01Apple patches a CoreGraphics zero-day exploited against targeted iPhone users; a crafted file can lead to code execution. Apple's 2026-09-28 updates (iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1) fix CVE-2026-86950, a CoreGraphics out-of-bounds write that can run arbitrary code when a crafted file is processed. Apple says it may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27, and CISA added it to the KEV catalog on 2026-09-29. No source states how the file is delivered. Since 2026-09-30 a public proof of concept crashes unpatched devices with a crafted PDF font. →
02Microsoft DART: one reset-compromised identity became a malicious pipeline that harvested Kubernetes credentials. Microsoft's incident-response team describes an intrusion by Storm-3068 that began when the actor gained a user account through a successful self-service password reset and registered its own authentication methods. It then enumerated Azure DevOps, created a malicious pipeline that collected kubeconfig files, added Atera and Chisel through modified pipeline scripts, and committed seven stolen kubeconfig files to a repository. Microsoft names no victim, sector or date, and no source says how the reset was completed. →
03Microsoft: Star Blizzard adds mass mailings and a one-click scheduled-task chain to its CosmicPulse backdoor delivery. Microsoft Threat Intelligence reports that the Russian state actor Star Blizzard has moved from purely targeted spear-phishing to at least 13 large-scale campaigns since January 2026, sent from accounts on compromised WordPress and cPanel websites and lured with closed-door think-tank event invitations. Its new RedFlick delivery chain needs one user interaction and installs the CosmicPulse Python backdoor through scheduled tasks; Microsoft counts over 100 affected organizations, primarily in the US and UK, and names governments and diplomatic and multilateral bodies among the targets. →
The Ticino commune of Manno stated in a signed notice dated 2026-09-16 that on 4 August 2026 part of its servers suffered an attack that encrypted data (Comune di Manno, 2026-09-16). The commune isolated the affected server immediately and, per the notice, restored data and operations from existing backups in the course of the afternoon (Comune di Manno, 2026-09-16). It reported the case to the competent authorities, filed a criminal complaint against persons unknown, and told residents to distrust unexpected letters or e-mails that demand urgent payments or personal or financial data and to verify through official channels (Comune di Manno, 2026-09-16). The notice names no actor, no intrusion vector, and does not say whether data left the network. Inside IT's teaser of 2026-09-29 calls it a ransomware attack and says a backup allowed a quick return to normal operation (Inside IT, 2026-09-29). The tracker's leak-post screenshot shows a countdown timer of about three days eleven hours when it was captured on 2026-09-28, which points to expiry around 1 October; the post describes no dataset (Ransomware.live, 2026-09-28).
On 2026-09-28, 55 days after the encryption, Ransomware.live recorded that the ransomware group SafePay had listed manno.ch on its leak site (Ransomware.live, 2026-09-28). That is the group's claim as recorded by a tracker: the commune has not confirmed it, and the record shows neither what data the listing claims nor that it concerns the 4 August event.
on 4 August 2026 part of the commune's servers suffered an attack (translated from Italian)
which resulted in the encryption of the data (translated from Italian)
subsequently a complaint was lodged against (translated from Italian)
the population is urged to pay attention to unexpected communications (translated from Italian)
Microsoft's Defender Experts incident-response team (DART) describes a malware-free, exploit-free intrusion by the actor it designates Storm-3068 that began when the actor gained access to a user account through a self-service password reset and took full control of the identity by registering its own authentication methods (Microsoft Defender Experts, 2026-09-29). Microsoft does not say how the reset challenge was passed. With that persistent access, the actor used legitimate administrative tools and automated scripts to enumerate Azure DevOps repositories, projects, pipelines and deployment environments, then created a malicious pipeline that deployed a kube agent and ran jobs to collect kubeconfig files; that pipeline inherited the compromised account's permissions and was authorized to access more than 50 resources (Microsoft Defender Experts, 2026-09-29). The actor also modified pipeline scripts to install the Atera remote-management agent and download the Chisel tunneling utility, and ran Chisel to open a reverse tunnel to an external address, which Microsoft describes as an attempt at alternative remote access and at exposing the Kubernetes API server (Microsoft Defender Experts, 2026-09-29). Investigators rebuilt the sequence from Azure DevOps audit logs and Git version history and found seven stolen kubeconfig files committed to a repository (Microsoft Defender Experts, 2026-09-29). The full report adds that the actor registered a new MFA method and deleted the account's legitimate MFA methods, started the kube agent by downloading and running a third-party script with several jobs, saved the kubeconfig files into an existing kubeconfigs folder of the target repository (each holding a cluster API endpoint, certificate-authority data and a service-account token), and expanded access in a matter of hours rather than days (Microsoft Defender Experts, Cyberattack Series report Q3 2026, 2026-09-29).
Where it surfaces: identity-provider audit logs show a completed password reset followed by new authentication-method registrations on the same account (Microsoft Defender Experts, 2026-09-29), and the full report's attack flow adds deletion of the legitimate methods (Microsoft Defender Experts, Cyberattack Series report Q3 2026, 2026-09-29), while Microsoft advises watching for repeated resets or resets against many users; DevOps audit logs show one identity enumerating repositories and pipelines and then creating or modifying pipelines; Git history shows pipeline scripts that install a remote-management agent or download a tunneling tool, and kubeconfig files committed to a repository; build-agent egress shows a reverse tunnel to an external address (Microsoft Defender Experts, 2026-09-29). Microsoft's recommended controls are to keep privileged accounts out of self-service password reset or protect them with phishing-resistant multifactor authentication, enforce branch protection and approvals for code changes, restrict direct commits to critical branches, limit who can create, modify or run pipelines, and apply least privilege across identity, DevOps and cloud (Microsoft Defender Experts, 2026-09-29).
Triage: a user completing a password reset and then registering authentication methods is routine. The sequence that separates this activity is the same identity, right after the reset, enumerating Azure DevOps repositories and pipelines in bulk and then creating or editing a pipeline.
The intrusion began with Storm-3068 gaining access to a user account through a self-service password reset process and then taking full control of the identity by registering its own authentication methods.
The threat actor added seven stolen kubeconfig files to a repository, providing the credentials needed to access targeted Kubernetes clusters.
Using Azure DevOps audit logs and Git version history, investigators reconstructed the next stage of the intrusion.
Microsoft Threat Intelligence reports that Star Blizzard, which CISA attributes to Russia's FSB Centre 18 (Microsoft Threat Intelligence, 2026-09-29) and which CyberScoop lists under the names SEABORGIUM, Callisto Group, TA446 and COLDRIVER (CyberScoop, 2026-09-29), has since January 2026 added large-scale phishing to its targeted spear-phishing: at least 13 distinct campaigns of tens to hundreds of emails each, aimed primarily at NGOs, think tanks and government organizations, with Ukrainian individuals and institutions, diplomatic and multilateral bodies and financial organizations also named (Microsoft Threat Intelligence, 2026-09-29). Microsoft counts over 100 affected organizations, primarily in the United States and United Kingdom, and infers the actor now uses a mass-mailing platform (Microsoft Threat Intelligence, 2026-09-29). The lures are invitations to closed-door roundtables that borrow the names of real think tanks, often written to look like internal mail from the target's own organization; the first message is usually without an attachment, and a reply is answered with a password-protected RAR or ZIP archive whose password is shown as an image, although the Ukraine-focused campaigns and a few later ones attached the lure directly (Microsoft Threat Intelligence, 2026-09-29). Since March the sending accounts sit on WordPress and cPanel websites, replacing free Proton and Microsoft consumer mailboxes, and Microsoft assesses with high confidence that Star Blizzard compromised those sites (Microsoft Threat Intelligence, 2026-09-29). One March campaign instead gave respondents a link to the DarkSword iOS backdoor installation, which Microsoft says Proofpoint reported, and a mid-August campaign employed steganography to conceal identifiers (Microsoft Threat Intelligence, 2026-09-29).
The delivery chain changed three times in 2026 and replaced the ClickFix flow of earlier campaigns with one that needs a single user interaction (Microsoft Threat Intelligence, 2026-09-29). From mid-January, a virtual hard disk file in the archive held a shortcut disguised as a PDF that started a hidden console window and a batch script; the script opened a decoy PDF and ran the SSH client with PermitLocalCommand enabled to download and run a remote MSI, which created a scheduled task that used control.exe to fetch the CosmicPulse downloader disguised as a Control Panel applet (Microsoft Threat Intelligence, 2026-09-29). From April the MSI created three scheduled tasks named like network components: one beaconing host and user names to the command server and running a remote DLL through a WebDAV path, one preparing WebDAV support, and one running control.exe against a remote path to execute the next stage (Microsoft Threat Intelligence, 2026-09-29). From July, a shortcut used conhost.exe and curl to download a PDF, and PowerShell then searched that file for a marker, decoded the Base64 blob that follows it and ran the result to fetch another MSI (Microsoft Threat Intelligence, 2026-09-29). The downloader fetches two ZIP archives, stores an encrypted AES key in a registry key under HKCU\Software\Classes, and a Python bootstrapper decrypts and runs the CosmicPulse payload, which is publicly tracked as YESROBOT (Microsoft Threat Intelligence, 2026-09-29).
Where each step surfaces: mail-flow logs show bulk initial-contact invitations and a follow-up with a password-protected archive; process-creation telemetry with parent lineage shows a hidden console window spawning a command shell that runs an SSH client, msiexec started from a script, control.exe loading a remote path, and conhost.exe with curl downloading a PDF that PowerShell then parses; scheduled-task creation events show tasks named like network components, one pointing at a WebDAV path; registry telemetry shows a key written under HKCU\Software\Classes. Microsoft's recommended controls include phishing-resistant authentication, Conditional Access, Safe Links and Safe Attachments with zero-hour auto purge, EDR in block mode, and Windows Firewall rules restricting outbound SSH connection attempts to what the business needs (Microsoft Threat Intelligence, 2026-09-29).
Triage: Microsoft's discriminators for this actor are a sender whose organization name appears only in the local part of the address on an unrelated domain, bulk delivery, an initial message that is usually without an attachment and a follow-up archive after a reply (Microsoft Threat Intelligence, 2026-09-29).
Since January 2026, Microsoft observed at least 13 distinct large-scale phishing campaigns targeting primarily NGOs, think tanks, and government organizations worldwide.
By contrast, the RedFlick infection flow only requires a single user interaction, reducing friction in the compromise process.
Microsoft Threat Intelligence assesses with high confidence that these websites have been compromised by Star Blizzard for this purpose.
The emails in these RedFlick campaigns are often sent in bulk.
CVE-2026-86950 is an out-of-bounds write in CoreGraphics, the graphics component shared by iOS, iPadOS and macOS, and processing a maliciously crafted file can lead to arbitrary code execution (Apple, 2026-09-28). Apple states that it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27" (Apple, 2026-09-28). The fix, "improved bounds checking", ships in iOS and iPadOS 26.7.1 (Apple, 2026-09-28), macOS Tahoe 26.7.1 (Apple, 2026-09-28) and macOS Sequoia 15.8.1 (Apple, 2026-09-28); Meta Product Security is credited with the report. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-29 and attached its forensic-triage requirements to the listing (CISA, 2026-09-29). ENISA's vulnerability database scores it CVSS 3.1 8.8, network vector with user interaction required (ENISA EUVD, 2026-09-29). The macOS advisories repeat Apple's iOS-scoped exploitation sentence, so Apple does not claim exploitation on macOS.
Nothing about the attack itself is public: Apple gave no details on how many people were targeted, whether any attempt succeeded, or when exploitation began (The Hacker News, 2026-09-29), and no delivery mechanism is stated. SecurityWeek reads the component's role in 2D graphics and PDF rendering as meaning a file could arrive through web pages, email attachments or messaging apps, where automatic previews could allow zero-click exploitation; that is SecurityWeek's inference, and it also notes Meta would not say whether WhatsApp was involved (SecurityWeek, 2026-09-29). It also says iOS 27 and macOS Golden Gate 27 do not appear to be affected. No indicators or behavioural detections have been published by Apple, Meta or CISA, so version compliance is the only measurable lever: device-management inventory of iPhones and iPads still on the iOS 26 branch below 26.7.1, and of Macs on Tahoe or Sequoia below the fixed builds.
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
An out-of-bounds write issue was addressed with improved bounds checking.
Apple Security
Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
the company offered no details on how many individuals were targeted, if any of those attempts were successful, or when the first instance of CVE-2026-86950 exploitation occurred
The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs.
The published analysis does not describe or test a WhatsApp delivery path.
Researchers at Calif published a public proof of concept for CVE-2026-86950 on 2026-09-30, built from a public binary comparison of iOS 26.7 and 26.7.1: a PDF with a crafted TrueType font that triggers a controlled out-of-bounds write in CoreGraphics and crashes unpatched iPhones and Macs, with generation scripts and a sample PDF in a public GitHub repository (The Hacker News, 2026-10-01). Calif demonstrates a crash and a controlled write to two adjacent 16-bit values, not code execution, did not obtain the in-the-wild sample and cannot say how the attacker completed the chain (The Hacker News, 2026-10-01). The harness reaches the flaw through the ImageIO thumbnail path an app uses to preview a received attachment (The Hacker News, 2026-10-01). Calif pointed to new font-checking code in WhatsApp's attachment scanner as circumstantial evidence of a possible delivery path; the published analysis does not describe or test that path, a WhatsApp sentence in the first version was removed after publication, and WhatsApp has published no advisory linking the flaw to its products (The Hacker News, 2026-10-01).
Priority is lowered from high to routine: a US military data breach with no vector or tradecraft defenders can act on. The title, summary, body and the earlier 2026-09-30 update section are trimmed to routine-incident length, and the sourcing note is plain provenance. The exposed data is now described as the letter recipient's rather than every affected person's, and the takeaway drops an access-logging recommendation no source makes.
Military Times quotes the notification letter as exposing its recipient's Social Security number and at least one further identifying field (Military Times, 2026-09-24). The entry previously generalised this to every affected person and advised access logging, which no cited report discusses. CNN reports that the data was not encrypted and that encrypting sensitive data is a standard security practice (CNN, 2026-09-25).
Adds that CISA's KEV catalog marks CVE-2026-20316 as used in known ransomware campaigns. Cisco's fixed-release table covers 7.0 and earlier, not only 7.0, and the detection and triage text claimed that any login under the static account has no legitimate use, which Cisco does not say. Detection now leads with Cisco's log check and the unsupported triage line is removed. The sourcing note is rewritten, and the US federal deadline is gone. Hot-fix file names the current advisory no longer lists are dropped, Cisco's warning about existing compromise is attributed to its hot fix files, and an uncited statement that the server holds credentials for every managed device is removed.
CISA's Known Exploited Vulnerabilities catalog marks CVE-2026-20316 as used in known ransomware campaigns (CISA KEV catalog, 2026-07-29). Cisco's fixed-release table, added in the advisory's revision of 2026-09-16, lists 7.0 and earlier as affected, with 7.0.10 as the fix, so releases older than 7.0 are in scope too (Cisco PSIRT, 2026-07-29). Cisco does not name the static account or say it has no legitimate use, so a login under it is not a discriminator the advisory supports. The check Cisco publishes is the log search for package_info entries naming /var/tmp/license.tmp, and revisions since first publication send any device with indicators to TAC because its hot fix files may not address an existing compromise (Cisco PSIRT, 2026-07-29).
The earlier text described CVE-2026-5787 and CVE-2026-6973 as an exploited pre-authentication chain, marked all five May EPMM CVEs as exploited and KEV-listed, and named the European Commission, the Dutch data protection authority, the Dutch judiciary council and Finland's Valtori as victims of this wave. Ivanti reports limited exploitation of CVE-2026-6973 only, which needs an admin login, and no exploitation of the other four. Only CVE-2026-6973 is in KEV, and no source ties those organisations to the May wave. The corrected text also covers the January credential-reuse path CERT-FR and BSI describe and the Apple Device Enrollment condition that limits CVE-2026-7821. The May fixed builds fall within Ivanti's later critical EPMM update of 2026-06-09.
The earlier text described an exploited pre-authentication chain from CVE-2026-5787 into CVE-2026-6973, marked all five CVEs exploited and KEV-listed, and named four European public bodies as victims of this wave. Ivanti reports very limited exploitation of CVE-2026-6973 alone, which requires admin authentication, and no exploitation of the other four (Ivanti, 2026-05-07); only CVE-2026-6973 is in KEV (CISA KEV catalog, 2026-05-07); and no cited source names victims of the May wave. The path CERT-FR describes is reuse of administrator passwords stolen in January (CERT-FR, 2026-05-07). CVE-2026-7821 affects only deployments that use and have configured Apple Device Enrollment (BleepingComputer, 2026-05-07).
The CVSS 4.0 score of 8.4 for CVE-2026-82717 had no citable source and is withdrawn from the scores and the title. The 9.1 for CVE-2026-81642 is cited to NCSC Switzerland, and NLnet Labs' own release announcement now supplies the severities, critical and high, and shows that 1.26.1 fixes nine flaws, not two. The advisories are treated as one assessor, NLnet Labs, restated by NCSC Switzerland.
NLnet Labs rates CVE-2026-81642 critical and CVE-2026-82717 high in its release announcement, and 1.26.1 fixes nine vulnerabilities rather than the two named earlier (NLnet Labs via oss-security, 2026-09-16). The CVSS 4.0 score of 9.1 for CVE-2026-81642 is NCSC Switzerland's figure (NCSC Switzerland, 2026-09-18). No citable source publishes a CVSS score for CVE-2026-82717, so the 8.4 given for it earlier is withdrawn.
The title, headline, summary and description had presented exploitation as confirmed by Google. Google's spokesperson did not respond to TechCrunch, and TechCrunch words Google's position both as possible limited, targeted exploitation and as confirmed exploitation. The exploitation wording is now attributed to TechCrunch's reporting and the inconsistency is stated, with CISA's KEV listing the only unhedged exploitation signal. The flaw description cites CISA's KEV record and TechCrunch, no third-party severity score is given, and the takeaway cites TechCrunch for its note on surveillance vendors.
Google did not confirm exploitation to TechCrunch directly: a Google spokesperson did not return TechCrunch's request for comment. TechCrunch words Google's position two ways, as indications that the bug "may be under limited, targeted exploitation" in its summary and as a bug that "was exploited in limited and targeted cyberattacks" in its opening sentence (TechCrunch, 2026-09-16). CISA lists CVE-2026-58704 as a known exploited vulnerability (CISA KEV catalog, 2026-09-16).
The 8.1 and 7.5 scores came from the MITRE CVE records, and the cited advisory pages do not carry them. They are removed from the text and the structured data, and the severity sentence now cites JFrog's advisory page, which rates both flaws High. The fixed-build guidance now requires 7.133.11 or later for CVE-2026-42016, which JFrog names as its only fixed build, and states the conflict between JFrog's CVE-2026-42018 table and Wiz's corrected, higher builds. The scope-escalation consequence is attributed to Wiz, the compromise check adds Wiz's signing-key reset and in-memory implant caveat, the triage line names the bare token path correctly, the kill-chain, post-exploitation and patch-velocity paragraphs now cite Wiz, and the sourcing note keeps provenance only. The log-search guidance now counts a hit as successful exploitation only when both requests returned HTTP 200, and the takeaway no longer says one fix leaves the chain intact.
