‹Thu · 15 Oct 2026

Daily brief · UTC day

Thursday, 15 October 2026

4 verified findings from 1 run · 2 updates to prior coverage · the settled record for this UTC day, in the classic brief order.

CriticalVerify Content Scanner Tools 25.3.0.5525 or later on every Cisco Secure Email Gateway and run Cisco's compromise check todayCVE-2026-76519 · exploited · 15 Oct 03:40Z

Criticality

Kind

Topic

Region

TL;DR · the day in one read

01Cisco's mail gateway has a second exploited root flaw in four weeks; the fix ships as a Content Scanner Tools update. Cisco's advisory of 2026-10-14 fixes CVE-2026-76519, a relative path traversal in the Advanced Malware Protection (file reputation) path of Cisco Secure Email Gateway that lets an unauthenticated attacker who sends one crafted attachment through the device write files and run commands as root (CVSS 9.8); Cisco says its PSIRT became aware of exploitation in October 2026, and CISA listed the flaw in KEV the same day. Only gateways with File Reputation enabled on a mail policy and Content Scanner Tools earlier than 25.3.0.5525 are exposed; there is no workaround, and the fix ships as a Content Scanner Tools update that needs no restart or upgrade, and in AsyncOS 15.5.5-014 and 16.5.0-780. →
02Exploited Nextcloud Collabora CODE app flaw: disabling the app does not help; update to 26.4.303 or remove it. CVE-2026-110447 is an OS command injection in proxy.php of the Collabora Online Built-in CODE Server, the richdocumentscode app that runs Collabora inside Nextcloud; versions before 26.4.303 are affected, the GitHub advisory record says it was exploited in the wild in September and October 2026, and a hoster reported web shells on its Nextcloud servers on 2026-09-11. Disabling the app does not stop the request, so it must be updated to 26.4.303 or removed; standalone Collabora Online servers are not affected. →
03Palo Alto confirms limited exploitation of a PAN-OS management-interface root flaw; no workaround, 11.2.16 now published. Palo Alto Networks' advisory of 2026-10-14 fixes CVE-2026-0322, a code injection in the PAN-OS management interface that lets an authenticated attacker with network access run code as root on PA-Series and VM-Series firewalls and on Panorama; the advisory is tagged as attacked and reports very limited exploitation, and CISA listed the flaw in KEV the same day. There is no workaround and the risk is highest where the management interface is reachable from the internet; 11.2.16, the fixed build for units on 11.2.14 and 11.2.15, was published on 2026-10-15, so every train now has a fixed build. →

01Active threats, incidents & disclosures1 item

NOTABLENATOB2

A fake WatchGuard VPN download site captures the SSL VPN server, login and password in the browser and then serves the genuine signed installer, leaving no malicious file for endpoint tools to flag

Huntress's SOC investigated an incident on 2026-10-07 in which an administrator at a managed service provider searched Bing for a WatchGuard VPN download with a typo in the query and clicked through the standard Bing result redirect to a lookalike site titled "WatchGuard Firebox VPN Client", which Huntress classes as search-engine poisoning rather than malvertising (Huntress, 2026-10-13). Choosing any download option opens a pop-up asking for Server, Login and Password; one unobfuscated JavaScript file of about 150 lines posts the typed values as JSON to a separate collector domain, tagged as the first or second attempt, and always rejects the first submission with an "incorrect data" message so that the victim types again or tries a second set of credentials (Huntress, 2026-10-13). Only after the second submission does the page fetch the real WatchGuard Mobile VPN with SSL installer from WatchGuard's own CDN, an Authenticode-signed file whose digest Huntress recomputed and found unmodified, so there is no trojanized installer or malicious DLL for endpoint defenses to flag (Huntress, 2026-10-13). The victim's browser history showed no download in the observed window, so Huntress judges the user probably did not finish both rounds but may have typed credentials in the first, and Managed Defender flagged the incident 21 seconds after the lookalike domain loaded (Huntress, 2026-10-13). Both domains were registered within the previous two months, few reputation engines flagged either as of 2026-10-08, and the lure domain was offline by 2026-10-13 (Huntress, 2026-10-13). Huntress places the iteration in a campaign that WatchGuard's Secplicity team described in January 2026 as lookalike download sites for WatchGuard, F5, Fortinet, SonicWall and Sophos clients, and that Microsoft tied in March 2026 to a financially motivated actor it tracks as Storm-2561; the new element is that the fake client is gone from the middle (Huntress, 2026-10-13).

