 72 h developing window, with no fresher development found.
borderline-drop: Head Mare trojanizing TrueConf client installers (Kaspersky, reported 2026-08-08) — unauthenticated access to TrueConf Server over a port open by default, ending with the legitimate client installer on the server replaced by a backdoored build served to participants as an update. Dropped on constituency relevance: the reported victimology is Russian organisations and TrueConf has effectively no footprint in Swiss or EU government estates. The transferable mechanic is named here rather than lost, because it generalises past the product: an organisation that does not run the compromised conferencing server can still be infected by joining a compromised counterparty's server and accepting its installer.
No delta: Phoenix Contact CHARX SEC-3xxx firmware 1.9.1, checked deliberately because the vendor committed to shipping it no later than 2026-08-12. Still unreleased, advisory unchanged since 2026-07-30. Worth re-checking before the deadline.
Not carried: InfoGuard Labs' TeamDavid disclosure was initially dropped by the research sub-agent on the recency gate and restored by the completeness sweep. See the note above.
Coverage gaps: ssd-disclosure (robot-challenge interstitial on both transports — regression from 2026-08-08); prodaft (fifth stale run; dead subdomain in the source note now corrected); csirt-acn-it (listing returned no date-bearing rows); technadu (JS-rendered homepage, no dated listing); sans-newsbites (no August issue indexed yet); cisa-news (feed items carry no dates); paradigm-shift-research (SPA shell, no server-rendered listing); siemens-productcert-csaf (directory index 403s as documented — the per-advisory recipe works but no Siemens advisory surfaced this run to exercise it); trellix (index stale since April–May 2026); flatt-security (genuinely monthly cadence, newest item 2026-06-01); claroty-team82 (listing carries no dates; both plausibly-recent titles drilled and dated June 2026).
Essential-coverage: no misses. All 15 active essential sources were attempted across the S1 and S2 slices.
No watchlists are configured for this deployment, so the product and supplier sweeps are no-ops and no Watchlist: line is reported. No closed-source drops were present under intel/, so no intake ran.