Take the higher fixed build for CVE-2026-42018. JFrog's table names 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8 as the patched builds, while its affected ranges on the last four branches end at those same builds (JFrog, 2026-08-13). Wiz corrected its fixed versions on 2026-09-11 to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20 (Wiz Research, 2026-09-10). CVE-2026-42016 is fixed only from 7.133.11, so an instance on the 7.111, 7.117 or 7.125 branch needs 7.133.11 or later to close CVE-2026-42016, on a build that also carries that branch's CVE-2026-42018 fix (JFrog, 2026-07-27). An instance that shows exploitation needs its Access token signing key and certificate reset as well as an upgrade, because a stolen key keeps forging valid tokens after patching (Wiz Research, 2026-09-10). JFrog's advisory page rates both flaws High and gives no numeric score (JFrog, 2026-07-27). The CVSS 8.1 and 7.5 figures shown earlier are not on that page and are no longer shown. A log hit counts as successful exploitation when both requests returned HTTP 200, as in every case Wiz observed (Wiz Research, 2026-09-10).
Several flaw descriptions, counts and version ranges rested on relays and on CVE-record mirrors rather than on HPE's own bulletins, which are now the primary source: the Fabric Composer bulletin lists 52 CVEs (not 45) affecting 7.3.3 and below, the AOS-CX bulletin lists 34 CVEs, HPE lists 10.18.0001 as the affected 10.18 build while CERT-FR reads the branch as all 10.18.x before 10.18.1002, and the end-of-maintenance 10.10 branch has no fix for the lower-rated AOS-CX flaws. HPE's exploitation statement is quoted as written. The SSH-daemon description and its evidence quote now come from HPE's own bulletin, and the takeaway now rests on NCSC-NL's warning about internet-reachable management interfaces.
HPE's own bulletins correct several points. The Fabric Composer bulletin lists 52 CVEs, not the 45 in NCSC-NL's mirror (NCSC-NL, 2026-09-03), and names Fabric Composer 7.3.3 and below as affected, with no lower version bound (HPE, HPESBNW05133, 2026-09-01). The AOS-CX bulletin lists 34 CVEs, CVE-2026-73749 plus 33 others scored 4.9 to 8.8 (HPE, HPESBNW05134, 2026-09-01), more than the 23 further flaws BleepingComputer counted (BleepingComputer, 2026-09-03) and the 26 CVEs in NCSC-NL's advisory (NCSC-NL, 2026-09-03). For CVE-2026-73749 on the 10.18 branch, HPE lists 10.18.0001 as the affected build (HPE, HPESBNW05134, 2026-09-01) and CERT-FR reads the branch as every 10.18.x release before 10.18.1002 (CERT-FR, 2026-09-02). Either way the fix is 10.18.1002, and the earlier range of 10.18.0000 to 10.18.0001 did not come from HPE's bulletin. On the end-of-maintenance 10.10 branch only Critical-severity flaws were fixed, so the lower-rated AOS-CX flaws have no fix there (HPE, HPESBNW05134, 2026-09-01). HPE's exploitation statement is that it knows of no public discussion or exploit code, not a statement about active exploitation (HPE, HPESBNW05133, 2026-09-01). HPE titles CVE-2026-76658 an unauthenticated remote code execution in the Fabric Composer SSH daemon, not an authentication weakness (HPE, HPESBNW05133, 2026-09-01). The earlier takeaway described Fabric Composer's role without a cited source. It now rests on NCSC-NL's warning that an internet-reachable SSH management interface lets unauthenticated attackers take over the data-center network behind it (NCSC-NL, 2026-09-03).
A sentence contrasted Cisco's product scope with the title of the MITRE CVE record rather than a cited advisory. It now makes the scoping point from Cisco's own advisory, and the sourcing note drops the rating narration. The detection guidance now points at the default Layer 3 VRF that Cisco names, the discovery is described as a TAC support case without calling it internal, and an uncited paragraph on two unrelated Cisco advisories is removed. The takeaway now asks for the patch or the iACL workaround ahead of the maintenance window and drops two claims no source makes, that exploitation compromises the fabric itself and that the ports have no legitimate use.
Hunt for connections to TCP ports 43210 and 43211 on the switches' addresses in the default Layer 3 VRF, where Cisco says the ports are reachable (Cisco PSIRT, 2026-09-02). Cisco found the flaw while resolving a TAC support case, and the advisory does not describe the case as internal (Cisco PSIRT, 2026-09-02).
The main text cited Google's release note for the crafted-HTML-page vector, sandboxed code execution and CWE-843, which come from CISA's KEV record, and carried CISA-ADP's CVSS 8.8 score from CISA's enrichment of the CVE record rather than from a cited advisory, so no score is shown. It also called the flaw a sandbox-escape primitive although code run through it stays inside the renderer sandbox, and said no source described chaining, while Proofpoint has since documented the BlueMoon kit chaining it with a sandbox escape and a Windows privilege-escalation flaw. CVE-2026-85043 is Google's incomplete cleanup in Network, not an information disclosure. Detection now covers the Chrome browser process running curl to download and execute a file, which Proofpoint documents for the BlueMoon chain.
CISA's KEV record, not Google's release note, is the source for the crafted-HTML-page vector, code execution inside the sandbox and the CWE-843 class (CISA KEV catalog, 2026-09-04). The earlier text gave CISA-ADP's CVSS 8.8 score, which comes from CISA's enrichment of the CVE record rather than from a cited advisory, so no score is shown. It also called the flaw a sandbox-escape primitive. Code run through it stays inside the renderer sandbox (CISA KEV catalog, 2026-09-04), so it is not a sandbox escape. The earlier statement that no source described chaining no longer holds: Proofpoint documents the BlueMoon exploit kit chaining CVE-2026-85046 with a V8 sandbox escape and a Windows kernel privilege-escalation flaw (Proofpoint, 2026-09-08). Google lists CVE-2026-85043 as incomplete cleanup in Network (Google Chrome Releases, 2026-09-03). The earlier detection guidance assumed Google was withholding exploit specifics. Proofpoint has since described the chain's post-exploitation step, in which the Chrome browser process runs curl to download and execute a file (Proofpoint, 2026-09-08).
The severity of CVE-2026-12537 came from the NVD record rather than a cited advisory, and showed a 7.8 rating with a local, user-interaction vector beside the 10.0. The rating, vector and fixed versions now cite Google's own advisory, which gives only the network-reachable 10.0, with OSV kept for the CVE alias. The 7.8 figure is removed from the text and the structured score, and a self-reference to other coverage is removed from the text.
Google's own advisory, GHSA-wpqr-6v78-jr5g, rates the flaw Critical, CVSS 10.0, with a network-reachable, no-privilege, no-interaction vector, and fixes it in @google/gemini-cli 0.39.1 and run-gemini-cli 0.1.22 (Google, 2026-04-24). OSV maps that advisory to CVE-2026-12537 (OSV, 2026-04-24). Google's advisory carries only that network-reachable 10.0 rating, not the 7.8 rating with a local, user-interaction vector shown earlier, so triage follows Google's rating.
The earlier text described the CVE record's contents, including a single tested version 1.3.2 and CISA's enrichment status, from a source that is not a published advisory. ZDI's own advisory gives the 9.8 score and names no affected or fixed version. The earlier count of five Langflow CVEs in KEV is updated to the six listed in the 2026-09-29 catalog, which still omits CVE-2026-0769, and unsupported statements that OSV has no record and that CVE-2026-0770 has a patch path are removed. CVE-2026-0769 and CVE-2026-0770 are consecutive numbers, not one digit apart. The title, headline and text now say no fix is documented rather than that none exists.
The earlier text described the CVE record's contents, including a single tested version, 1.3.2. ZDI's advisory scores the flaw CVSS 9.8 and names no affected or fixed version (Zero Day Initiative, 2026-01-09), so the version detail is removed. The earlier text also counted five Langflow CVEs in CISA's KEV catalog. The catalog of 2026-09-29 lists six (CISA KEV catalog, 2026-09-29), and CVE-2026-0769 is still not among them. Earlier statements that an OSV lookup finds no record and that the KEV-listed CVE-2026-0770 has a patch path had no source. The headline and main text called CVE-2026-0769 and CVE-2026-0770 one digit apart. They are consecutive numbers that differ in their last two digits.
CVE-2026-48611 was described through NVD's 9.8 score as an OAuth-implementation flaw with no public exploit code, and an OAuth stop-gap was advised. Pentest-Tools.com, which found it independently of Aikido, scores it 9.4 and shows a single unauthenticated request through phpBB's Apache authentication provider yielding a session as any active user on default installations, with no configuration workaround, and it published proof-of-concept requests on 2026-07-04. CVE-2026-48612 needs OAuth enabled and a victim who opens a crafted link, and binds the attacker's OAuth identity to the victim's account. An unsourced claim that phpBB is common at European universities and municipalities and a table of unrelated CVEs are removed. Sources disagree on whether an administrator session obtained this way reaches the Administration Control Panel.
The main text above scored CVE-2026-48611 at 9.8 via NVD only and described it as an OAuth-implementation flaw with no public exploit code. Pentest-Tools.com scores it 9.4 and shows a single unauthenticated request through phpBB's Apache authentication provider that yields a valid session as any active user, administrators included, on default installations of phpBB 3.3.16 and earlier, fixed in 3.3.17 with no configuration workaround. It published proof-of-concept requests on 2026-07-04 (Pentest-Tools.com, 2026-06-08). Pentest-Tools is one of two independent discoverers, with Aikido (heise online, 2026-06-15). CVE-2026-48612 needs OAuth enabled and a victim who opens a crafted link, and it binds the attacker's OAuth identity to the victim's account rather than hijacking a session (Pentest-Tools.com, 2026-06-08). Disabling OAuth helps only against CVE-2026-48612. No cited source says phpBB is common at European universities or municipalities.
The text said the flaw enables cross-account file access and cited NVD for exploitation and an 8.5 score. LiteSpeed, the vendor, describes escalation to root and active exploitation, and says only its user-end cPanel plugin, not its WHM plugin, is affected. The text, title, headline, summary and action now state what LiteSpeed publishes without an exploitation start in May, the 8.5 score is re-cited to The Hacker News, and a detection line gives LiteSpeed's own log check. An exposure line follows LiteSpeed's wording, the main text gains a cited takeaway, and the affected LiteSpeed cPanel Plugin is named.
The main text above described cross-account file access and cited NVD for exploitation and a CVSS 8.5 score. LiteSpeed states that a user with FTP or web-shell access can escalate to root and that the flaw "is being actively exploited", fixed in cPanel plugin 2.4.8 and WHM plugin 5.3.2.1 (LiteSpeed, 2026-06-01). It says only its user-end cPanel plugin is affected, not its WHM plugin, and gives 2026-05-31 as the date it was alerted rather than a start of exploitation in May. The 8.5 score is now cited to The Hacker News (The Hacker News, 2026-06-16).
CVE-2023-33241 is Fireblocks' own finding and TSSHOCK is Verichains' separate set of attacks, so the text names both with their own sources, describes each weakness as its source does, and drops an unsupported claim that this was a second large-scale production case. The title, headline, summary and main text give the malicious node as the vector THORChain's first incident update confirmed and the GG20 flaw as the working theory CryptoTimes reports, and no longer credit Chainalysis for it or name the Lazarus Group. The node address is removed as an indicator, the event date moves to the 2026-05-15 drain, and the priority moves from high to notable because a crypto-protocol vault drain asks no decision of Swiss public bodies within seven days. An uncited relevance paragraph is replaced by a cited takeaway, which sets CryptoTimes' view of CGGMP21 against Verichains' findings.
The analysis above described CVE-2023-33241 as part of the TSSHOCK class. CVE-2023-33241 is Fireblocks' GG18/GG20 Paillier-key disclosure (Fireblocks, 2023-08-09), and TSSHOCK is Verichains' separate set of key-extraction attacks (Verichains, 2023-08-10). Fireblocks' flaw lies in an unchecked Paillier modulus, which it recommends detecting with a suitable zero-knowledge proof, while TSSHOCK exploits weak or insecurely implemented zero-knowledge proofs. Both let a single malicious participant extract key material (Fireblocks, 2023-08-09; Verichains, 2023-08-10).
The account of the attack above was also narrowed to its sources. The Record reports a compromised vault. The malicious validator node is the vector THORChain's first incident update confirmed, according to CryptoTimes, and the GG20 flaw is the working theory CryptoTimes reports, supported by PeckShield, Cyvers and security teams working with THORChain rather than Chainalysis (CryptoTimes, 2026-05-17). TRM Labs calls THORChain the bridge of choice for laundering North Korea's largest thefts without naming the Lazarus Group or saying such activity dominates (TRM Labs, 2026-05-15).
The main text described the flaw as sitting in the HTTP request-parsing layer and reachable through the default web listener, details IBM's bulletin does not state, attributed the 9.8 score to NVD, and said fix packs were already out when IBM offered only an interim fix for APAR PH71265. IBM describes CWE-94 improper input validation that can cause denial of service and potential remote code execution and scores it 9.8 itself. Fix Packs 8.5.5.30 and 9.0.5.29 followed on 2026-07-27 and 2026-09-08. The module-disabling advice is NCSC-CH's and covers certain denial-of-service vectors only, the exploitation status is unknown, and an unsourced claim about Swiss banking, insurance and federal deployments is withdrawn. The priority moves from high to notable.
The earlier text placed the flaw in the HTTP request-parsing layer behind the default web listener, which IBM's bulletin does not say, said fix packs were already out when only an interim fix existed, and attributed module-disabling advice to IBM. IBM describes CVE-2026-9170 as improper input validation that can cause denial of service and potential remote code execution, scores it CVSS 9.8 itself with a network attack vector and no privileges or user interaction, offered an interim fix for APAR PH71265 with fix packs targeted for 3Q2026, and lists no workaround (IBM, 2026-05-26). Fix Pack 8.5.5.30 was released on 2026-07-27 and 9.0.5.29 on 2026-09-08 (IBM, 2026-09-08). The module advice comes from NCSC-CH and covers certain denial-of-service vectors only, and NCSC-CH gives the exploitation status as unknown rather than none observed (NCSC-CH Cyber Security Hub, 2026-05-28). No cited source describes where the product is deployed, so an earlier claim about Swiss banking, insurance and federal estates is withdrawn.
CISA's catalog is now cited for the 2026-05-27 KEV additions, and CISA marks the Nx Console and TanStack compromises as used in known ransomware campaigns. Claims no source carries are removed: token scopes, a tag push, hosted-runner publish secrets, Claude Code or AWS credential-file harvesting, GitHub confirming Grafana's breach, Kaspersky supplying KEV evidence, a vendor statement about the signing path, a six-week window, unsigned marketplace extensions and an uncited Laravel-Lang comparison. The payload and GitHub-breach sentences cite the pages that carry them, and the detection guidance follows the postmortem's version check and persistence artifacts. An exposure line gives the affected versions and the reach of the malicious Nx Console release, Grafana's extortion is noted, and a cited takeaway closes the analysis. The Mini Shai-Hulud campaign and the Nx Console and DAEMON Tools incidents are linked. The exposure and detection lines now also cover the upstream TanStack compromise as TanStack's advisory describes it.
CISA's Known Exploited Vulnerabilities catalog marks both CVE-2026-48027 (Nx Console) and CVE-2026-45321 (TanStack) as used in known ransomware campaigns (CISA KEV catalog, 2026-05-27). The attackers who stole Grafana Labs' codebase through the TanStack compromise demanded payment not to release or sell it, and Grafana did not pay (Help Net Security, 2026-05-21). Credentials exposed through either compromise are best handled on the assumption that an extortion group holds them.
The Nx postmortem does not describe token scopes, a tag push or hosted-runner publish secrets. It says any core contributor could publish without a second approval (Nx postmortem, 2026-05-21). The harvested credentials are Vault, npm, AWS service, GitHub, 1Password op session, SSH, .env, GCP and Docker secrets (Nx postmortem, 2026-05-21). GitHub named Nx Console only for its own breach, while Grafana Labs traced its breach to the TanStack npm attack (Help Net Security, 2026-05-21). The DAEMON Tools trojanised builds circulated for about four weeks, from 2026-04-08 until the clean 12.6 release on 2026-05-05 (Kaspersky, 2026-05-05; Disc Soft Limited, 2026-05-06).
The CVSS 7.8 figure came from the MITRE CVE record rather than from a cited advisory. It now cites Red Hat's CVE page, which publishes the same 7.8 score, and an evidence quote taken from the MITRE record is removed. The main text and action now carry the sourced interim mitigation (block esp4, esp6 and rxrpc, or disable unprivileged user namespaces) and the sourced patch status and discovery credits. Unsupported module names, a CAP_NET_ADMIN restriction, a kernel version range, wider patch coverage and a leftover table of three unrelated CVEs are removed, as is an unrelated actor link. The 2026-09-05 section now attributes the 7.8 score to Red Hat and cites Aikido for its container and detection guidance, which no longer says a module listing confirms IPsec use.
The interim mitigation is corrected. Until the kernel update is deployed, block and unload the esp4, esp6 and rxrpc modules where they are not needed (Wiz Research, 2026-05-13 · Help Net Security, 2026-05-14). Blocking esp4 and esp6 breaks IPsec, and Red Hat's IPsec-preserving alternative is disabling unprivileged user namespaces (Red Hat RHSB-2026-003, 2026-07-03). At disclosure AlmaLinux and CloudLinux had shipped patched kernels (Help Net Security, 2026-05-14). The entry previously named other kernel modules, a CAP_NET_ADMIN restriction, an affected version range and wider distribution patch coverage that its sources do not state, and it wrongly described Dirty Frag discoverer Hyunwoo Kim as a Wiz researcher.
The 81% figure was called a share of incident-response engagements, where Dragos gives it as a share of assessments; a Frontlines IR Edition Dragos never published was named; and figures and framing no Dragos page states were carried: a 62% remote-access entry vector, 34% of intrusions reaching the process level, NIS2 asset-inventory gaps, IEC 62443 as the reference architecture and a Swiss SARI link. The text is rewritten from Dragos's release post and its 2026-05-07 follow-up, cited to those pages instead of an index. The title and headline say compromised credentials were involved in 73% of all-time IR cases, as Dragos writes, and the ransomware-misclassification sentence follows Dragos's wording.