Triage: a genuine VPN client also asks for server, login and password, but only inside the installed client at connect time; a browser form that collects the three values before any installer has run, on a domain that is not the vendor's, is the signal.

Rather than downloading a fake client, the domain instead downloads a genuine, validly signed WatchGuard installer.

The legitimate Mobile VPN with SSL client also asks for these three values when users connect, so the prompt looks reasonable.

Huntress 2026-10-13

threat15 Oct 03:43Zsingle-sourceOpen finding →

Sources: Huntress

CRITICALCVE-2026-76519exploitedNATOA2

CVE-2026-76519, Cisco Secure Email Gateway: one crafted email attachment writes files and runs commands as root, exploited in the wild and listed in CISA KEV (CVSS 9.8)

Cisco's advisory of 2026-10-14 describes CVE-2026-76519, a relative path traversal in the Advanced Malware Protection feature of Cisco Secure Email Gateway: improper handling of email attachments when the file reputation service is enabled lets an unauthenticated remote attacker who sends a crafted attachment through the device write arbitrary files on the underlying operating system and run commands as root, and Cisco rates it CVSS 3.1 9.8 (Cisco PSIRT, 2026-10-14). Cisco states that in October 2026 its PSIRT became aware of active exploitation, and that it has directly contacted Cisco Secure Email Cloud customers on whose devices indicators of possible compromise were identified (Cisco PSIRT, 2026-10-14); CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026-10-14). Cisco gives no workaround; the fix is distributed through the Content Scanner Tools package for every supported AsyncOS release and needs no software upgrade or restart, and it is also in AsyncOS 15.5.5-014 and 16.5.0-780, while release 16.0 must migrate to a fixed release (Cisco PSIRT, 2026-10-14). It is the second exploited root-level flaw in this product in about four weeks: BleepingComputer notes that last month Cisco warned of CVE-2026-76461, which also lets unauthenticated remote attackers run commands as root (BleepingComputer, 2026-10-14).

In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

There are no workarounds that address this vulnerability.

Content Scanner Tools versions 25.3.0.5525 and later contain the fix for this vulnerability.

Cisco PSIRT 2026-10-14

Builds on: Cisco's mail gateway can be rooted by a single crafted email, and Cisco found out from a real…

vulnerability15 Oct 03:40Zmulti-sourceOpen finding →

Sources: Cisco PSIRT · BleepingComputer · CISA

HIGHCVE-2026-110447exploitedNATOA2

CVE-2026-110447, Collabora Online Built-in CODE Server (Nextcloud richdocumentscode app): an unauthenticated command injection in proxy.php, exploited in the wild to plant PHP web shells, fixed in 26.4.303 (CVSS 4.0 9.2)

Collabora's own advisory, published 2026-10-14, says users of Nextcloud with the Collabora Online Built-in CODE Server app (richdocumentscode) can be vulnerable through proxy.php: a request can run an operating system command as the web server user, the attack works only while the built-in CODE server is not running (after a restart, an upgrade or a crash), and disabling the app is not sufficient, it must be upgraded to 26.4.303 or later or removed (Collabora Online security advisory, 2026-10-14). Users of end-of-life Nextcloud 29 or older should upgrade Nextcloud or remove the app, standalone Collabora Online servers are not affected, and the fix for CVE-2025-66208 does not prevent this flaw (Collabora Online security advisory, 2026-10-14). The GitHub Advisory Database record for CVE-2026-110447 says it was exploited in the wild in September and October 2026 (GitHub Advisory Database, 2026-10-14). Field reports came first: on 2026-09-11 a hoster reported on the app's issue tracker that several Nextcloud servers running richdocumentscode 26.4.302 had been compromised since the previous day through requests to proxy.php that carried shell command substitution and an encoded path traversal, with base64 payloads decoded and run through a shell to create PHP web shells in the app directory; on one server the attacker then searched for password-manager databases and cryptocurrency-wallet files, and the reviewed requests showed no archiving or upload commands (issue 354, 2026-09-11). Other administrators report the same compromise, one noticing it because Nextcloud's integrity check failed on an unexpected PHP file (issue 354, 2026-09-11). A reply on the issue says the flaw affects only the Development Edition in the Built-in CODE Server mode that downloads a local AppImage, and a later one that leftover web-shell files must be removed after upgrading (issue 354, 2026-09-11). A Nextcloud forum post of 2026-10-03 told users to update, saying that as far as the poster knew no CVE existed (Nextcloud community forum, 2026-10-03).

It is not sufficient to disable the app to avoid the problem, it must be upgraded to >= 26.4.303 or removed.

Collabora Online security advisory 2026-10-14

as exploited in the wild in September and October 2026

GitHub Advisory Database 2026-10-14

The attacker was able to create php-files which are web-shells:

CollaboraOnline/richdocumentscode issue 354 2026-09-11

This impacts only the Development Edition, and only in this (rather rarer) Built-in CODE Server deployment mode that downloads a local appimage.

CollaboraOnline/richdocumentscode issue 354 (a reply on the issue)

vulnerability15 Oct 03:42Zmulti-sourceOpen finding →

Sources: Collabora Online security advisory · GitHub Advisory Database · CollaboraOnline/richdocumentscode issue 354 · Nextcloud community forum

HIGHCVE-2026-0322exploitedupdatedNATOA2

CVE-2026-0322, Palo Alto Networks PAN-OS: code injection in the management interface gives an authenticated attacker root, exploited in very limited attacks and listed in CISA KEV (CVSS-B 8.6)

Palo Alto Networks' advisory of 2026-10-14 describes CVE-2026-0322, a code injection (CWE-94) in the management interface of PAN-OS that lets an authenticated attacker with network access run arbitrary code as root on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected and no special configuration is needed to be affected (Palo Alto Networks PSIRT, 2026-10-14). The advisory is tagged as attacked and says very limited exploitation has been observed targeting the management interface (Palo Alto Networks PSIRT, 2026-10-14), and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026-10-14). Palo Alto scores it CVSS-B 8.6 with a suggested urgency of highest, says the risk is highest when the management interface is reachable from the internet, and scores it 8.5 when access is restricted to a single jump box (Palo Alto Networks PSIRT, 2026-10-14). It lists no workaround; Threat Prevention IDs 510046 and 510047 give limited coverage and only when management traffic is routed through a data-plane interface and decrypted, and Palo Alto warns that variations of the attack may not be detected (Palo Alto Networks PSIRT, 2026-10-14). Fixes ship per train; a unit on 11.2.14 or 11.2.15 had no fixed build when the advisory appeared, and 11.2.16, the fix for those two releases, was published on 2026-10-15 (Palo Alto Networks PSIRT, 2026-10-14). The advisory does not say how the attackers obtained the credentials the flaw requires, when exploitation began or who is behind it, and BleepingComputer says it asked Palo Alto when exploitation began, who is behind the attacks and whether attackers compromised firewalls or used them to reach internal networks (BleepingComputer, 2026-10-14).

Very limited exploitation has been observed targeting the Palo Alto Networks management interface.

No known workarounds exist for this issue.

The risk is highest when you allow access to the management interface from external IP addresses on the internet.

11.2.16 has been published.

Palo Alto Networks PSIRT 2026-10-14

Update16 Oct 2026 04:08 UTCrun 2026-10-16T0256Z-intelheadlinesummarycvesevidenceactionsbody

Palo Alto Networks published 11.2.16 on 2026-10-15, the fixed build for units on 11.2.14 and 11.2.15, which had none when the advisory appeared; its solution table now reads "Upgrade to 11.2.16 or later" for those two releases and every other train keeps the fixed builds already listed (Palo Alto Networks PSIRT, 2026-10-14). The advisory's exploitation status is unchanged at very limited exploitation, and it still lists no workaround (Palo Alto Networks PSIRT, 2026-10-14).