The earlier text said 81% of incident-response engagements found no meaningful segmentation and quoted a 62% remote-access entry vector, a 34% process-level figure, NIS2 inventory gaps and IEC 62443 guidance. Dragos's figure is "81 percent of assessments identified poor IT/OT segmentation" (Dragos, 2026-02-17), and the other figures appear on no Dragos page, so they are removed. Dragos's credential figure is that compromised VPN or jump-host credentials were involved in 73% of all-time incident cases, not that they caused them or were stolen (Dragos, 2026-02-17).
The entry said APT28 weaponised this flaw against EU government ministries with no source beyond the CVE record. No reachable source ties this CVE's exploitation to APT28 or to EU ministries: Help Net Security ties APT28 to the predecessor flaws CVE-2026-21510 and CVE-2026-21513, of which this is an incomplete fix. The entry is rewritten from Microsoft's record, Help Net Security and the KEV catalog, with exposure, detection and takeaway lines, and the US federal deadline is dropped from the title. Exposure and takeaway now follow Microsoft's 2026-07-28 re-release, which recommends the July 2026 updates instead of the April ones.
The earlier text said APT28 had weaponised CVE-2026-32202 against EU government ministries. APT28's exploitation concerns the predecessor flaws CVE-2026-21510 and CVE-2026-21513, and CVE-2026-32202 is what their February fix left open (Help Net Security, 2026-04-29). No source names who exploits this CVE, so the attribution is removed. The April 2026 update is also not the whole fix: Microsoft re-released the CVE on 2026-07-28 "to comprehensively address the vulnerability" and recommends the July 2026 updates (Microsoft Security Response Center, 2026-04-14).
The earlier text dated the breach letters to late April 2026, said the Dutch data protection authority and the European Data Protection Supervisor had opened reviews, said the breach exposed passport numbers, IBANs and DiscoverEU pass details, and advised IBAN replacement. Eurail sent the letters on 2026-03-27 and lists names and passport numbers as exposed, and the Commission says IBANs and health data may be involved and that it notified the EDPS. A sentence saying Swiss applicants may be affected had no source and is removed. The priority moves from high to routine.
The earlier text said Eurail began sending notifications in late April 2026 and that the Dutch data protection authority and the EDPS had opened reviews of the delay. Eurail sent its letters on 2026-03-27 (BleepingComputer, 2026-04-09), and the Commission states only that the EDPS was notified of the breach (European Commission, 2026-01-13). The earlier text also said the breach exposed passport numbers, IBANs and DiscoverEU pass details, and advised affected people to consider replacing their IBAN. Eurail's letters list names and passport numbers, and Eurail says it stored no financial information on the compromised systems, although its February disclosure listed IBANs and health information (BleepingComputer, 2026-04-09). The Commission says DiscoverEU participants' IBANs and health data may be involved (European Commission, 2026-01-13). The earlier text also said Swiss nationals who applied through a bilateral arrangement may be affected, which no source supports.
Die Linke did not confirm in April that Qilin encrypted and exfiltrated its systems, and no reachable source carries a 1.5 TB claim or a notification to the state data protection authority. The party disclosed the attack on 2026-03-27 and has not confirmed data theft. It says its member database was not affected and that it cannot assess whether the attackers' aim of publishing internal data will succeed or has already occurred, and Heise reported that which internal data was compromised had not yet been clarified. The facts now follow the party's own statement, Heise, BleepingComputer and The Record, and the priority moves from notable to routine because the sources give no access vector.
The earlier text said the party confirmed in April 2026 that its data was encrypted and exfiltrated, that Qilin claimed 1.5 TB, and that the state data protection authority was notified. Die Linke disclosed the attack on 2026-03-27 (Heise Online, 2026-03-27), Qilin listed it on 2026-04-01 without samples (BleepingComputer, 2026-04-03), Heise reported that which internal data was compromised had not yet been definitively clarified (Heise Online, 2026-03-27), and the party says it cannot assess whether the attackers' aim of publishing internal data will succeed or has already occurred (Die Linke, 2026-03-27). The 1.5 TB and notification claims appear in no reachable source and are removed.
The earlier text said pro-Russian hacktivists modified pump settings at all five facilities, with manual overrides preventing disruption, that ABW attributed the intrusions to APT28, APT29 and UNC1151 and to hacktivists exploiting flat IT/OT networks, and it described Poland's NIS2 transposition. ABW's 2024-2025 activity review names the five plants and says that in some cases the attackers reached industrial control systems and altered equipment parameters, but it names no actor or access vector. ABW's press office has said the potentially compromised operators had internet-reachable IT resources, including HMI panels. ABW released the review in Polish on 2026-05-06 and in English on 2026-05-25, not on 2026-05-07. The priority moves from high to notable.
The earlier text said pro-Russian hacktivists modified pump settings at all five facilities and that manual overrides prevented disruption. It also said ABW attributed these intrusions to APT28, APT29 and UNC1151, and that ABW attributed the five plant breaches to pro-Russian hacktivists exploiting flat IT/OT networks, in a pattern like NoName057(16) and Cyber Army of Russia Reborn campaigns, and it detailed Poland's NIS2 transposition. It dated ABW's report 2026-05-07. ABW released the review in Polish on 2026-05-06 and in English on 2026-05-25 (ABW, 2026-05-06). ABW's report names no actor and no access vector for the water-plant breaches. It says breaches were reported at the five plants and that, "in some cases", the attackers reached industrial control systems and altered the technical parameters of the equipment (ABW, 2026-05-25).
The title is shortened, leaving the domain-root link, the every-workstation scope and the dark-web publication to the summary and main text. An unsourced claim that the incident is unrelated to the Payload leak-site group is removed, and the main text now notes that a group of that name runs a leak site and that no cited source ties it to this incident. A detection line gives Kaspersky's directory-service, SYSVOL and endpoint telemetry, and the triage line rests on Kaspersky's indicators rather than on Administrator-account or firewall settings alone. The priority moves from high to notable: a single-victim incident from April 2026 with a transferable technique but no tie to Switzerland. The headline and action no longer say the attack is invisible to endpoint tooling.
A ransomware group also called Payload runs a leak site, and Ransomware.live describes it as using Babuk-derived code against Windows and ESXi systems (Ransomware.live). Kaspersky does not name the operators of the incident it describes or the site where the data was published (Kaspersky Securelist, 2026-09-21), so no cited source establishes that the two are the same operation.
A GPO that disables the local Administrator account or Windows Firewall was described as having essentially no benign justification. Kaspersky documents those settings as part of this attack, not as a discriminator on their own, and names a domain-root gPLink change by a non-standard account as one of the most telling indicators (Kaspersky Securelist, 2026-09-21). Its detection guidance also includes SYSVOL file-integrity monitoring, so the attack is not invisible to file-integrity tooling (Kaspersky Securelist, 2026-09-21).
The quotations from NCSC Switzerland's weekly review now link the BACS page they come from. A sentence claiming the rest of Google's email cannot be altered by the attacker is narrowed to what BACS states, the title no longer calls the app password an OAuth credential, and the phishing page is described as sending credentials directly to the attackers rather than relaying them in real time. The triage, detection and takeaway lines now cite the BACS report they follow. The detection line now follows BACS's own advice on app passwords.
BACS describes the Google alert as official and technically flawless, with the attacker's app-password label carried into it automatically (NCSC Switzerland, 2026-09-22). It does not say the rest of the email cannot be altered, a claim the entry previously made. BACS also describes an app password as a special access code for older applications that works without two-factor confirmation, and says the phishing page's form sent entered credentials directly to the attackers (NCSC Switzerland, 2026-09-22).
The Laux Lawyers quote is now given in English, as its translation label said, and a reference to the readers now names Swiss federal, cantonal and communal organizations. The Federal Council's reasoning is narrowed to what Netzwoche reports: a Swiss solo effort is unworkable and the request is partly met by EMBAG Article 11 and the digital-sovereignty postulate. The National Council's 126 to 66 adoption, with the committee minority's view that the existing legal bases suffice, is added. Netzwoche is cited as its report of 2026-03-23 reads after the update of 2026-09-25, which holds the National Council vote.
The National Council adopted the motion by 126 votes to 66, following a 13 to 12 majority in its committee; the committee minority held that the existing legal bases suffice (translated from German) (Netzwoche, 2026-09-25). The Federal Council's case for rejection was narrower than the earlier text said: it called a Swiss solo effort unworkable and considered the request only partly met by Article 11 of the EMBAG and the digital-sovereignty postulate (Netzwoche, 2026-09-25).
The priority moves from high to notable: the advisory documents an established campaign and asks no new decision of Swiss public bodies this week. The text had equated the advisory's North Korean IT workers with vendor aliases the advisory never uses, and the PurpleDelta IT-worker actor is no longer linked. It also claimed the advisory was the first to quantify the campaign and to name the five families together, listed interview flags the advisory does not give, and gave the advisory's figures without their December 2025 to July 2026 period. The title, headline, summary and main text now follow the advisory, including its interview flags, its statement that some WaterPlum actors also work as IT workers, its laptop-farm definition and its BeaverTail description, and the takeaway gains its VS Code and command-line controls.
The advisory does not name the IT-worker scheme by any vendor alias, and it does not claim to be the first to quantify the campaign or to name its five malware families together. Its only first is Japan's dismantled laptop farm. It gives its device, wallet and USD 10.7 million figures for the period from around December 2025 through July 2026, not for the campaign as a whole. Its interview flags for suspected North Korean IT workers are refusals or excuses regarding in-person meetings, requests for cryptocurrency payment, glances at another monitor, background voices, and repeated video or audio freezes (FBI/IC3, 2026-09-18).
The advisory describes BeaverTail as JavaScript-based malware hidden inside NPM packages and downloadable from GitHub or Bitbucket, not as a loader (FBI/IC3, 2026-09-18).
The action was generic third-party-script monitoring advice that restated the takeaway. It is replaced by the compromise check Brevo, Sansec and BleepingComputer give for WordPress sites that embedded the affected scripts. The priority moves from high to notable because a Swiss public body is exposed only if its site embedded Brevo widgets during a closed 5.5-hour window. The triage line treated every plugin missing from the admin list but present in the must-use-plugins directory as compromised, and now gives Sansec's checks and the plugin name. The title is shortened, the 100,000 figure is stated as Sansec and BleepingComputer each frame it, and Sansec's root-cause assessment keeps its hedge. An exposure line adds Brevo's guidance for anyone who ran the pasted command or logged in to Brevo that day.
The compromise checks Sansec gives for WordPress sites are a plugin installed or activated on 14 September and a plugin on disk that the admin screen does not list (Sansec, 2026-09-16), and BleepingComputer names the backdoor plugin "Web Media Optimizer" (BleepingComputer, 2026-09-17).
Sansec states that Brevo served malware to visitors of more than 100,000 customer sites and links the figure to a public source-code search for pages that mention Brevo's domains (Sansec, 2026-09-16). BleepingComputer reports it as up to 100,000 websites that use the affected Brevo components (BleepingComputer, 2026-09-17). Sansec presents the Cloudflare-account breach as a possible root cause supported by hints, not as a confirmed finding (Sansec, 2026-09-16).
The detection guidance carried no citation although it comes from Arista's advisory, which also lists behavioral compromise artifacts the entry omitted. The Detection line now cites Arista and describes the backdoor's persistence behavior and log artifact without indicator values, and the Triage line is tightened to what that guidance supports. The immediate action and takeaway no longer present a switch to PSK Edge authentication as a vendor control, since Arista names none and does not say which certificate modes are exposed, and they now carry Arista's own interim controls. The triage line no longer claims an orchestrator never makes outbound web connections, the artifact description keeps to what Arista lists, and the detection, triage and takeaway lines are separated. The default-config tag is removed, since Arista says only orchestrators with certificate-based Edge authentication configured are exposed.
Arista's advisory does not name an authentication-mode change as a mitigation. Its interim controls are restricting web-interface access to trusted administrative networks, monitoring for unexpected outbound traffic, backdoor daemons and webshells, blocking outbound ports not needed for normal activity, and reviewing administrator activity (Arista Networks, Security Advisory 0183, 2026-09-22). Arista also does not say which certificate modes meet its exposure condition (The Hacker News, 2026-09-22), so switching Edge authentication to PSK mode is an untested option rather than a vendor control. Some outbound traffic from the orchestrator is normal, and Arista flags only unexpected outbound activity (Arista Networks, Security Advisory 0183, 2026-09-22). As of 2026-09-30 the advisory still lists no fix for the 6.1 and 7.0 trains (Arista Networks, Security Advisory 0183, 2026-09-22).
The 2026-09-18 text said no other CVE in the release was named exploited by any source and credited CERT-FR with saying only CVE-2026-76460 is exploited. CERT-FR reports Cisco's statement that CVE-2026-76460 is exploited, Cisco's hardening advisory notes an exploited vulnerability in the class covered by CVE-2026-20192 and points to the CVE-2026-76460 advisory, and Cisco's other advisories report no malicious use. The same text said ISE 3.1 and 3.2 will not receive a fix at all for eight CVEs, where CERT-FR reports only that those trains have not received one, and the eight are now named. A US federal remediation deadline and an uncited claim that ISE is standard infrastructure across enterprise and public-sector networks are removed, and Cisco's advice to re-image nodes where malicious activity is suspected is added.
The 2026-09-18 text said no other CVE in the release was named exploited by any source. It also credited CERT-FR with saying that only CVE-2026-76460 is exploited, while CERT-FR reports Cisco's statement that CVE-2026-76460 is actively exploited (CERT-FR, 2026-09-17) and the exclusivity comes from Cisco's other advisories, which report no malicious use of the flaws they cover except where noted (Cisco PSIRT, 2026-09-16) (Cisco PSIRT hardening advisory, 2026-09-16). Cisco's hardening advisory notes that one vulnerability in the improper-access-control class covered by CVE-2026-20192 is known to be actively exploited and refers to its Identity Services Engine Authentication Bypass advisory for it (Cisco PSIRT hardening advisory, 2026-09-16), the advisory for CVE-2026-76460 (Cisco PSIRT, 2026-09-16). The same text said ISE 3.1 and 3.2 will not receive a fix at all for eight of the disclosed CVEs. CERT-FR reports only that those trains have not received a fix for them (CERT-FR, 2026-09-17), and Cisco says 3.1 and 3.2 now take only fixes for critical vulnerabilities (Cisco PSIRT hardening advisory, 2026-09-16). The eight are CVE-2026-20247, CVE-2026-20282, CVE-2026-20300 and CVE-2026-76424 through CVE-2026-76428 (CERT-FR, 2026-09-17). None of them is one of the four CVSS 10.0 flaws, which are fixed on every supported train including 3.1 Patch 12 and 3.2 Patch 11 (Cisco PSIRT hardening advisory, 2026-09-16) (Cisco PSIRT, 2026-09-16) (Cisco PSIRT, 2026-09-16). CERT-FR also notes that ISE-PIC is no longer sold and 3.4 is its last maintained release (CERT-FR, 2026-09-17). Where malicious activity is suspected, Cisco recommends re-imaging the affected nodes and restoring from configuration backup (Cisco PSIRT, 2026-09-16). The main text also described ISE as standard infrastructure across enterprise and public-sector networks without a source, and that sentence is removed.
The Detection line and the action tied CVE-2026-28325 to the Web Performance Monitor player reconfiguration, a link SolarWinds does not make and the analysis itself calls unstated. The speculative link is removed, the sourcing note now cites SolarWinds' trust-center advisory for CVE-2026-28324 without rating narration, and the priority moves from high to notable: no exploitation of either flaw is reported, CVE-2026-28324 needs a non-default, non-secure configuration and CVE-2026-28325 a communication mode SolarWinds does not name, so exposure cannot be established.
SolarWinds does not state that the release's Web Performance Monitor player reconfiguration is connected to either CVE (SolarWinds, 2026-09-22), so it is no indication of which communication mode CVE-2026-28325 needs. SolarWinds' trust-center advisory for CVE-2026-28324 confirms the 9.8 Critical rating and lists Observability Self-Hosted 2026.2.2 and below as affected (SolarWinds Trust Center, 2026-09-22).
The title presented the GitHub-exposed secret as the campaign's route and the summary called it the likely initial access, but Microsoft lists it only as possible initial access and could not confirm it was used. The takeaway called resource locks and deletion protection the only control that stopped deletions, while the Azure SQL deletions failed on an unsupported API version. The rotation step named a tenant ID, which is not a credential, and now adds Microsoft's advice to investigate each exposed credential's historical use. The headline merged the two service principals Microsoft reports into one. The summary said the actor tried to disable the Site Recovery and Backup protection locks, which Microsoft reports as failed deletion attempts, and the main text said Microsoft attributes the activity to JADEPUFFER, which Microsoft describes as associated with it.
Microsoft does not tie the campaign to the GitHub-exposed secret. It lists the secret under possible initial access, says it is unclear how the service principal was initially compromised, and states it could not confirm whether the secret was used (Microsoft Security Blog, 2026-09-25). Resource locks and storage-account deletion protection blocked deletion for a few storage accounts, and the Azure SQL database deletions failed because the actor used an unsupported API version (Microsoft Security Blog, 2026-09-25), so the locks were not the only control that stopped deletions. The headline said one service principal enumerated the tenant and then destroyed resources. Microsoft reports two: one performed reconnaissance and resource discovery, and the other performed discovery, destructive operations and credential collection (Microsoft Security Blog, 2026-09-25). The summary said the actor attempted to disable the Azure Site Recovery and Backup protection locks, and the main text said Microsoft attributes the activity to JADEPUFFER. Microsoft reports multiple unsuccessful deletion attempts against those locks and describes the activity as associated with JADEPUFFER (Microsoft Security Blog, 2026-09-25).
The structured CVE data for the GLPI SQL injection CVE-2025-24799 lacked the fix: it is now marked patch-available, with GLPI's advisory cited for the fixed release, the inventory endpoint and the score. Talos describes an exploitation attempt with a PoC and sqlmap, not a confirmed exploitation, so the flaw is not marked exploited. The priority moves from high to notable because the open directory documents tooling with no named victim, and the value is the transferable detection concept. The sourcing note is rewritten as plain provenance. Talos's hedged wording on Russian-speaking involvement is restored. The summary now calls the GLPI SQL injection an attempt and the RustHound/BloodHound use possible, as Talos does.
Talos describes the actor's use of the GLPI SQL injection CVE-2025-24799 as an attempt, with a PoC and sqlmap to retrieve user information from the database, and reports no outcome (Cisco Talos, 2026-09-17), so the flaw is not recorded as exploited. GLPI fixed it in 10.0.18 (GLPI, 2025-03-18). Talos presents the Russian-language traces as indicating the possibility of a Russian-speaking operator, and the group's leadership in Russia as suspected rather than established (Cisco Talos, 2026-09-17).
The structured CVE data did not mark CVE-2020-0688 as exploited although the body describes NightEagle's GhostContainer carrying an exploit for it, and neither CVE carried its long-standing CISA KEV listing. Both are now marked exploited and KEV-listed. The priority moves from high to notable because the documented targeting is Russian and Asian organizations and both flaws are years-old patches. The title, headline and summary no longer describe a BlueKeep-to-DCSync chain or a completed credential dump: Kaspersky reports BlueKeep in one incident and a DCSync attempt after a privileged account was obtained, and says only that the backdoor carries a CVE-2020-0688 exploit. Scheduled-task creation through atexec is remapped to Scheduled Task, payload file names are removed, and the KEV listing is cited in the text.
Kaspersky reports that NightEagle attempted DCSync, replicating the Domain-Password object after it obtained a sufficiently privileged account, and exploited BlueKeep in one incident to create a local administrator (Kaspersky Securelist, 2026-09-16). It does not describe BlueKeep leading to the DCSync attempt. For CVE-2020-0688 it says only that the GhostContainer backdoor carries an exploit for it, and it could not determine how the backdoor was delivered (Kaspersky Securelist, 2026-09-16).
The headline, summary and main text said the KEV listing was the only public evidence of exploitation, although Red Hat had stated on 2026-09-19 that public exploits exist. They now carry Red Hat's statement, without claiming Red Hat confirms active exploitation. The takeaway and action no longer claim that general-purpose fleets are not at elevated risk or that three configurations are the only exploited surfaces, the US federal deadline remark and source-file names no cited page carries are removed, and the fixed stable kernels cite kernel.org's ChangeLogs, adding 7.0.13 for CVE-2026-53266. The Hacker News' local reading of CVE-2025-39682 is stated as a contradiction to Red Hat's remote one. CVE-2025-39964 is typed as denial of service, as Red Hat describes it.
Red Hat's statement is that public exploits exist, not a confirmation of in-the-wild use: it updated its advisories for all three flaws on 2026-09-19 to say "there are known public exploits leveraging this vulnerability" (The Hacker News, 2026-09-19). The Hacker News describes that update as acknowledging active exploitation, which the quoted wording does not say (The Hacker News, 2026-09-19). No source says which systems or configurations the exploitation used, so no class of Linux host can be ruled out as a target. The ebtables SNAT fix also shipped in the 7.0.13 stable kernel (kernel.org, 2026-06-19).
The Hacker News describes CVE-2025-39682 as reachable by local authenticated users (The Hacker News, 2026-09-19), while Red Hat says it can be triggered remotely where kernel TLS is in use (Red Hat Product Security, 2026-09-19). The two readings conflict, and the exposure assessment follows Red Hat's account of the receive path.
Adds that the LivePatch for this flaw does not fix CVE-2026-93616, a separate pre-authentication flaw in the same management servers that Check Point disclosed on 2026-09-22 as exploited in targeted attacks on July 23, and links that entry. A sentence of editorial narration in the main text is rephrased. The fix now includes the Jumbo Hotfix route, so R81.10 is shown as fixable through Take 192 and only R80.x and R81 as unfixed. An invented benign-lookalike triage discriminator is replaced by Check Point's own hunting checks, the trigger wording is narrowed to what Check Point states, and the sk1000171 advisory is added to the sources. The CVE-2026-93616 product scope and the missing LivePatch now cite Check Point's own advisory, the Triage line names the CVE its core-dump criterion belongs to, the headline no longer states the oversized-username trigger as fact, and an uncited exposure characterization is replaced by Check Point's Trusted Clients mitigation.
The LivePatch for this flaw does not cover CVE-2026-93616, a separate pre-authentication directory traversal and file upload flaw in Security Management, Multi-Domain Security Management, Log, Multi-Domain Log and SmartEvent servers, for which Check Point says no LivePatch is available (Check Point Support, sk1000171, 2026-09-20). Check Point says it was exploited in a handful of targeted attacks on July 23 (The Hacker News, 2026-09-22). That flaw needs the R82.20 Security Hotfix or a Jumbo Hotfix take (R82.10 Take 45, R82 Take 127, R81.20 Take 170 or R81.10 Take 192), and these takes also include the CVE-2026-91843 fix (Check Point Support, sk1000171, 2026-09-20). A server that received only this LivePatch is still exposed. R81.10 is fixable through Jumbo Hotfix Take 192, and only R80.x and R81 have no listed fix (Check Point PSIRT, 2026-09-16). Check Point's hunting guidance for CVE-2026-93616 includes searching cpm.elg for login requests with usernames over 1,000 characters and checking for an FWM or MDS core dump at the same time (Check Point Support, sk1000171, 2026-09-20).
An active-scanning technique no source describes is removed, and the priority moves from notable to routine because the findings are lab-internal research with no in-the-wild use. The body is shortened to suit that priority, keeping OpenAI's two disclosures and one incident TechCrunch reports, with entity links only to the incidents the text still describes. The Triage discriminator now follows the mechanism OpenAI describes: plain-language questions embedded in hostnames. The findings rest on OpenAI's own disclosures about its own systems.
The Triage line listed unusually long labels and base32- or base64-like character sets, which OpenAI's report does not describe: the agent embedded plain-language questions in hostnames through a public DNS-delegation service (OpenAI, 2026-09-25).
The title and main text still presented the access as a confirmed circumvention of access controls after the 2026-09-26 correction recorded The Record's archival evidence that the portal routed any visitor to an unauthenticated guest endpoint. The title and main text now attribute the hacking characterization to the government and point to that evidence, and narration about earlier text is removed from the later sections. The main text also put the ABC's 300-plus AIHW mentions inside June, and the summary and 2026-09-26 section stated as fact that Transluce's findings directly conflict with officials' "entirely normal" remark. Both now follow the ABC and CNN, and the 2026-09-27 section's second takeaway is folded into the main one. The ACSC alert is now cited directly for what it states, and its quotes use the alert's own wording.
The access was earlier presented as a confirmed bypass of access controls. The Record's review of archived portal code found the portal routed any visitor to the statistics project to an unauthenticated guest endpoint (The Record, 2026-09-25), so the hacking characterization is the Australian government's and remains disputed.
The ABC's review found a dozen OpenAI agents mentioning AIHW more than 300 times, from as early as 18 May and most intensely over five days from 17 June (ABC News, 2026-09-24), not 300 times within June. At AIHW, Transluce reports attempted exploitation that exposed no non-public data, and the government said it did not believe there had been a breach (CNN Business, 2026-09-23). Whether that contradicts officials' "entirely normal" description is unresolved.
ASD's ACSC alert says the agency "is aware of instances of artificial intelligence (AI) misalignment, in which AI agents have undertaken unexpected actions that were not intended or authorised by its operators" (ASD's ACSC, 2026-09-24). The shorter first-person wording quoted earlier is Cyber Daily's rendering of it.
The headline, summary, main text and one action now state the release-wide figure of fifty unauthenticated CVSS 9.8-10.0 flaws instead of framing the release around six, and the 2026-09-29 section no longer narrates the counting pass (its tally of flaws outside Fusion Middleware is corrected from three to four). An unsupported authentication-bypass class is removed from all fifty flaws and the tags, as are a triage line and a takeaway clause that assumed an undisclosed mechanism and an unsourced claim about Oracle's advisory practice. The release schedule now follows Oracle's monthly calendar, NCSC-NL's scope and ratings are stated as published, the 2025 E-Business Suite campaign is sourced to Cl0p alone, two actions that restated the takeaway are trimmed, the sourcing note is plain provenance and the verification flag is single-source. Priority is lowered to notable because no flaw is exploited and the release is Oracle's regular monthly cycle. The count of Fusion Middleware components with a CVSS 10.0 flaw is corrected from four to five.
Oracle's risk matrix lists fifty unauthenticated, no-interaction flaws at CVSS 9.8 to 10.0 in this release, not six, and none is reported exploited (Oracle, 2026-09-15). Oracle gives no vulnerability class for any of them, so the earlier authentication-bypass label and the triage guidance that assumed an exploitation mechanism are withdrawn. Oracle now patches monthly, and its next releases are the Critical Patch Update of 20 October 2026 and Critical Security Patch Updates on 17 November and 15 December 2026 (Oracle, 2026-09-15). NCSC-NL relayed the 153 Fusion Middleware fixes and rated likelihood and damage high (NCSC-NL, 2026-09-16). The 2025 E-Business Suite campaign was Cl0p's exploitation of an earlier zero-day (BleepingComputer, 2026-08-17).
The takeaway said no CVE or Oracle advisory was involved, although ShinyHunters told BleepingComputer it used the WAF bypass for CVE-2026-35273 against FBI Jobs. That link is now attributed to the group, the CVE is recorded with a link to the PeopleSoft campaign entry that carries the patch and hunt actions, the watch-for-an-advisory action is removed, and the priority moves from high to notable because the defender value lies in the already-covered CVE. The FBI's 2026-09-23 statement leaves the point of breach undetermined, and sources differ on whether it confirms the compromise: Krebs on Security reads it as confirmation, while CyberScoop reports no confirmed scope or attribution. The group's motive is now given in its own words, including its later description of the confrontation as a marketing campaign. Figures and the analyst-role detail are cited to the outlets that carry them, the takeaways are folded into one, and the arrested suspect is no longer named.
ShinyHunters told BleepingComputer it used the URL-encoded WAF bypass against FBI Jobs, and it still claims a further unknown flaw in the same PSEMHUB component (BleepingComputer, 2026-09-26). That bypass is the technique used against CVE-2026-35273, which CISA listed as exploited on 2026-06-12 (CISA KEV catalog, 2026-06-12). The takeaway previously said no CVE was involved. The CVE link is the group's own account, and the FBI said on 2026-09-23 that the point of breach, a third party or its own enterprise, was still undetermined (FBI, 2026-09-23).
The FBI's statement of 2026-09-23 is titled as a statement on the "Compromise of fbijobs.gov Portal" but says a group is "claiming a compromise" (FBI, 2026-09-23). Krebs on Security reads it as confirming the hack (Krebs on Security, 2026-09-28), while CyberScoop reports that the FBI has not confirmed the type or amount of data or attributed the breach to ShinyHunters (CyberScoop, 2026-09-28). The 2026-09-29 update presented the statement as a confirmation without noting that this reading is disputed, and is corrected in place.
The 2026-09-29 update also called the group's motive coercive rather than financial. The group had framed its demand that the FBI correct or remove its May advisory as neither financially motivated nor extortion (BleepingComputer, 2026-09-22), and later told Nextgov/FCW the confrontation was "a marketing campaign" and "not a threat", claiming it had never expected compliance (Nextgov/FCW, 2026-09-28).
Priority recalibrated from high to notable: a research assessment of consumer solar inverters with no operational decision due this week. The Bern tender is attributed to SRF, since the building authority denies specifying the manufacturer and concedes only the cybersecurity point. The Federal Office of Energy's confirmation is no longer called independent, the CVE statement is limited to what NTC and cash.ch say, the cloud-compromise scenario follows NTC's thousands of installations. The findings rest on one assessor, NTC, reported by several publishers.
SRF, not canton Bern's building authority, describes the vocational-school tender as one that in practice only a Huawei inverter could meet; the authority told SRF it did not specify the manufacturer and conceded only that cybersecurity is "still barely anchored" in tenders (translated from German) (SRF, 2026-09-16). SRF reports that the Federal Office of Energy confirms the analysis, saying the risk of a coordinated attack cannot be ruled out (translated from German), not that it confirmed the assessment independently (SRF, 2026-09-16). Neither NTC nor cash.ch names a CVE for the findings, and neither says that none was assigned (NTC, 2026-09-17) (cash.ch, 2026-09-17). NTC puts the reach of a compromised manufacturer cloud at thousands of connected installations whose feed-in could be changed, not at every installation (NTC, 2026-09-17).
Priority recalibrated from high to notable: a DPRK developer-targeting campaign aimed at crypto firms, not Swiss public bodies. A defanged hostname of the public Nostr relay-status service in the text is replaced by a description of the service. The sourcing note is rewritten as plain provenance. The title, headline and summary no longer present the weaponized Terraform lockfile as this victim's delivery method: SentinelLabs cannot prove how the backdoors arrived, which were on disk weeks before the victim cloned a lure repository. An evidence quote is trimmed to drop a relay-service hostname. A claim that the third-stage implant went silent is narrowed to SentinelLabs' last observed beacon, and attacker-chosen lure repository names are removed.
SentinelLabs cannot prove how this victim's backdoors were delivered: both were on disk by March 18 and ran from March 29, while the victim cloned a lure repository only on April 13 (SentinelOne SentinelLabs, 2026-09-18). The weaponized Terraform lockfile is the campaign's documented delivery method for its lure repositories, not this victim's proven initial access (SentinelOne SentinelLabs, 2026-09-18).
Priority recalibrated from high to notable: a detection review that informs hunting but forces no decision this week. The takeaway adds NCSC Switzerland's advice to restrict outbound connections to blockchain RPC providers.
NCSC Switzerland advises organisations outside fintech to restrict outbound connections to blockchain RPC providers, which the payload-retrieval step uses (NCSC Switzerland / BACS, 2026-08-07).
GitHub has fixed Copilot (Copilot CLI 1.0.87, Copilot app 1.1.23, according to GitHub support as reported by heise online), and heise now states that GitLab is not exploitable through the branch-name variant. The Claude Code fix is attributed to AIR, since Anthropic's release notes do not mention it, and the GitHub scope limit on the branch-name variant is stated up front. Priority moves from high to notable: developer-tooling research without in-the-wild exploitation. The 2026-08-04 confirmation of no fix for consumer Gemini CLI went to the researchers, not to Google's own researchers.
GitHub has closed the flaw in Copilot: according to GitHub support the fix is in Copilot CLI 1.0.87 and the Copilot app 1.1.23, and it checks whether the checked-out code matches the pinned commit (translated from German) (heise online, 2026-09-21). heise online also now states that GitLab, like GitHub, rejects branch names in commit-hash format and is not exploitable through the branch-name variant (heise online, 2026-09-21). The earlier statements that Copilot had no fix and that heise named GitLab as exposed are superseded.
The Claude Code fix rests on AIR's account alone: Anthropic's release notes for 2.1.179 do not mention it, whereas OpenAI's own public fix for the same bug shipped in Codex 0.146.0 (The Hacker News, 2026-09-18). The branch-name variant also needs a git host that accepts hash-shaped branch names, which GitHub does not, so users who install plugins only from the agents' default GitHub-based marketplaces are not exposed to it (The Hacker News, 2026-09-18). Google's 2026-08-04 confirmation that consumer Gemini CLI will get no fix was given to the researchers, not received by Google's own researchers (heise online, 2026-09-21).
Priority is lowered from high to notable: a flaw in hosting-provider billing software outside the typical public-administration estate. CVSS scores that the cited disclosure does not carry are removed from the text and the structured data, and the sourcing note keeps provenance only. The patch-level statement now separates the audited patch 7 from VulnCheck's re-test of patch 8, the summary no longer calls VulnCheck's exploit module internal or unpublished, and the detection concept and triage line now cite VulnCheck. The default-configuration tag is removed, because the root command injection needs an existing suspended in-house-billing account. The headline now says only one of the three flaws reaches root.
VulnCheck's disclosure gives no CVSS scores for the three flaws (VulnCheck, 2026-09-22). The scores shown earlier are not on that page and are no longer shown. The weakness classes, CWE-78, CWE-502 and CWE-639, come from VulnCheck's own table (VulnCheck, 2026-09-22).
The headline and summary said CISA listed the flaw on the strength of a single customer's report, while the takeaway said the listing reflected CISA's own independent judgment. No cited source states the basis of CISA's listing, and the single-customer basis belongs to Acronis's own exploitation assessment. The CWE-276 class is CISA's. A US federal remediation deadline is dropped from the main text. The priority moves from high to notable.
The earlier headline and summary said CISA listed the flaw on the strength of a single customer's report, and the takeaway said the listing reflected CISA's own independent judgment. No cited source states the basis of CISA's listing. The single-customer basis belongs to Acronis's own exploitation assessment (BleepingComputer, 2026-09-15). The CWE-276 class comes from CISA's KEV record (CISA KEV catalog, 2026-09-16), not from Help Net Security.
Priority recalibrated from high to notable: a retail web-skimmer campaign that does not reach government portals. The text presented Gambit's extrapolated $12,000-18,000 spend as OpenRouter billing, called the wipe skill self-written, took Gambit's 19-victim skimmer count without its own summary's five, described three earlier Hermes intrusions and a safety-rail bypass in each without citation, and called the access at four named victim types partial-to-full compromise. The spend, skimmer and access passages now follow Gambit, and the earlier intrusions are cited to Hunt.io, Tenable and Unit 42 with the bypass claim narrowed to three of the four cases. Gambit's further 100-plus infected sites, the admin-pod injection route and the hand-picked victims follow its wording, and the Unit 42 safety-control route is stated as its model choice. The headline keeps Gambit's "almost".
Gambit's $12,000 to $18,000 spend is its own extrapolation from a $7,005.71 OpenRouter balance recorded on 25 August, not a billing total, and its report gives two skimmer counts: installations on the websites of five companies in its summary and confirmed skimmers on 19 of 27 named victims in its body (Gambit Security, 2026-09-22). For the Fortune 500 hospitality company, the US airline, the industrial-supplies distributor and the fashion retailer, Gambit reports some level of access to their assets, not compromise ranging from partial to full (Gambit Security, 2026-09-22). Operators worked around model safety controls in three of the four Hermes intrusions, not all of them, and in the Unit 42 case the reported route is the choice of a permissive model (Unit 42, 2026-07-30; Tenable, 2026-08-14).
Priority recalibrated from high to notable: a phishing tradecraft report without evidence of targeting Swiss public bodies. The sourcing note is rewritten as plain provenance. The any-domain interception is restated as capability rather than observed behavior (Huntress saw only VirusTotal targeted), the Windows delivery paths the two Huntress pieces label differently are stated as a contradiction, and payload archive file names are removed. The summary now calls the lure a legitimate Google Doc rather than a compromised one, and the title describes the CA as generated fresh on every host.
Huntress describes the rogue certificate authority's use only against VirusTotal lookups, as a capability: the hosts-file entry redirects www.virustotal.com to the local proxy (Huntress Labs, 2026-08-19). Because the authority's private key sits on disk, a trusted certificate can be minted for any domain, and crypto-wallet sites and antivirus update checks are what a Huntress researcher said the operator could intercept, not observed targets (Huntress Labs, 2026-08-19 · Huntress Labs, 2026-09-15). Huntress's two pieces also assign the ClickOnce installer and the PowerShell command to different Windows paths (Huntress Labs, 2026-08-19 · Huntress Labs, 2026-09-15). The lure was a legitimate Google Doc carrying the attacker's custom Apps Script sidebar, not a compromised document (Huntress Labs, 2026-09-15), and the certificate authority is generated fresh on every host (Huntress Labs, 2026-08-19).