Builds on: CISA marks the exploited GlobalProtect VPN bypass as used in ransomware; Arctic Wolf traced…

vulnerability15 Oct 03:41Zmulti-sourceOpen finding →

Sources: Palo Alto Networks PSIRT · BleepingComputer · CISA

03Updates to prior coverage2 items

HIGHexploitedupdatedNATOA2

Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers compromised, with forced defrost reported at hundreds of French supermarkets; CERT-FR and NCSC Switzerland say to remove internet exposure

First published 2026-10-13 · open finding →

Improvement15 Oct 2026 03:49 UTCrun 2026-10-15T0256Z-intelsourcesevidencesourcing_notebody

Censys's exposure report of 2026-10-14 points to three published 2025 AK-SM 800A flaws that Danfoss patched more than a year earlier and gives their firmware boundaries (4.3.1 or later fixes all three; Danfoss has not confirmed the vector), and shows exposed French controllers falling about 71 percent in three days with patched and unpatched builds leaving at the same rate, which Censys reads as operators taking units offline rather than patching.

Censys, which scans for Danfoss StoreView control panels, says Danfoss has not confirmed the initial access vector and points to three AK-SM 800A flaws that Danfoss patched more than a year earlier: CVE-2025-41450 (March 2025), which Censys describes as letting an unauthenticated actor log in as an administrator with a code computed from the current calendar date, and CVE-2025-41451 and CVE-2025-41452 (August 2025), which it says let authenticated users run commands and disrupt the management interface (Censys, 2026-10-14). Censys maps the firmware by build: below 4.2 carries all three, 4.2.4 fixes only the date-based login and still carries the two later ones, and 4.3.1 or later fixes all three (Censys, 2026-10-14). Its scan counted 1,825 exposed StoreView panels in France on 2026-10-11 and 537 on 2026-10-14, a fall of 71 percent, with builds below 4.2, build 4.2.4 and builds from 4.3.1 leaving at about the same rate, which it reads as operators taking controllers off the internet rather than patching them (Censys, 2026-10-14). Outside France the count fell from 1,166 to 966, and in ten of the twelve countries with the most exposed hosts more than 60 percent of the hosts run a build below 4.3.1, led by Poland at 81 percent and Romania at 80 percent (Censys, 2026-10-14).

Sources: CERT-FR (alert CERTFR-2026-ALE-012) · AFP · BFMTV · Infosecurity Magazine · BleepingComputer · CERT-FR (alert CERTFR-2026-ALE-012, revised version) · NCSC Switzerland (Security Hub advisory 13054) · Cooling Post · Blick · Censys

NOTABLEupdatedNATOA2

PK Softech, software supplier of Swiss pension funds: malware and a data outflow at Publica, with the Bernese funds BPK and BLVK and Pensionskasse Post also reporting the supplier incident, and the Federal Prosecutor's Office investigating

First published 2026-10-09 · open finding →

Update15 Oct 2026 03:48 UTCrun 2026-10-15T0256Z-intelsourcesevidencesourcing_noteactions

The Pensionskasse Stadt Zürich, the City of Zurich's pension fund, says on 2026-10-13 that it currently uses another provider, plans to move to PK Softech's system in early 2027 and is checking whether data from migration tests was affected. Publica's page says as of 2026-10-14 that it has no indications that data from the attack was published on the darkweb.

The City of Zurich's pension fund has commented, and its position differs from the other funds': the Pensionskasse Stadt Zürich (PKZH) says in a notice dated 2026-10-13 that PK Softech was hit at the end of September, that it currently works with another software provider and plans to move to PK Softech's administration system in early 2027, so the attack does not touch the system it uses today, and that it is still clarifying whether, because of tests carried out ahead of that switch, PKZH data is also affected (PKZH, 2026-10-13). It adds that the incident does not affect insured persons' pension assets (PKZH, 2026-10-13). PKZH's concern is that migration tests may have left PKZH data at the supplier; it has not said that they did. Publica's page now carries a status of 2026-10-14 saying that it currently has no indications that data from the attack on its software supplier has been published on the darkweb and that it keeps monitoring the situation; its list of data that could be affected is unchanged (Publica, 2026-10-14). Neither statement says which data left, how the attackers got in or who they are.