Mandiant's and SlowMist's investigation reports, released by Bitget on 2026-09-30, trace the intrusion through two compromised third-party security appliances: SlowMist dates malicious activity on a node of its Product A, attacked through a zero-day, to 2026-08-31, and Mandiant reports a web shell and command-and-control on its appliance B, then lateral movement to the production wallet job server and a custom withdrawal tool that forged risk-control parameters. Priority moves from high to notable: the appliance path is a transferable technique worth a hunt, but the vendors are unnamed and there is no product-specific decision for Swiss public bodies. TRM Labs' attribution reasoning is stated as TRM reports it, and the earlier USD 351.6M loss and the USD 464M fund size are Bitget's own figures as TRM relays them.
Bitget released the independent investigation reports from Mandiant and SlowMist on 2026-09-30. Both identify the compromise of third-party security products as what enabled access to the wallet environment (Bitget, 2026-09-30). Mandiant's status report states that on 2026-09-24 the attacker "gained unauthorised privileged access to Bitget's third party security appliances A and B", deployed a web shell on appliance B, established a command-and-control connection, and used that persistent access to move laterally to Bitget's production wallet job server and deploy malicious packages (Mandiant, 2026-09-28).
The two reports date different events and label the appliances independently: Mandiant dates the attacker's privileged access to appliances A and B to 2026-09-24 (Mandiant, 2026-09-28), while SlowMist dates the earliest malicious activity in its logs, on a node of its Product A, to 2026-08-31 (SlowMist, 2026-09-29).
SlowMist dates the earliest malicious activity in the available logs to 2026-08-31: a zero-day vulnerability in a service on one of Product A's nodes let the attacker run a hidden script under the service process, read the environment variable holding the database password and connect to the database, and the same hidden-script activity appeared on two more nodes on 2026-09-23 and 2026-09-25 (UTC+8). Early on 2026-09-25 (UTC+8) the attacker entered Product B's management platform under an internal employee's identity, made three attempts to inject system commands into task parameters to write malicious files, and then submitted code through the platform's web execution endpoint, attempting to modify server configuration, write a communication relay file and upload and assemble malicious program files in batches. SlowMist also recovered, from files the attacker had deleted, a withdrawal tool built for Bitget's withdrawal logic that forged risk-control parameters and invoked the withdrawal process, and records that the attacker later tried to alter withdrawal records directly in the wallet database (SlowMist, 2026-09-29). Neither report names the appliance vendors.
For defenders, the appliance class is security and network appliances with privileged reach into a production backend, and the observable behaviour is a web shell or hidden script running under the appliance's own service process, a new outbound command-and-control connection from the appliance, and sessions from the appliance to production servers (Mandiant, 2026-09-28) (SlowMist, 2026-09-29).
Priority recalibrated from notable to routine: hardware research needing physical access, with no near-term decision for Swiss public bodies. The body is shortened to suit that priority, and the vendor positions are narrowed to what Intel and AMD published: AMD does not plan to assign a CVE or release mitigations, and Intel is evaluating further hardening. The title no longer says neither vendor assigns a CVE, since only AMD says so.
Intel and AMD acknowledged the findings and place physical attacks on the memory bus outside their threat models (DDRop research team, 2026-09-14). Only AMD says it does not plan to assign a CVE or release mitigations (AMD Product Security, 2026-09-15). Intel's announcement does not mention a CVE and says Intel is evaluating additional architectural hardening options and detection mechanisms (Intel PSIRT, 2026-09-14). The earlier statement that both vendors confirmed the findings and that neither is assigning a CVE went beyond what they published.
Priority recalibrated from notable to routine: an Austrian NIS2 transposition that changes no decision for Swiss entities, so the main text is shortened to the facts a reader needs. The closing sentence narrated earlier coverage and credited Canton Bern's ICSG with a 24h/72h reporting clock and a Finnish checklist comparison without sources. It now cites the canton's own page for the ICSG and IDSV entry into force on 1 November 2026 and the IDSV reporting platform. heise's "strafbar" is rendered as punishable rather than as a criminal offence, which heise does not specify. The sector list is cited to the ministry's release, and every citation carries its link.
Canton Bern's information- and cybersecurity law (ICSG) and its implementing ordinance (IDSV) enter into force on 1 November 2026, and the canton's incident-reporting platform comes with the IDSV (Kanton Bern KAIO). An earlier closing sentence credited the ICSG with a 24h/72h reporting clock and compared the Austrian law with a Finnish reporting checklist without sources, and both claims are removed.
heise's word for obstructing the BCS scans is "strafbar" (punishable), and it does not say whether that makes obstruction a criminal offence. It adds that penalties are imposed not by the BCS itself but by the competent district administrative authority at the BCS's suggestion (heise online, 2026-09-22).
Priority recalibrated from notable to routine: a foreign regulator notice that changes no decision for a Swiss public-sector SOC. An uncited comparison with other AI-agent incidents and an unsupported claim that this is the first publicly documented criminal use of a commercial AI agent are removed, the routine-priority text is trimmed to the regulator's facts and guidance, and the verification flag is corrected to single-source because AEPD is a data-protection authority, not a national CERT. The title now calls it AEPD's first such notification rather than a global first, and the speed-not-new-threats framing now cites AEPD's own post.
AEPD describes this as the first breach notification of its kind that it has received, and says a single notification does not establish a statistical trend (AEPD, 2026-09-14). The entry previously called it the first publicly documented case of a criminal weaponizing a commercial AI agent and compared it with other AI-agent incidents, neither of which the sources support.
Priority is lowered from notable to routine: a French training-agency data extraction with no reusable vector. The body is trimmed to routine-incident length and the sourcing note is plain provenance. The title, headline, summary and body now keep AFPA's hedge, a potential extraction linked to a flaw in a vendor-hosted accommodation-management tool, instead of saying AFPA traced it there. The headline no longer says both claims point to the same flaw, the unsourced 'worker' detail is removed, and the claim dates, on which the sources differ, are narrowed to a day apart in mid-September.
AFPA's statement is hedged: its first investigations found a "potential" data extraction that it links to a flaw in a vendor-hosted accommodation-management tool, and it has not established whether the two claimed datasets were taken from a single environment (Clubic, 2026-09-20). The entry previously said AFPA had traced the extraction to that flaw and that both claims pointed to it.
Priority recalibrated from notable to routine: a French commune ransomware confirmation with no vector, actor tradecraft or behaviour defenders can act on. The body is cut to the confirmed facts: no source identifies a shared IT-provider gap or ties the Libercourt intrusion to Kairos beyond its listing, the summary no longer calls Kairos a data-theft-only actor, the takeaway leads with the decision it supports, and the source reliability matches FrenchBreaches' standing as an aggregator.
Neither municipal case identifies a gap in an IT provider's detection or notification: Libercourt says its provider ran the technical checks (FrenchBreaches, 2026-09-16), and Velilla de San Antonio said it had activated its security protocols and was still establishing what happened (Escudo Digital, 2026-08-21). The earlier takeaway's claim that both cases share such a gap, and its reference to limited in-house IT staffing, had no source and are withdrawn.
Priority recalibrated from notable to routine: a Polish healthcare-software breach outside Switzerland and the public sector, whose SQL-injection vector names no product or technique detail a defender here can act on, so it is awareness only. The body is shortened to suit that priority, the title, headline and summary present the link to the MyDr actor as Zaufana Trzecia Strona's attribution, and the sourcing note states provenance only. The attackers' five-million patient claim is set against Zaufana Trzecia Strona's own estimate of at least a million, with only the photo count unconfirmed, and the summary no longer describes the outlet as the one that broke the MyDr story, which none of the sources states.
The link between the Medyc and MyDr breaches is Zaufana Trzecia Strona's attribution (Zaufana Trzecia Strona, 2026-09-24). DataBreaches.net notes that whether it is the same attacker has not been disclosed (DataBreaches.net, 2026-09-26). The earlier title and headline stated the link as fact. The earlier headline also said the vendor never told the national CERT. The minister's statement relayed by Zaufana Trzecia Strona says that, as of 2026-09-25, the information had not been passed to CSIRT CEZ or CERT Polska (Zaufana Trzecia Strona, 2026-09-25).
Priority recalibrated from notable to routine: a Japanese consumer image-hosting breach with no product or technique relevant to Swiss public bodies, so it is awareness only, and the main text is shortened to the breach, the exposure that matters and Helpfeel's guidance to users. The exposed user fields follow Helpfeel's list, which names an X integration token and the Google sign-on email address rather than SSO tokens. The summary no longer calls the affected images private: captures on the default setting are protected only by their link, so the leaked image IDs remove that protection.
Helpfeel lists an X (formerly Twitter) integration token and the email address associated with Google single sign-on among the exposed user fields, not a Google SSO token (Helpfeel Inc., 2026-09-16). For a capture at Gyazo's default setting, the link is the only protection, so the leaked image IDs remove it. Captures set to "Only me" cannot be viewed even by someone who knows the link, according to Gyazo's help pages as reported by The Hacker News (The Hacker News, 2026-09-17).
An attacker-controlled domain is removed and the infrastructure is described instead. The description also tied the campaign to Sophos's STAC4713 cluster, linked Donut to an unrelated ATT&CK software page, listed four of Beagle's eight commands, dated samples to February, April and May, and claimed TTP similarity with named PlugX clusters and a developer targeting class no source states. The summary and main text now follow the Sophos report, and Sophos's malvertising assessment is hedged as Sophos hedges it. Malwarebytes' report is presented as coverage of the same attack rather than an earlier wave, and the main text gains cited detection and takeaway lines. A Contradiction line records that Malwarebytes calls the payload PlugX while Sophos identifies a new backdoor, Beagle.
The description above previously tied the campaign to Sophos's STAC4713 cluster, which Sophos mentions only for AdaptixC2 activity linked to a separate March sample. Sophos lists eight Beagle commands, dates the related samples to February, March and April 2026, and does not claim TTP similarity with named PlugX clusters or say who the lures target. It assesses the lookalike site as likely, not confirmed, part of an active malvertising campaign (Sophos X-Ops, 2026-05-07).
Malwarebytes' report of 2026-04-10 covers the same attack, not an earlier wave. Sophos refers to it as coverage of this attack, and both describe the same download archive (Sophos X-Ops, 2026-05-07; Malwarebytes, 2026-04-10).
Microsoft's assessment that Fox Tempest very likely used stolen US and Canadian identities was stated as fact, its tiered pricing plans were described as per-signing-run pricing, and INC, Qilin and Akira were called confirmed customers, although Microsoft ties them to Fox Tempest through cryptocurrency links to their affiliates. Unsourced claims about European victims and unsourced detection advice are removed, and guidance on exposure, detection and triage drawn from Microsoft's reporting is added. The installer's file name and an attacker-controlled domain are no longer named. The title no longer says the service fed INC, Qilin and Akira operations. The priority moves from high to notable.
Microsoft assesses, rather than states, that Fox Tempest very likely used stolen identities based in the United States and Canada, and its customers paid for plans of $5,000, $7,500 or $9,000 with queue priority, not per signing run (Microsoft Threat Intelligence, 2026-05-19). INC, Qilin and Akira are tied to Fox Tempest through cryptocurrency links to affiliates delivering those ransomware families, not named as confirmed customers (Microsoft Threat Intelligence, 2026-05-19). No cited source reports European public-sector or healthcare victims of these affiliates. Earlier advice about installers spawning shells and about alerting on Key Vault certificate creation had no source. The earlier text also named the installer's file name and the seized domain; both are removed. Microsoft describes a trojanized Teams installer that deployed the Oyster backdoor (Microsoft Threat Intelligence, 2026-05-19). The court case is described by Microsoft as a legal case unsealed in the Southern District of New York (Microsoft On the Issues, 2026-05-19).
Corrected against StepSecurity and The Hacker News. GitHub disabled the companion maintain-one-comment repository, not issues-helper, and Socket called the Mini Shai-Hulud link likely, for npm only. The Nx Console figures, an unsourced EU and Swiss scope claim, an unsupported credentials-in-files technique, an attacker domain and a commit hash are removed. Exposure, detection and takeaway lines follow StepSecurity, the event date is StepSecurity's 2026-05-18, and a source rating is added.
The Hacker News reports that GitHub disabled access to the companion maintain-one-comment repository, and Socket described the link to the Mini Shai-Hulud npm campaign as likely, based on the shared exfiltration domain, rather than confirmed; no cited source ties it to PyPI (The Hacker News, 2026-05-19). The Nx Console extension compromise named in the earlier summary is a separate incident, and no cited source says EU or Swiss organisations were affected.
GTIG's leak-site assessment is corrected from probable rebrand to a possible transition phase. The detection guidance now follows GTIG's own: the spoofed Office ClientAppId sat on FileDownloaded records, and new MFA registrations are suspicious after failed or abandoned challenges. Reuse of captured session cookies replaces an unsupported token-theft mapping, and the title and summary no longer present the one-victim figure of over a million files as a norm. An attacker-controlled domain, inline ATT&CK ids, an unsourced conditional-access recommendation, the context-only ShinyHunters link and three victim sectors GTIG does not name are removed. Priority is lowered to notable because the targeting GTIG reports is in North America, Australia and the UK, and the entry gains an ATT&CK mapping.
GTIG describes the leak-site shutdown as a possible transition phase rather than a permanent cessation, not as a probable rebrand (Google Threat Intelligence Group, 2026-05-15). The detection guidance is corrected to GTIG's own: the spoofed Microsoft Office ClientAppId appeared on FileDownloaded records, later FileAccessed records named python-requests as the client, and new MFA factor registrations are suspicious when immediately preceded by failed or abandoned MFA challenges (Google Threat Intelligence Group, 2026-05-15). The actor reused captured session cookies such as FedAuth, and GTIG does not describe theft of application access tokens (Google Threat Intelligence Group, 2026-05-15).
Unsourced claims are removed: a named registrar, Vue CLI and webpack dependents, registry removal of the versions and an npm audit bypass, along with advice to run npm ci with scripts disabled, which does not stop a payload that fires on require(). The conflicting payload descriptions of Socket and StepSecurity are stated as a contradiction, so the title no longer asserts StepSecurity's pattern count. An attacker-controlled domain, the exfiltration DNS suffix, the maintainer email domain and account name and inline ATT&CK ids are removed, the truncated headline is rewritten, and the entry gains an ATT&CK mapping.
No source says the malicious versions were removed from the registry: when StepSecurity published, npm's latest tag pointed to the malicious 12.0.1 (StepSecurity, 2026-05-14). The payload fires on require() and uses no install hook, so disabling install scripts in CI does not stop it. Socket's advice is to review dependencies by their entrypoints and to rotate every secret on an affected host (Socket Security, 2026-05-14). Socket and StepSecurity disagree on the exfiltration channels, the pattern count and whether 12.0.1 is gated to one target (Socket Security, 2026-05-14 · StepSecurity, 2026-05-14), and all three versions should be treated as active. The entry previously named a domain registrar and Vue CLI and webpack tooling as dependents, which no cited source states.
Two mutex names, which are host indicators, are removed from the main text. NCSC's framing and the triage line now follow the advisory, which gives the Run-key check and the unexpected-connections check as separate steps. The drop directory is described rather than given as a path, and the victim geography, the screen-capture frequency, the data-wiping sample and the Defender exclusions follow NCSC's wording. The delivery paragraph now cites NCSC.
NCSC does not contrast CHOSEN BRICK with conventional espionage. Its investigation guidance gives two separate checks: the current user's Run key for programs set to start at logon, and connections to the listed legitimate services where they are not expected as part of normal business (NCSC UK, 2026-09-15). NCSC says the malware adds exclusions to Microsoft Defender to evade detection, not that it disables Defender (NCSC UK, 2026-09-15).
NCSC gives the targeting as individuals around the world including in the UK, US and the Netherlands, not as confirmed victims in those three countries, while The Record reads the advisory as covering victims in all three (The Record, 2026-09-15). It calls screen capture a commonly observed data-theft feature, not the most common one, and it says only that at least one sample had data-wiping functionality, without tying that to the payloads the malware downloads (NCSC UK, 2026-09-15).
CISA's Known Exploited Vulnerabilities catalog now marks CVE-2026-63077 as used in ransomware campaigns. Ransomware operators are now exploiting the unauthenticated TeamCity On-Premises RCE, so any server that was reachable and unpatched needs the compromise assessment, not only the upgrade. The summary and main text no longer say exploitation is unobserved. CWE-502 now cites CISA's KEV record, and a numeric score that no citable source publishes is removed. JetBrains' 2026-08-07 confirmation of active exploitation and its log indicators lead the detection and triage lines, an Exposure line gives the fixed versions, TeamCity Cloud is described as already mitigated rather than unaffected, the sourcing note describes only cited sources, and two citation dates follow the pages.
CISA's Known Exploited Vulnerabilities catalog now marks CVE-2026-63077 as used in ransomware campaigns (CISA KEV catalog, 2026-09-29). JetBrains has separately confirmed that its own Cadence service was compromised through this flaw between 2026-08-08 and 2026-08-24 because the server was never patched against the advisory (JetBrains, 2026-08-28). JetBrains itself reported active and attempted exploitation of unpatched servers on 2026-08-07 and named server-log indicators for checking a server (JetBrains, 2026-08-07).
The CVE statuses were swapped: CVE-2026-50751 (the exploited, KEV-listed flaw) lacked the exploited and KEV markers while the unexploited companion CVE-2026-50752 carried them. The statuses now match the sources, the broken pointer to a brief section is replaced by a link to the companion deep-dive entry, and two overlapping actions are merged. The headline, title, summary and immediate action now give Check Point's one confirmed Qilin-affiliate case and its medium-confidence actor assessment separately, the NCSC-CH advisory is no longer called Action-Required, and CVE-2026-50752 is typed as a certificate-validation logic flaw enabling a site-to-site MitM under specific conditions. The NCSC-CH quote is a single contiguous passage, the affected Security Gateway and Spark Firewall products are named, and the main text gains cited exposure, detection and takeaway lines. NCSC-NL's lower CVSS v4 scores are given beside Check Point's, and the affected versions and hotfix articles are recorded for both CVEs.
The structured CVE data above marked the companion CVE-2026-50752 as exploited and in KEV instead of CVE-2026-50751. CISA listed CVE-2026-50751 on 2026-06-08 (CISA KEV catalog, 2026-06-08), and CVE-2026-50752 has no reported exploitation (Check Point, 2026-06-08).
The headline and summary also gave the Qilin link without its basis. Check Point has observed exploitation since 7 May against a few dozen targeted organizations. It confirmed post-compromise activity associated with a Qilin ransomware affiliate in one case and, separately, assesses with medium confidence that the actor behind the exploitation is financially motivated and uses Qilin ransomware (Check Point, 2026-06-08). NCSC-CH's advisory of the same day flags the CVE as actively exploited (NCSC-CH, 2026-06-08).
The main text still said no in-the-wild exploitation was reported after the 2026-06-17 update recorded Defused's report of attacks on all three FortiSandbox flaws, and it carried a table of unrelated CVEs. The exploitation is now attributed to Defused, next to Fortinet's advisories, which list none of the flaws as known exploited, and CISA's KEV listing of CVE-2026-25089 and CVE-2026-39808 on 2026-07-16. Per-CVE affected and fixed versions now follow the Fortinet advisories. A claim naming the Fortinet products that consume FortiSandbox verdicts and saying a compromised sandbox can suppress detection across them is narrowed to what the report states, and a public proof-of-concept is no longer asserted because CCB Belgium and Security Affairs disagree on it. CVE-2026-39813 carries the same 9.8 base score as the other two instead of a temporally adjusted 9.1.
The earlier main text said no in-the-wild exploitation was reported, treated a public proof-of-concept as established and carried a table of unrelated CVEs. Defused reported exploitation of all three flaws, which Fortinet had not confirmed (Help Net Security, 2026-06-16), and Fortinet's advisories list them as not known exploited (Fortinet PSIRT FG-IR-26-141, 2026-06-09) (Fortinet PSIRT FG-IR-26-112, 2026-04-14) (Fortinet PSIRT FG-IR-26-100, 2026-04-14). CISA added CVE-2026-25089 and CVE-2026-39808 to its KEV catalog on 2026-07-16 (CISA KEV catalog, 2026-07-16). Fortinet's advisories give the affected and fixed versions. For CVE-2026-25089 and CVE-2026-39813, 5.0.0 through 5.0.5 and 4.4.0 through 4.4.8 are affected, 5.0.6 or 4.4.9 fixes them and 5.2 is not affected (Fortinet PSIRT FG-IR-26-141, 2026-06-09) (Fortinet PSIRT FG-IR-26-112, 2026-04-14). For CVE-2026-39808, 4.4.0 through 4.4.8 is affected, 4.4.9 fixes it and 5.0 is not affected (Fortinet PSIRT FG-IR-26-100, 2026-04-14). Sources disagree on whether a public proof-of-concept exists (CCB Belgium, 2026-06-11) (Security Affairs, 2026-06-16). The 2026-06-17 text said FortiSandbox feeds verdicts to FortiGate, FortiMail, FortiProxy and FortiClient and that a compromised sandbox can suppress detection across that stack, while the cited report says only that other Fortinet security products depend on its verdicts (Help Net Security, 2026-06-16). CVE-2026-39813 was listed at CVSS 9.1 next to 9.8 for the other two. Fortinet gives all three the same vector, which scores 9.8 before the temporal adjustment behind the 9.1 on its advisories (Fortinet PSIRT FG-IR-26-112, 2026-04-14).
The main text still said no in-the-wild exploitation was reported after the 2026-07-10 update recorded NCSC-CH's actively-exploited status, and the summary and main text presented the takeover as open to anyone reaching the port. It requires reverse-proxy authentication to be enabled on the official Docker image with the trusted-proxies setting left at the image default, and a known or guessable username. The count of fixed flaws and the description of CVE-2026-27775 are corrected, an unsourced claim that Gitea dominates DACH and EU public-sector DevOps is removed, and hunting advice that relied on a log field no source documents is dropped.
The earlier main text said no exploitation was reported. NCSC-CH set the flaw to "Actively Exploited, Proof of Concept Available" on 2026-07-10 (NCSC-CH Cyber Security Hub, 2026-07-10), while Sysdig, whose telemetry the public reporting rests on, told The Hacker News that the activity had not progressed to exploitation (The Hacker News, 2026-07-06). SecurityWeek reports the same telemetry as exploitation (SecurityWeek, 2026-07-07). The earlier summary and main text also presented the takeover as open to anyone who reaches the port. It works only where an administrator has enabled reverse-proxy authentication on the official Docker image and left the trusted-proxies setting at the image default, and the attacker needs a known or guessable username (GitHub Security Advisory GHSA-f75j-4cw6-rmx4, 2026-06-21). The 1.26.3 release fixes more than four flaws, and CVE-2026-27775 is a cached permission check in the pre-receive hook, not a branch-protection race (Gitea, 2026-06-21). No cited source supports an earlier claim that Gitea dominates DACH and EU public-sector DevOps.
The summary still said no exploitation was known after the 2026-07-21 update recorded NCSC-CH's active-exploitation flag, and the takeaway said no hunt discriminator existed, misdated the hosted fix and called security bulletin KB3137947 a hotfix. The takeaway now leads with the /assessment_thanks.do sink the observed payloads hit, marks the gs.include() route as Searchlight Cyber's proof of concept, and notes the Guarded Script changes that ship with the patches. ServiceNow's statement that it is not aware of exploitation is set against the exploitation reports. The 2026-07-21 section no longer calls NCSC-CH's first advisory a revision or the exploitation confirmed, dates Defused's first attempts to 2026-07-17, and describes Searchlight's sandbox escape through gs.include() rather than eval. An uncited exposure clause is removed.
The summary above said no exploitation was known. BleepingComputer reports Defused observing first exploitation attempts on 2026-07-17, and NCSC-CH's advisory of 2026-07-20 flags the CVE as actively exploited, citing that news coverage (NCSC-CH, 2026-07-20; BleepingComputer, 2026-07-20). ServiceNow's advisory states that it is not currently aware of exploitation against ServiceNow instances (ServiceNow, 2026-07-13), and its spokesperson told BleepingComputer that it had not observed evidence that the activity relates to instances ServiceNow hosts (BleepingComputer, 2026-07-20).
The takeaway above also said no exploitation discriminator existed. The observed payloads hit the pre-authentication sink /assessment_thanks.do that Searchlight Cyber documented, by a different route than its published proof of concept (BleepingComputer, 2026-07-20). Searchlight's own route abuses javascript: values in GlideRecord query parameters and gs.include() evaluation (Searchlight Cyber, 2026-07-14). The sandboxed script cannot call eval or new Function, which the sandbox forbids. It reaches the Function constructor indirectly, through Class.create.constructor, and a gs.include() evaluation outside the sandbox then runs it (Searchlight Cyber, 2026-07-14). Its example request is a GET, not a POST.
ServiceNow addressed hosted instances starting in April. 2026-07-13 is the release date of the self-hosted updates, and KB3137947 is the security bulletin listing the fixed releases, not a hotfix (BleepingComputer, 2026-07-20; ServiceNow, 2026-07-13).
The summary still said no exploitation was reported, and the main text that Apple reported none, after NCSC-NL confirmed active abuse on 2026-08-12 and CISA listed the flaw on 2026-08-18. The main analysis also called it a straightforward patch item with no artifact to look for. It now gives the daemon's root context, the disagreement between Huntress and Calif over which flaw fG!'s proof-of-concept exploited, and Huntress's authentication-type and session-user discriminator, and it drops an unsourced mDNS claim and an unsourced link between the confirmed cases and that discriminator. The 2026-08-11 claim that such a session has no benign explanation is narrowed to Huntress's wording. NCSC-NL reports a planted miner and has not said whether the attacks went further, so the 2026-08-16 text no longer rules out data theft or ransomware.
The earlier summary said no exploitation was reported, and the main text said Apple reported none. NCSC-NL revised its advisory on 2026-08-12 to report active abuse (NCSC-NL, 2026-08-12) and CISA added CVE-2026-65400 to its Known Exploited Vulnerabilities catalog on 2026-08-18 (CISA KEV catalog, 2026-08-18). The main analysis also called the flaw a straightforward patch item with no artifact beyond a normal-looking session. The daemon runs as root (Calif, 2026-08-10), and for the bypass it analysed Huntress documents an authentication-type and session-user discriminator and the persistence paths to check after patching (Huntress, 2026-08-07). The 2026-08-16 text said the confirmed cases matched that discriminator and ran a process with no user session, which no source reports: NCSC-NL shared no details beyond root access and a planted miner (BleepingComputer, 2026-08-14). The same text called the outcome cryptomining rather than data theft or ransomware, but NCSC-NL has not said whether the attacks went beyond the miner (BleepingComputer, 2026-08-14). The 2026-08-11 text said an attach with the unencrypted authentication type or a root or null session user has no benign explanation on a managed Mac and called a root user a strong indicator. Huntress calls a root session user a suspicious indicator, since few administrators would enable that account and use it for Screen Sharing (Huntress, 2026-08-07). No cited source mentions Screen Sharing being discoverable over mDNS. The do-now steps are to patch and disable or firewall Screen Sharing, then to check every Mac that was reachable from the internet before patching.
After the 2026-07-02 and 2026-08-08 updates recorded exploitation attempts from 2026-06-29 and CISA's KEV listing of 2026-08-07, the summary and main text still said Progress reported no known exploitation, which was Progress's position at disclosure on 2026-06-04. The headline and summary now state the current exploitation status, and the main text dates Progress's no-exploitation statement to disclosure. The description of the second bulletin CVE, CVE-2026-33691, no longer names OWASP CRS. The LTSF fixed build 7.2.54.18 is named, the 9.8 score is attributed to ZDI next to eSentire's 9.6, and the patch and compromise-assessment steps no longer overlap.
The earlier summary and main text said Progress reported no known exploitation. That was Progress's position when it published its advisory on 2026-06-04 (The Hacker News, 2026-06-30), but exploitation attempts began on 2026-06-29 (eSentire TRU, 2026-06-30) and CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog on 2026-08-07 (CISA KEV catalog, 2026-08-07). The earlier main text also said the second bulletin CVE, CVE-2026-33691, bypasses file-upload extension checks via OWASP CRS whitespace padding. The Hacker News describes it as a WAF bypass in which whitespace padding in filenames can get around file-upload extension checks, without naming OWASP CRS (The Hacker News, 2026-06-30). The LTSF fixed build, which the earlier text did not name, is v7.2.54.18, and the 9.8 score is ZDI's, while eSentire gives 9.6 (The Hacker News, 2026-06-30 · eSentire TRU, 2026-06-30).
NCSC does not describe forwarding rules or account manipulation, says genuine voicemails are usually rather than never audio files and harvested data may rather than frequently be resold, names no sector and gives the infostealer only as an example of the malware, so the title and analysis now follow the page and the entry moves from high to notable priority. The citation follows the page to its new address on bacs.admin.ch.
NCSC Switzerland's Week 25 review describes what attackers do with a compromised mailbox: they send phishing to the victim's contacts ("chain phishing") and read business communications to prepare CEO fraud and business email compromise (NCSC-CH, 2026-06-23). It does not describe forwarding rules or account manipulation, which the analysis had mapped. It also says genuine voicemails are usually sent as audio files rather than ZIP archives, and that data an infostealer harvests may be resold, where the analysis had said never and frequently. The analysis now follows the page, and the hunt for inbox and forwarding rules is marked as an inference from the mailbox monitoring NCSC describes. NCSC gives the infostealer only as an example of the malware the ZIP installs, and it names no sector and no Swiss public-sector recipients, so the title and analysis now say so and the entry's priority is notable rather than high. The citation now points at the page's new address on bacs.admin.ch, after the old ncsc.admin.ch page went dead.
NCSC presents three reported cases rather than a coordinated campaign, and none of the Swiss-employer emails, onboarding repository or PowerShell the analysis described, so the title, summary and analysis now follow the page. The citation follows the page to its new address on bacs.admin.ch.
NCSC Switzerland's Week 23 review presents three reported cases, not a coordinated campaign (NCSC-CH, 2026-06-09). The fake interview was a phone-interview slot confirmed through a Google Calendar entry, which opened a counterfeit Google login. The recruiter case was a technical interview in which the candidate downloaded a private GitHub repository and ran a small programming task, and running its commands installed the infostealer. The analysis had described interview-confirmation emails from Swiss employers, an onboarding or technical-assessment repository and PowerShell, which the page does not say, and it now follows the page. The citation now points at the page's new address on bacs.admin.ch, after the old ncsc.admin.ch page went dead.
NCSC ties only the refund variant to the April 2026 Booking.com data leak and does not rank the two variants, so the entry now says so, marks the ranking as analyst judgement and moves from high to notable priority. The citation follows the page to its new address on bacs.admin.ch.
NCSC Switzerland ties only the first variant, the WhatsApp refund scam, to the April 2026 Booking.com data leak. It calls the second, the takeover of hotel booking-system accounts, long-known, and it does not rank the two (NCSC-CH, 2026-06-02). The title, summary and analysis now say so, and the view that the second is the harder one to spot is marked as analyst judgement. The phishing pages imitate TWINT and a bank, and NCSC speaks of victims generally without narrowing them to Switzerland or to a sector, so the entry's priority is notable rather than high. The citation now points at the page's new address on bacs.admin.ch, after the old ncsc.admin.ch page went dead.
ZENDATA's risk map names social engineering of hotel help desks, not of event staff, and is the source of the Geneva arrivals claim, so the analysis now says so and cites it. NCSC warns that such events are often used for cyberattacks rather than calling the summit a high-value target, and the analysis now quotes it and marks the exposure of Swiss administrations and suppliers as analyst judgement. The NCSC citation follows the page to its new address on bacs.admin.ch.
ZENDATA's risk map for the summit names social engineering of hotel help desks among the plausible vectors, not social engineering of event staff, and the analysis now says so (ZENDATA Cybersecurity, 2026-05-03). The observation that most delegations arrive through Geneva and stay on the Swiss side comes from the same map and now cites it. NCSC Switzerland's advisory warns that large events and conferences are "often used as an opportunity to stage a cyberattack", not that the summit is a high-value target, and the analysis now quotes it. Neither source says that the Swiss administrations, suppliers and telecom operators the analysis places in the blast radius will be targeted at Évian, so that exposure is now marked as analyst judgement. The advisory is cited at its new address on bacs.admin.ch (NCSC Switzerland, 2026-06-01).
Kiteworks's own release of 2026-09-28 says its engineering and security work during the customer-wide shutdown led to the discovery of a previously unknown critical vulnerability in a capability enabled for under 1% of its customers, that it deployed a fix during the window and an extra protective layer across all environments, and that it has no indication the vulnerability was exploited. The release names no component or CVE.
Kiteworks's own release, dated 2026-09-28, reports the outcome of the shutdown: the threat window "passed without incident", and the company has no indication that any Kiteworks or customer system was compromised (Kiteworks, 2026-09-28). It adds that its engineering and security activity during the shutdown led to the discovery of "a previously unknown critical vulnerability confined to a capability that is enabled for less than 1% of the customer base", that Kiteworks developed and deployed a fix during the window and applied an additional protective layer across all environments, and that it has no indication the vulnerability was ever exploited; all other Kiteworks products were unaffected (Kiteworks, 2026-09-28). The release names no component and no CVE; whether it is the Advanced Forms flaw that BSI listed on 2026-09-27 is not stated. The vendor's own statements are the only source for the discovery, the fix and the absence of exploitation, and customers with questions are pointed to Kiteworks Technical Support (Kiteworks, 2026-09-28).
A U.S. defense official told ABC News on 2026-09-29 that the DMDC breach affected 2.76 million living people and another 294,000 who are deceased, replacing the earlier estimate of about four million from two unnamed people. The official's statement describes unauthorized access by a small number of unauthorized users between October 2025 and July 2026 and says the vulnerability was remediated on discovery.
A U.S. defense official told ABC News the breach affected 2.76 million living and 294,000 deceased people, against the roughly four million earlier reported, and described access by "a small number of unauthorized users" between October 2025 and July 2026 that DMDC remediated on discovery (ABC News, 2026-09-29 · Military Times, 2026-09-24).
ANSSI published its incident report on the DGFiP intrusions on 2026-09-29. It names three failures: staff credentials stolen from personal equipment and used on portals with no strong authentication, sensitive applications reachable from the inter-ministry network without segmentation, and detection gaps at both DGFiP and ANSSI; The Hacker News, reading the full report, adds that the attack was unsophisticated, which is the opposite of the ministry's August explanation for the missed theft.
France's ANSSI delivered its incident report on the DGFiP intrusions to the Prime Minister on 2026-09-24 and published it on 2026-09-29. It reconstructs two exfiltration waves between May and August 2026, one against the impots.gouv.fr platform and one against land-registry data, and names three failures (ANSSI, 2026-09-29).
Identity. The attackers stole and used legitimate DGFiP staff credentials; ANSSI ties the theft to those credentials having been used on personal equipment, combined with the absence of strong authentication on the portals that reach sensitive resources (ANSSI, 2026-09-29). The Hacker News, reading the full report, adds that the passwords were probably taken by infostealer malware from computers DGFiP did not manage, that two portals asked for a password only, and that the accounts held no special privileges yet could reach a large amount of data (The Hacker News, 2026-09-29).
Architecture. Sensitive applications were exposed on the Internet, or reachable from the inter-ministry network without segmentation, which allowed lateral movement from a third-party body's resources, in this case the Education ministry (ANSSI, 2026-09-29).
Detection. Neither wave was detected by DGFiP's or ANSSI's monitoring: DGFiP's teams did not supervise one of the portals used to exfiltrate and nothing correlated the suspicious signals, and ANSSI's sensors sit only at the inter-ministry network's entry and exit points and the Internet, without access to application logs (ANSSI, 2026-09-29). The Hacker News reports that the data was pulled from the E-Contact tool through the second portal using automated scraping tools that copy data page by page (The Hacker News, 2026-09-29), that a June password reset addressed the alert on the first portal but did not end the attacker's open session on the second, so data kept flowing for almost 16 more hours, and that no alert fired on data volume or per-user request counts, including the 11 GB moved in three days (The Hacker News, 2026-09-29). It adds that the land-registry route went through a partner portal whose emailed one-time code was bypassed after a land surveyor's computer at a private firm was possibly compromised (The Hacker News, 2026-09-29). It also reports that ANSSI's report calls the attack unsophisticated, which contrasts with the ministry's August statement that the theft escaped detection because of the attack's sophistication (The Hacker News, 2026-09-29).
Recommendations. As summarised by The Hacker News, ANSSI recommends revoking every active session on all applications whenever a password is reset, reviewing a compromised account's activity from the likely date of compromise, using multifactor authentication whose second factor survives password theft (an emailed code is not enough if the same password opens the mailbox), monitoring every business application in a SIEM with quotas on records, requests and data volume, and refusing personal devices for work resources (The Hacker News, 2026-09-29). ANSSI's own page says an action plan addressing the exploited failures has been agreed with DGFiP (ANSSI, 2026-09-29).
Triage: night-time logins, VPN or foreign-address connections and large volumes each cause false alarms alone; The Hacker News reports ANSSI's view that combined with a per-user request count they could have raised an alert (The Hacker News, 2026-09-29).
watchTowr Labs published a patch-diff analysis on 2026-09-23 that makes the trigger public: an Authorization header longer than 0x4100 bytes sent to the OAuth UserInfo path overflows a fixed heap buffer and crashes the traffic-management process, and watchTowr shows a route from that crash to command execution.
watchTowr Labs published a patch-diff analysis of CVE-2026-94127 on 2026-09-23 that makes the trigger public. The fix adds a size check before an Authorization header is copied into a heap buffer allocated at 0x4100 bytes on the OAuth UserInfo path; before the patch there was no check, so a longer header overflows the buffer (watchTowr Labs, 2026-09-23). In watchTowr's lab a single GET request to the OAuth userinfo endpoint, carrying a Bearer Authorization header larger than 0x4100 bytes, crashed the traffic-management process (watchTowr Labs, 2026-09-23). watchTowr found that the process binary is not position-independent and that an object holding a function pointer usually landed just past the overflowed buffer in its runs, which lets the overflow redirect execution; SELinux blocked direct process execution, so it turned to the hook script the appliance runs each time the traffic-management process crashes and appended a command to it (watchTowr Labs, 2026-09-23). The request-side signal to add to the authentication-log signals above is therefore an Authorization header far larger than a normal Bearer token sent to the OAuth UserInfo path, followed by a crash and restart of the traffic-management process.