Sources: Swiss Federal Administration (admin.ch) · PK Softech AG · watson.ch · Netzwoche · Bernische Pensionskasse (BPK) · Bernische Lehrerversicherungskasse (BLVK) · Pensionskasse Post · Inside IT (AWP) · Publica (Pensionskasse des Bundes) · cash.ch (AWP) · Pensionskasse Stadt Zürich (PKZH) · Cybercrimepolice (cantonal police platform) · SwissCybersecurity.net · NZZ · Inside IT

04Action items8 items

Tell the helpdesk, HR and payroll teams of every body whose staff are insured with Publica (including the federal administration and the ETH domain) that AHV number, date of birth, address, salary and IBAN may now be known to criminals and must not count as proof of identity, and route requests that quote them, a request to change a payout account included, to a call-back on a known number; for staff insured with the Bernische Pensionskasse or the Bernische Lehrerversicherungskasse apply the same rule until those funds report the scope, because the Bernische Pensionskasse says it has no indication of theft but cannot exclude it and the Bernische Lehrerversicherungskasse is still checking whether and to what extent its data is affected; also tell insured staff that cantonal police warn of investment-fraud calls from people who know their salary and pension details, which prove nothing about the caller.
FindingPK Softech breach widens: Bernese cantonal funds…
If your organisation's pension administration, HR or payroll runs on PK Softech software, is being migrated to it or tested on it, or your staff are insured with Pensionskasse Post, ask the supplier or the fund in writing whether your data, test data included, was in the affected environment and what it holds.
FindingPK Softech breach widens: Bernese cantonal funds…
Run contentscannerstatus on every Cisco Secure Email Gateway that has File Reputation enabled in a mail policy and update Content Scanner Tools to 25.3.0.5525 or later with contentscannerupdate wherever automatic updates are off; the update needs no restart.
FindingCVE-2026-76519
On every such gateway, and on each member of a cluster, run grep "System Security" system_logs now: on a suspected-compromise message keep the forensic data before upgrading, then follow Cisco's recovery steps (a new virtual machine on a fixed release with a fresh configuration and renewed credentials for a virtual appliance, Cisco TAC for a physical one) for every member of that cluster.
FindingCVE-2026-76519
Update the Collabora Online Built-in CODE Server app (richdocumentscode) to 26.4.303 or remove it on every Nextcloud server that runs it; disabling the app does not stop the request, and on Nextcloud 29 or older, which is end of life, upgrade Nextcloud or remove the app.
FindingCVE-2026-110447
On each such server, search the web access logs back to at least early September 2026 for requests to apps/richdocumentscode/proxy.php that carry $( or an encoded .. in the path, and the app directory for PHP files that are not part of the release; on a hit, treat every secret the web server account can read as exposed and rotate it.
FindingCVE-2026-110447
Restrict the management interface of every PA-Series, VM-Series and Panorama to a jump box or trusted internal addresses now, then upgrade each to the fixed build of its train (11.2.14 and 11.2.15 units to 11.2.16, published 2026-10-15); there is no workaround.
FindingCVE-2026-0322
On every device whose management interface was reachable from untrusted networks, search management-interface logins, administrator-change records and upstream firewall logs for the three source addresses Palo Alto lists in the advisory's FAQ, and treat a match as a root compromise.
FindingCVE-2026-0322

Verification & coverage notes1 run

2026-10-15T0256Z-intel · Sonnet 5.5 · window 26 h · 4 entries published

Verification & coverage notes

Window: gap 24.0 h from 2026-10-14T0255Z-intel, window 26 h, developing-story window 72 h; the container clock agreed with the network date (skew 1 s). Four new entries (Cisco Secure Email Gateway CVE-2026-76519 critical; PAN-OS CVE-2026-0322 high; Collabora Built-in CODE Server CVE-2026-110447 high; the fake WatchGuard VPN client site notable) and two changelog records (an update on the PK Softech/Publica entry, an improvement on the Danfoss refrigeration-controller entry). No deep dive: nothing cleared the bar. The previous record's publish_status is ok.