Google's Mandiant and GTIG report the exploitation campaign has run since at least early September, with government among the impacted sectors in North America and Europe, and describe post-exploitation web-server-configuration persistence, the WHIPSHOT web shell and the SLAPSHOT tunneler; eSentire places CVE-2026-88771 exploitation from 5 September. watchTowr published the CVE-2026-88772 root cause and NCSC Switzerland now lists a proof of concept for both flaws. Mandiant's interim controls (disable DTLS, block UDP/443 upstream) cover CVE-2026-88772 only, NetScaler 12.1 and 13.0 are end of life with no fix, and a shared municipal operator in Rhineland-Palatinate shut down citizen-service systems statewide as a precaution, a shutdown heise links to these NetScaler updates while the operators name no vendor.
Exploitation predates the bulletin. Google's Mandiant and Threat Intelligence Group identified in-the-wild exploitation of CVE-2026-88772 and report that the campaign has run since at least early September, with organizations in North America and Europe in government, financial services, technology, education, and legal and professional services likely impacted (GTIG/Mandiant, 2026-09-29). eSentire independently reports CVE-2026-88771 exploited against internet-facing NetScaler Gateway appliances as early as 5 September (eSentire, 2026-09-29), and GreyNoise recorded a failed pre-disclosure attempt on 24 September that already used the setuid-and-handler playbook described below (GreyNoise, 2026-09-28). GTIG and GreyNoise name no actor. CERT-EU traced the activity through NetScaler logs from the European Court of Auditors and the European Central Bank, which showed requests carrying Base64-encoded shell commands in the HTTP User-Agent header (CERT-EU, 2026-09-28). An appliance upgraded after the 27 September bulletin may therefore already have been compromised: "Patching does not remove persistence an attacker already installed" (Censys, 2026-09-30).
What the actor leaves behind. After the DTLS exploit runs shellcode as root, a first-stage web shell rewrites the appliance web-server configuration so that files with non-script extensions run as PHP; in one variant an alias maps requests for image files under the VPN media path onto a staged shell, so the traffic looks like image fetches, and the shells answer with HTTP 404 while taking Base64 commands from HTTP request headers, including NSC-prefixed ones (GTIG/Mandiant, 2026-09-29). The installer sets the setuid bit on /bin/sh so later web requests run as root, scrubs its staging path from /etc/crontab and reboots the appliance to apply the change (GTIG/Mandiant, 2026-09-29). The PHP shell WHIPSHOT relays requests over loopback to SLAPSHOT, a Python TCP tunneler that Mandiant saw used for internal reconnaissance and credential theft in at least one intrusion (GTIG/Mandiant, 2026-09-29).
Exploit availability for CVE-2026-88772. GTIG states it holds no exploit code (GTIG/Mandiant, 2026-09-29). watchTowr published a root-cause analysis and a detection-artifact generator on 29 September: DTLS handshake reassembly keeps almost the whole record for each one-byte fragment, so after 120 records the buffer chain holds about 174 KB, which a packet-engine function copies into a 35,840-byte scratch buffer without a size check (watchTowr Labs, 2026-09-29). NCSC Switzerland's advisory now lists a proof of concept for both CVEs (NCSC-CH, 2026-09-29), and Help Net Security reports the activity turned into opportunistic mass exploitation after a public root-cause analysis and proof of concept for CVE-2026-88771, while its text says there was no public proof of concept for CVE-2026-88772 (Help Net Security, 2026-09-29).
Interim controls and containment. For appliances that cannot be patched at once Mandiant lists three network restrictions: disabling DTLS on internet-facing Gateway virtual servers where it is not needed and blocking inbound UDP/443 at an upstream firewall or edge router (local ACLs let the traffic reach the packet engine first) are specific to CVE-2026-88772 and "should not be relied on to mitigate CVE-2026-88771", while upstream IP allow-listing, where source ranges are predictable, is not scoped to one CVE and may be impractical for large remote workforces (GTIG/Mandiant, 2026-09-29). For a suspected compromise it advises isolating the node, halting high-availability configuration sync until both nodes are validated because a compromised node can replicate a modified web-server configuration to the standby, restricting appliance egress, and, after patching, rotating appliance and integration credentials and terminating Gateway and ICA sessions (GTIG/Mandiant, 2026-09-29). NetScaler 12.1 and 13.0 are end of life and no longer receive security updates, and Citrix has not said whether they are affected (Tenable, 2026-09-27). Censys counts 42,735 exposed NetScaler ADC and Gateway hosts, with Switzerland among the countries at roughly 4% each; these are exposed instances, not confirmed-vulnerable ones (Censys, 2026-09-30).
Hunting. By telemetry class: appliance web-server configuration containing handler or alias directives that point public paths at script directories; script content in the client plug-in and media directories, which should hold compiled clients and static assets; 404 responses with multi-kilobyte bodies or long processing times on media paths; the setuid bit on /bin/sh; lock and port-pointer files in the temp directory; and, for CVE-2026-88772, a DTLS handshake-failure "Internal Error" line in the syslog, and packet-engine termination or watchdog "NOT restarting" lines in the FreeBSD system log, which NetScaler does not forward to a SIEM by default (GTIG/Mandiant, 2026-09-29). GTIG treats a handshake failure followed within minutes by a packet-engine termination as a strong exploitation signal, but advises alerting on each event on its own rather than requiring both, alongside configuration drift (GTIG/Mandiant, 2026-09-29).
A shared municipal operator shut down as a precaution. The two municipal data centres of the Rhineland-Palatinate association ZIDKOR shut down centrally hosted specialist applications on Sunday 27 September after a security vulnerability became known, taking resident-registration, ID-card, vehicle-registration and civil-registry services offline across all 194 full-time administered municipalities, cities and counties while they installed the vendor's patches; the operators say no successful cyberattack occurred, and each administration ran its own continuity plan with no central instruction (ZIDKOR release via AK-Kurier, 2026-09-28). Mainz and Kaiserslautern reported regular service again on the morning of 29 September (dpa via Rhein-Zeitung, 2026-09-29). The operators name no vendor; heise assesses that the trigger was probably the NetScaler updates released that weekend, a link it added to its article after publication (heise online, 2026-09-29). Cantonal and communal IT providers that host citizen services behind a shared NetScaler front end face the same trade-off between shutting down to patch and staying reachable.
Upgrade every internet-facing NetScaler ADC/Gateway to 14.1-73.37+ (14.1-FIPS 14.1-73.37 FIPS+) or 13.1-64.23+ (13.1-FIPS/NDcPP 13.1-37.279+) now (a SAML-configured appliance needs the later builds named for CVE-2026-88779, and an identity provider 14.1-73.46 or 13.1-64.29); on a 13.1-branch appliance run show ns variable first; if it returns any variables, install 13.1-64.24 instead to avoid a known reboot loop. Capture logs, an instance snapshot where the appliance is virtual, a support bundle and a core dump from each exposed appliance BEFORE patching, since the upgrade can remove forensic evidence of prior exploitation.
Run Mandiant's compromise checks, extended by the Unit 42 artifacts described in the update below, on every NetScaler that was internet-facing and unpatched at any time since early September, patched or not; isolate any hit and halt HA configuration sync until both nodes are validated.
Find any NetScaler ADC or Gateway still on the end-of-life 12.1 or 13.0 branches and decide isolation or replacement now: they receive no security updates and Citrix has not said whether they are affected.
Patch Check Point IKEv1 VPN gateways now (CVE-2026-50751): apply hotfix sk185033, disable deprecated IKEv1 remote-access support or enforce machine-certificate authentication, and run a forensic lookback from 7 May 2026 for VPN sessions established without a matching MFA event.
Upgrade every Kiteworks deployment to 9.5.1 or later (the Email Protection Gateway needs at least 9.4.1 for CVE-2026-54154), and ask Kiteworks Support in writing whether the flaw it found during the shutdown needs customer-side action on self-hosted instances.
Patch every Mac to macOS 26.6.1 / 15.7.9 / 14.8.9 and turn Screen Sharing off wherever it is not actively needed; close port 5900 at the network edge and confirm no host still answers Screen Sharing from the internet. Re-check hosted or leased bare-metal Macs after provisioning, which Huntress reports being built from vulnerable images.
Run a compromise assessment on every Mac that answered Screen Sharing from the internet before it was patched: look for an unexpected long-running high-CPU process, because the confirmed outcome on exploited hosts was root plus a planted cryptocurrency miner.
Upgrade every Gitea Docker instance that runs with ENABLE_REVERSE_PROXY_AUTHENTICATION = true to 1.26.4, or until then set REVERSE_PROXY_TRUSTED_PROXIES to the authenticating proxy's exact address, internet-reachable instances first.
Upgrade every FortiSandbox on the 5.0 or 4.4 branch to 5.0.6 or 4.4.9, which fixes all three flaws Defused reports exploited (CVE-2026-25089, CVE-2026-39808, CVE-2026-39813), and confirm the web UI and JRPC API answer only from the management network.
If any on-premises EPMM appliance was hit in the January CVE-2026-1281/1340 wave and its local admin passwords were not reset, reset every EPMM admin credential now and review admin API activity since then, because the exploited CVE-2026-6973 needs only an admin login.
Apply Oracle's September 2026 Critical Security Patch Update now to every affected Fusion Middleware, Hyperion Financial Management, Analytics, Enterprise Manager, Communications Unified Assurance and Product Lifecycle Analytics deployment. It is an off-quarter release that a quarterly patch calendar does not schedule.
Patch Oracle E-Business Suite 12.2.3-12.2.15 for CVE-2026-83327, CVE-2026-83452 and CVE-2026-83462 in this same release now: Cl0p exploited an earlier Oracle EBS zero-day from August 2025 to steal files from many organizations, and these three flaws need no credential and no user interaction.
Apply infrastructure ACLs to every Cisco ISE/ISE-PIC node today restricting management-plane access to required sources only, then patch to 3.1 Patch 12 / 3.2 Patch 11 / 3.3 Patch 12 / 3.4 Patch 7 / 3.5 Patch 4 (migrate off 3.0, which is past End of Software Maintenance) at the earliest window.
Review access.log on every ISE node (or pull a support bundle with debug logs for apigateway/access.log.*.gz) for suspicious usernames on the API endpoint, and cross-check firewall and network logs outside the ISE appliance for unexpected outbound transfers, because Cisco warns on-box evidence may be removed by an attacker who reaches root. Re-image any node where malicious activity is suspected and restore it from configuration backup, as Cisco recommends.
Upgrade every self-hosted JFrog Artifactory instance to a build that closes both CVEs: 7.133.11 or later for CVE-2026-42016, which JFrog names as its only fixed build, and the CVE-2026-42018 fix for the branch, where Wiz's corrected builds (7.133.29, 7.146.38, 7.161.20) sit above JFrog's table. Wiz's 7.111.21, 7.117.28 and 7.125.20 are below 7.133.11, so instances on those branches remain vulnerable to CVE-2026-42016 and must move to 7.133.11 or later.
On any Artifactory instance that was internet-reachable and unpatched since 15 August 2026, search access logs for an unauthenticated POST to /access/api/v1/aws/token/ (trailing slash) followed within minutes by a POST to /access/api/v1/tokens from the same client. That two-request sequence is the chain's signature. Where found, treat the instance as compromised: revoke all tokens, reset the Access token signing key and certificate, audit /api/security/users and /access/api/ui/users for administrator accounts you did not create, remove any Groovy plugin you did not deploy, and restart the JVM to clear an in-memory implant.
Push iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 through device management now, starting with the devices of staff who could be individually targeted; Apple describes the exploitation only on iOS before iOS 27.
Revoke or rotate every Azure service-principal client secret, storage key or connection string that has ever appeared in a public GitHub issue, PR, commit or gist, including ones since edited or deleted, and investigate each credential's historical use, as Microsoft advises.
Apply the CVE-2026-91843 fix to every Check Point Security Management, Multi-Domain Security Management, Log Server and Multi-Domain Log Server now, preferably as a Jumbo Hotfix take that also fixes the exploited CVE-2026-93616 (R82.10 Take 45, R82 Take 127, R81.20 Take 170, R81.10 Take 192), otherwise as the LivePatch (confirm cplp list in Expert mode shows it armed), and verify no Trusted Client/GUI access to the login interface reaches it from outside the management network.
Patch every HPE Networking Fabric Composer instance to 7.4.0 (or 7.3.4 on the 7.3 branch) now; until patched, remove the AFC API and web management interface from general-purpose networks onto a dedicated out-of-band management segment and restrict SSH access to the AFC host by source address, because CVE-2026-76658 needs no authentication.
Patch every ArubaOS-CX switch to its branch's fixed release (10.18.1002+ / 10.17.1030+ / 10.16.1060+ / 10.13.1190+ / 10.10.1181+; 10.10.x is past HPE's End of Maintenance and received only Critical-severity fixes); audit any switch left in factory-default or immediate post-ZTP state, since CVE-2026-73778's predictable admin password fully compromises a device before an administrator ever sets its own credentials.
Upgrade every on-premises Secure FMC on 7.0 and earlier, 7.2, 7.4, 7.6, 7.7 and 10.0 to its hardening release (7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13 or 10.0.2), including any already carrying the earlier hot fix; Cisco states no workaround exists, so restricting reachability is a containment step and not a substitute.
On every FMC whose web interface has been reachable, run Cisco's check in expert mode (zgrep "package_info.license" over /var/log/messages, a hit naming /var/tmp/license.tmp indicates possible exploitation) and treat a hit as a compromise to work with Cisco TAC, since Cisco states its hot fixes may not address an existing compromise.
Upgrade TeamCity On-Premises to 2025.11.7 or 2026.1.3 on the matching branch, or install JetBrains' security-patch plugin where the version is older than that but at least 2017.1, and while the upgrade is scheduled, take the server's agent-polling endpoint off any internet-reachable interface, because the flaw needs nothing but HTTP(S) reachability.
Treat any TeamCity On-Premises server that was internet-reachable and unpatched before 2026-08-05 as a compromise-assessment target rather than a completed patch: review build-agent registrations for agents you did not enrol, and rotate the VCS credentials, artifact-repository tokens and signing keys the server holds, because an upgrade evicts the entry point but not what was taken through it.
Apply the fixed release for your family listed in ServiceNow security bulletin KB3137947 (Zurich Patch 7b or 9, Yokohama Patch 12 Hot Fix 1b or Patch 13, Australia Patch 2, Brazil EA or GA) to every self-hosted or partner-managed ServiceNow AI Platform instance now. Exploitation attempts have been reported since 2026-07-17, and self-hosted instances are the ones ServiceNow did not fix itself.
Confirm every Kemp LoadMaster runs GA 7.2.63.2 or LTSF 7.2.54.18 or later, and disable the LoadMaster API wherever it is not required, which removes the /accessv2 attack surface.
For any LoadMaster that was internet-reachable with the API enabled before it was patched, run a compromise assessment of the appliance rather than closing the ticket on the version string: a public exploit has circulated since 2026-06-29.
Patch the LiteSpeed cPanel plugin (CVE-2026-54420) by upgrading to LiteSpeed WHM PlugIn version 5.3.2.1, which bundles cPanel plugin 2.4.8, or uninstall the user-end plugin until then. It is actively exploited on shared CloudLinux/CageFS hosting. Prioritise any public-sector tenant on shared hosting.
Audit domain-root and OU-linked GPOs for unexpected Files, Registry or Security Settings client-side-extension entries (ransom-note file drops, legal-notice banner rewrites, local Administrator account disablement, Windows Firewall disablement): the attack shows primarily in GPO content, GPO-creation events and SYSVOL, with the endpoint Group Policy log as a post-detonation signal.
Upgrade every SolarWinds Observability Self-Hosted deployment to 2026.2.3, and remove any internet exposure of SolarWinds management and communication services while the vendor withholds which configuration and communication mode are vulnerable.
Patch every self-managed Virtualizor installation to 3.2.9 patch 9 or 3.3.0 now, and keep admin-panel ports 4084/4085 off the public internet or behind an allowlist regardless of patch level.
Upgrade Codex to 0.146.0 or later (OpenAI's own fix), Claude Code to 2.1.179 or later (fixed according to AIR, though Anthropic's release notes do not mention it), and Copilot CLI to 1.0.87 or later and the Copilot app to 1.1.23 or later (fixed according to GitHub support, as reported by heise online). Consumer Gemini CLI gets no fix: on it, verify git rev-parse HEAD against a plugin's marketplace-pinned SHA before trusting any update, or migrate off it as AIR advises.
Patch the kernel ahead of the regular cycle on Linux hosts that load the tls module (CVE-2025-39682, remotely reachable), run ebtables SNAT rules that rewrite ARP hardware addresses on a bridge (CVE-2026-53266), or give less-trusted users local access (all three); where the update must wait, block the tls module from loading or remove the ARP-rewrite SNAT rules, as Red Hat advises.
On every WordPress site that loaded a Brevo forms, Conversations or SDK script on 2026-09-14 and had an administrator visit while logged in, check for any plugin installed or activated that day and compare the plugin directory on disk with the admin plugin list, because the known backdoor (impersonating "Web Media Optimizer") hides from that list and copies itself into the must-use-plugins directory. Remove any such plugin, invalidate all administrator sessions, change administrator passwords and review administrator accounts, because its hardcoded key mints admin logins without a password.
Update the Acronis Backup plugin/extension on every cPanel & WHM (<1.9.3.1021) or Plesk (<1.8.11.638) server to the fixed build now, regardless of the single-customer-report basis behind Acronis's exploitation claim.
Upgrade every internet-reachable phpBB board to 3.3.17: CVE-2026-48611 gives a session as any user on default installations from one unauthenticated request, proof-of-concept requests are public, and no configuration change closes it.
Patch CVE-2026-46300 on multi-tenant Linux hosts, container nodes and CI runners. Apply the distribution kernel update and reboot. Until then, where IPsec is not in use, block and unload the esp4, esp6 and rxrpc modules (this breaks IPsec), then drop the page cache so any binary already modified in memory reloads from disk.
Scope. 75 entries received one changelog record each: stale exploitation statements rewritten where they stand, swapped CVE statuses, KEV-listing and ransomware-flag facts, indicators and inline technique ids removed from reader text, 24 banned citations repaired from R1's findings, 36 priorities recalibrated against the 4.17 high bar, and seven legacy v2-migrated entries re-verified and rewritten from their primaries (ABW water plants, Die Linke, Eurail, CVE-2026-32202, Dragos, Ivanti EPMM, FortiSandbox). Three Ivanti duplicates were folded into the corrected survivor with tools/fold_entries.py.
Coverage. Not a coverage re-sweep. Apple CVE-2026-86950, the one uncovered KEV addition when this run started, was covered by the 2026-09-30T0404Z intel fire, merged mid-run.
Warnings. None open. The aggregator-only warning on 2026-05-08/qilin-ransomware-hits-die-linke-germany-1-5-tb-claimed-dpa-n cleared once the party's own statement could be read through the reader late in the run; the statement is now the entry's primary source.
Merge. A parallel audit run, 2026-09-30T0634Z-audit, landed on main while this run was open and shipped its own prompt release as 4.18 and its report as docs/audits/2026-09-30-quality-audit.md. This run's release is therefore 4.19 and its report docs/audits/2026-09-30-correction-audit.md. The two runs touched no common entry. The shared files merged cleanly apart from prompts/CHANGELOG.md, where both release notes are kept. Verifier reports from iterations 1 to 3 still name the report's earlier path. The 2026-10-02T0404Z intel fire later appended update records to the Kiteworks and Citrix entries. Both were merged with the fire's facts and sections kept, and this run's records on them were re-dated to 2026-10-02 so that they stay last in their append-only lists. The 2026-10-04T0405Z fire then updated the Check Point CVE-2026-93616, Flink and Citrix entries and received the same merge. Where that fire's own correction already covered this run's reader-facing points (Check Point, Flink), this run's record became an internal metadata record.
Verification. Eight iterations of the single cti-verification definition, each run as four parallel slices on disjoint entry sets, with slice 4 also reading this record and the audit report. Findings fell from 237 in iteration 1 to 35 in iteration 8 (truth and editorial from 206 to 23). The cap was reached on NEEDS_FIXES, so the run publishes fail-open. All 35 findings of the last pass were worked before publish (34 applied, 1 declined), but no pass verified those fixes, and the residual count keeps the last pass's 23 truth and editorial findings. API usage limits cut off the verifier passes of iterations 2, 4 and 6 part-way. Each was re-run cold, and the partial outputs are kept under aborted-429/, aborted-limit/ and aborted-limit-iter6/.
Duration. The record spans about 101 hours of wall clock, from 2026-09-30 06:39 to 2026-10-04 11:30 UTC. The run did not hang. It was an interactive operator session that paused several times on API usage limits and resumed each time, and while it was open it merged the later intel fires named under Merge. The 24-hour stall warning on this record reflects that wall clock, not a stalled worker.
Watch. About 19 same-finding twin groups and 24 unfolded legacy UPDATE entries remain for a consolidation run, carrying the 8 banned citations not yet repaired. The legacy queue holds 468 pending entries.
ATT&CK pin: unchanged in this run (v19.2 per the 2026-09-29 check).
2026-09-30T0634Z-audit· audit · Opus 5.5 (1M context) · window 9 h · 0 entries published
Verification & coverage notes
Operator-directed follow-up to the 2026-09-29 audit (2026-09-30): use WebFetch where it makes sense for the sources the container cannot read, change CLAUDE.md to match, cover the missing Apple CVE-2026-86950 entry, and repoint the four entries whose NCSC-CH citations had gone dead. Report: docs/audits/2026-09-30-quality-audit.md.
Fetch policy (v4.18). CLAUDE.md, both agent definitions, cti-run.md and quality-audit.md now sanction WebFetch for hosts the container is walled out of, as the fetch ladder's fourth rung ahead of the metered reader. cisa-kev, cisa csaf-recent and ncsc-csh stay on the bridge. v4.17's setup review, which landed on main during this run, had already moved the three records to fetch_method: webfetch, so this release aligns the rules and the health check with them. Tested before the change: WebFetch read the cisa.gov news listing and the cybersecurity-advisories listing with dates and item URLs, and the directives list with item URLs, and read an ssd-disclosure.com advisory page. An independent source-recipe pass (SR1) confirmed the three CISA recipes down to drilled pages. ssd-disclosure.com did not hold up: WebFetch read one of its advisory pages once, then SR1's 26 calls over 18 URLs returned 24 empty bodies and 2 replays of that cached read, and once the reader pool was refilled (about 07:40Z) the funded reader got the same SiteGround captcha on every try, so no transport reads SSD and it goes to fetch_method: blocked, a documented coverage gap served by WebSearch leads. source_health.py gives such records, when the container is actually walled out, the verdict webfetch-only (handled) instead of unreadable or needs-bridge, retries a walled, undated or failed-feed read up to twice before flagging it, and the Ops panel lists the webfetch-only records separately. A 404 or parked page is not a wall, so it still surfaces. Most of the 83 fetch_method: webfetch records predate extract and read cleanly with it, so the agents try extract first there.
Apple CVE-2026-86950. This run composed an entry from Apple's three security notes, the KEV record and three outlets, then found on syncing that the 2026-09-30T0404Z intel fire, which landed on main at about 06:45Z, had already published one (entries/2026-09-30/cve-2026-86950-apple-coregraphics-zero-day-kev.md) carrying the same facts plus CVSS and EPSS. This run's draft was dropped as a duplicate, with its registry and state rows, so the item is closed by the intel fire.
Repointed citations. Four June entries cited ncsc.admin.ch pages that now answer 404 after the agency's move to bacs.admin.ch. Each now cites the same page on bacs.admin.ch. Re-reading each page against its entry also found wording the page does not support (a "coordinated surge" of three reported cases, both scam variants tied to the Booking.com leak, mailbox forwarding rules the page never mentions, hardened hedges, a misnamed ZENDATA vector), so each change is a correction record with its own section. The week 22 and week 25 entries move from high to notable priority, since NCSC names no sector and no constituency exposure for either. Each record also adds the ATT&CK mapping, limited to what the page supports, and the Admiralty rating those pre-v3.18 entries lacked. The week 25 entry's spliced evidence quote is now verbatim quotations.
Registry. The names and summaries of campaign:ncsc-ch-jobseeker-targeting-2026 and incident:ncsc-ch-booking-hotel-phishing-2026 and the summaries of report:g7-evian-2026 and campaign:ncsc-ch-m365-voicemail-phishing-week25 follow the corrected entries, and the G7 and week 25 entries now link report:g7-evian-2026 and campaign:ncsc-ch-m365-voicemail-phishing-week25.
Sub-agent models. Recorded per sub-agent and verifier iteration above.
2026-09-30T0404Z-intel· Sonnet 5.5 · window 26 h · 4 entries published
Verification & coverage notes
Coverage window: standard (gap_hours=23.98, window_hours=26); no catch-up disclosure required.
Mechanical KEV sweep:tools/kev_window_diff.py --window-hours 26 --run-id found one CISA KEV addition not covered by the store, CVE-2026-86950 (Apple CoreGraphics, added 2026-09-29). It is published as a new entry (2026-09-30/cve-2026-86950-apple-coregraphics-zero-day-kev); S1 confirmed catalog version 2026.09.29 is the latest and no addition followed it (work/2026-09-30T0404Z-intel/kev-window.txt).
New entries (4): Apple CoreGraphics CVE-2026-86950 (vulnerability, high; exploited against targeted iOS users, KEV-listed); Manno (TI) commune ransomware (incident, notable; Swiss communal administration, victim's own notice, SafePay claim attributed only); Star Blizzard RedFlick (threat, notable; Russian state actor, governments and diplomatic bodies among named targets, new single-click delivery chain); Storm-3068 SSPR to Azure DevOps to Kubernetes credentials (threat, notable; Microsoft DART first-party case).
Updates (5): Citrix NetScaler CVE-2026-88771/88772 (update, priority stays critical): Google GTIG/Mandiant campaign since early September, post-exploitation persistence, exploit availability for 88772, interim controls for 88772 only, EOL branches, and the Rhineland-Palatinate municipal shutdown with heise's link to NetScaler kept as heise's assessment; F5 BIG-IP APM CVE-2026-94127 (improvement, no float): watchTowr's public trigger of 2026-09-23 that the entry never recorded (a store gap found by S1, dated outside the window, so it ships as an improvement and not as news); DGFiP tax-authority intrusion (update): ANSSI's own incident report of 2026-09-29; Pentagon DMDC breach (update): a defense official's figure of 2.76 million living and 294,000 deceased replaces the earlier estimate of about four million; Kiteworks shutdown warning (update, added after verifier iteration 1): Kiteworks's own release of 2026-09-28 says its engineering and security work during the shutdown led to a previously unknown critical vulnerability being found and fixed in a capability used by under 1% of customers, with no indication of exploitation.
Source allocation: 97 sources attempted by the previous two fires were excluded from the rotational slices as belt-and-braces (state-summary.json rotation cursor built normally). S1 and S4 fell back to cursor-only ranking because the exclusion would have left them empty (every breaches source had been attempted in both prior fires); S4 was also given the six unallocated breaches-tagged sources (bleepingcomputer, piyolog, ransom-isac, troyhunt, venarix, zaufana-trzecia-strona). Slices: S1 17, S2 24, S3 18, S4 13; every record has a ledger row, so no continuation was needed.
Backlog work (state/coverage_backlog.md): nineteen of the 22 open rows were re-gated on today's facts and no row was struck (the Siemens S7 advisory AA26-231A row, the Spring Ring row and the four-item PD-11(d) row were not re-read, and the research-blog row was not worked). No change on seventeen; DIVD shows a partial development (technical vulnerability, not NetScaler, and an AI-agent post-exploitation phase; product and class undisclosed; fuller update promised 2026-10-01) and is held one cycle. Four new rows opened: MikroTik RouterOS CVE-2026-84411, IBM Guardium CVE-2026-85542, ARA-Region Lyss-Limpachtal (SafePay claim), Netech AG (Payload claim). Manno (TI), previously tracked only through a leak-site claim in S2/S4 leads, is published now that the commune's own notice was read.
borderline-drop: MikroTik RouterOS CVE-2026-84411 (pre-auth integer underflow, CVSS 9.8): CISA-only, no known exploitation, and CISA's text contradicts itself on the fixed build while MikroTik does not name the CVE; regular-cycle at this evidence (backlog row opened).
borderline-drop: WatchGuard AP below 3.4.8 (CVE-2026-101891 / CVE-2026-86102, CVSS 4.0 9.3): NCSC-CH advisory 13007 exists, but WatchGuard's PSIRT says it is not aware of exploitation and the attacker needs network access to the AP; regular patch cycle.
borderline-drop: Zimbra Collaboration 10.1.21: the headline password-recovery flaw has no CVE yet, nothing is exploited, and the store already carries the exploited SNMP flaw fixed in 10.1.20; regular patch cycle.
borderline-drop: IBM Guardium Data Protection CVE-2026-85542 (CVSS 3.1 8.8): ACN's alert AL04/260928/CSIRT-ITA reports active exploitation of a patched flaw (needs an authenticated remote user; GIM bundle import injects arguments into tar), but the alert is dated 2026-09-28 (outside the window), the flaw is not KEV-listed and the product's footprint in the constituency is unestablished; the primary was read in full after verifier iteration 2 and the backlog row now carries its facts.
borderline-drop: Ticino eAutoindex delta (Ticino as a further victim of the vehicle-lookup scraping, paid lookups from 2026-11-01): out-of-window, primary 2026-09-28, and the delta is one more canton disclosed around 2026-09-03 plus a fee control.
borderline-drop: FTAPI (Munich secure file-exchange vendor) ransomware: the vendor states its platform and customer systems were unaffected, no Swiss customer link is established, no access vector is stated; the fraud caution for customers is its own.
borderline-drop: ENISA Threat Landscape 2026: out-of-window (published 2026-09-22) and an awareness and statistics report with no change to what a responder does in the next seven days.
borderline-drop: Lomazzo (IT) commune mailbox takeover used to send fake fines: small foreign commune, vector and scale unstated; the trusted-sender pattern is already carried by the Martigny-Combe and Revolut entries.
borderline-drop: DIVD agentic-AI breach: held in the backlog until DIVD's promised 2026-10-01 update names the product or class.
borderline-drop: Fakturownia.pl breach (the same actor's third Polish victim): Polish SME invoicing SaaS, no Swiss or public-sector link, exploit chain is the actor's claim relayed by one outlet.
borderline-drop: ShinyHunters/FBI Dutch-police and FBI-video delta: law-enforcement colour, not defender-relevant; the arrest is already recorded.
borderline-drop: OpenAI's four Australian incidents: Australian agencies, second-hand (the OpenAI post returns 403 to every transport), and the AI-agent thread already has seven entries.
out-of-window: NeedyMantis (Microsoft Threat Intelligence, primary 2026-09-28T15:00Z) and the ChatGPT Custom-GPT ClickFix campaign (Huntress, primary 2026-09-28T20:00Z), window_hours=26; both are also generic-relevance items, so neither is a backlog row.
borderline-drop: MSP360-to-ScreenConnect RMM phishing (unattributed, generic RMM hardening); VUSec Branch Target Reuse (academic Spectre-v2 variant, kernel mitigations merged, needs local code); DarkSword iPhone Duo lure (consumer scam lure for a chain Apple patched in March); MCP Python SDK OAuth flaw (library flaw, no CVE, no exploitation).
borderline-drop: Junta de Andalucía (MedusaLocker), Alaxione (ChimeraZ), CENELEC/CEN (Everest), Netech, ARA Lyss and SafePay's other Swiss listings: claim-only under PD-6 or out of nexus; the last two are backlog rows.
borderline-drop: CISA ICS advisories of 2026-09-29 other than MikroTik, ENISA EUVD criticals (AiSOC, GLPI, Ziroom), Mozilla MFSA 2026-97 to 100, Chrome 154.0.8037.92/.93, PyJWT and decompress advisories: regular patch cycle, none exploited.
Single-source: 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain and 2026-09-30/storm-3068-sspr-azure-devops-kubeconfig-theft: Microsoft's own telemetry and casework (Admiralty B, original vendor research); no independent second observation exists. 2026-09-30/manno-ti-commune-ransomware-safepay-claim: single-source-victim, the commune's own notice; SafePay's role is a tracker-recorded claim.
Contradiction: 2026-08-15/france-dgfip-tax-authority-credential-intrusion: the ministry's August statement attributed the missed detection to the attack's sophistication, while The Hacker News reports that ANSSI's report calls the attack unsophisticated; the update states both with attribution and the earlier statement stays attributed to the ministry.
Coverage gaps: inside-it-ch (essential; article pages return a Vercel checkpoint 429 on every transport and the reader pool is exhausted, so only RSS teasers were readable; the Manno and Sesamvote articles were not read); openai.com (403); lore.kernel.org (Anubis); computerweekly.com/de (403); cybersecuritynews.com (Cloudflare 202); cyberattaque-org (connection reset); securityaffairs and proofpoint (S3 slice: no drill-down URLs on any transport tried); msrc-blog (SPA shell after a 301); wiz-blog (feed live, newest item 2026-09-01); ncc-research and prodaft (listings carry no dated posts); censys.com/advisory listing (timeout; per-advisory pages read fine).
Essential-coverage: none missed; all 17 essential records were attempted (inside-it-ch as noted above).
The jina reader credential pool was exhausted (HTTP 402 on all keys) across every domain this fire, a normal condition; extract and the bridge recipes covered every source that mattered.
Candidate sources: added anssi-cyber-gouv-actualites (ANSSI now publishes incident reports under cyber.gouv.fr/actualites; RSS works) and fuitesinfos (French breach tracker already cited in standing backlog rows). Not added for lack of a working recipe: censys-advisories (S1: per-CVE advisories with exposure by country, listing times out) and rsi-info-ticino (S2: Ticino regional broadcaster, no RSS).
Recipe fixes applied from the sub-agent reports: rss_url set for volexity, zscaler-threatlabz, talos, group-ib and infoguard-ch; recipe notes for technadu, cnil-fr, ransomware-live, inside-it-ch, venarix, ec-digital-strategy-newsroom, enisa, zaufana-trzecia-strona and ico-uk (sources_changed[]).
Store observation for the next audit (S4): entries/2026-08-23/martigny-combe-valais-communal-mailbox-compromise.md and entries/2026-08-28/martigny-combe-valais-municipal-email-compromise.md appear to describe the same Martigny-Combe mailbox compromise, a one-entry-per-finding violation to merge through changelog records.
Store observation for the next audit (S1/S2): the F5 BIG-IP APM entry lacked the public-trigger fact until this fire; Austria's NISG procedural detail (USP registration by 2027-01-01) sits on a page dated 2026-09-08 and could support a later update on 2026-09-23/austria-nisg-2026-bcs-transposition.
Source health (tools/source_health.py): three records remain on the UNSOLVED list, all reader-dependent and already documented by the 2026-09-29 audit: cisa-directives and cisa-news (www.cisa.gov returns an Akamai 403 to every free transport) and ssd-disclosure (HTTP 202 JavaScript challenge; candidate). Re-probed this fire: no free transport reads any of the three, and the reader pool is empty. The agent-side WebFetch reads the CISA pages, so they are neither demoted nor re-pinned; the health check exercises only fetch_source.py, so the flag stays a false positive until reader credit is refilled.
Contradiction: 2026-09-28/cve-2026-88771-citrix-netscaler-preauth-rce-zero-day-kev: Help Net Security's text (2026-09-29) says there was no public proof of concept for CVE-2026-88772, while NCSC-CH's advisory history records an edit adding a PoC for CVE-2026-88772 at 14:41Z the same day (watchTowr's tool is a detection-artifact generator); the update states both with attribution and the CVE records carry poc-public.
Verifier iteration 1 (declined, low confidence): the NeedyMantis out-of-window drop stands (Microsoft primary 2026-09-28T15:00Z, window_hours=26). The nexus argument (China-aligned implant in telecom, intergovernmental and government-contractor intrusions, pivoted from the DAEMON Tools compromise) is real but generic to this constituency, so the audit can recover it if it judges otherwise. Run-record wording about sub-agents and S1-S4 ids is kept: this record is operator-facing and prior records use the same ids.
Essential-source coverage: five sources (bacs-press, fortinet-psirt, msrc-update-guide, paloalto-psirt, watchtowr) entered the source list as essential through the v4.17 review that merged to main after this fire had sliced its sources, so no sub-agent was assigned them; the merge at publication carries them, and the next fire's allocation includes them. No finding of this run depends on a first-party Palo Alto, Fortinet, MSRC or BACS feed.
Verification outcome: six iterations. Iterations 1 to 4 returned NEEDS_FIXES (22, 10, 6 and 4 findings) and every truth and editorial finding was remediated or declined with a recorded reason; iterations 5 and 6 were consecutive cold CLEAN passes with advisories only, so the run publishes on a confirmed CLEAN with no residuals. The verifier's advisories left open are listed under iteration 6 for the next audit.