KEV sweep (work/2026-10-15T0256Z-intel/kev-window.txt): four additions dated 2026-10-14; CVE-2026-76519 and CVE-2026-0322 were NOT COVERED and became entries, the AhsayCBS pair (CVE-2026-105133, CVE-2026-105134) was already covered with exploitation stated. No RANSOMWARE rows.

Backlog (state/coverage_backlog.md): the one open row, Beyond Gravity, is unchanged (S2 and S4 re-checked: swissinfo, Netzwoche and bluewin of 2026-10-02 to 06 are still the freshest, no vector, actor or data class named, no leak-site listing); it stays held on its stated condition and expires 2026-10-20. No row changed state, so nothing was appended.

borderline-drop lines:

borderline-drop: Fortinet October PSIRT batch FG-IR-26-176 to -185 (S1; FortiSIEM 7.5.0 CVE-2026-106173 9.4, FortiSandbox GUI authentication bypass CVE-2026-107656 9.6); Known Exploited is No on all ten, the FortiSIEM flaw affects 7.5.0 only and restricting TCP 27918 prevents it, NCSC-NL and CERT-FR only relay it; the 2026-10-14 fire dropped the same set on the same facts, so this is the same call, not a new one.
borderline-drop: Juniper Junos OS and Junos OS Evolved October bundle, 153 records (S1; three unauthenticated J-Web paths to root CVE-2026-101956, CVE-2026-101986 and CVE-2026-101954 and unauthenticated overflows at 9.8), a quarterly vendor release, Juniper SIRT and CISA's SSVC record state no exploitation, J-Web needs the web-management service configured, the advisory portal is a JavaScript shell on every transport so only the CNA record (not citable) and one ENISA page were readable, and the Cisco Nexus OAM and Fortinet bundles were judged the same way. Re-gate when an exploitation report, a KEV listing or a CERT or press page that can be cited appears.
borderline-drop: Microsoft October Patch Tuesday residual (S1; five Outlook preview-pane RCEs CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156, CVE-2026-70291, about 60 further unauthenticated network flaws at CVSS 9.0 or above, the .NET WDAC bypass CVE-2026-108398, MessagePack-CSharp CVE-2026-92707), none exploited, all rated Exploitation Less Likely or Unlikely, no public proof of concept for the unauthenticated items; the 2026-10-14 fire dropped this set on identical facts.
borderline-drop: Chrome 155 stable, 37 fixes with seven Critical (S1), no exploitation statement, source dated 2026-10-13 20:53Z before the window.
borderline-drop: Microsoft Digital Crimes Unit and Resecurity on Storm-2990 and Storm-3119 (YAM Store), the Chinese-language phishing-kit and tenant-takeover ecosystem (S3), victims named in Japan, the United States, Australia and India, a takedown narrative with generic mitigations; the one concrete hunt (the PnP Management Shell service principal self-provisioned after a hijacked Global Administrator sign-in) concerns the broker's own hijacked tenants, not a decision for this constituency this week.
borderline-drop: ARTEX, an open-source agentic penetration-testing framework abused against South Korean financial firms (S3; Zscaler, CrowdStrike), no constituency nexus, generic SQL injection and authentication bypass on peripheral web applications, and the store already carries several AI-agent intrusion entries.
borderline-drop: SlugFest, npm Trusted Publishing slug takeover (S3; Bloom Security), fixed by GitHub on 2026-10-02, no exploitation, exposure only through suppliers that publish npm packages.
borderline-drop: XWorm Reborn (Netskope, single source), CyberXero initial access broker (SOCRadar, nine days old, Ukrainian and Polish targets, the WordPress flaw already covered), UAT-6275 and TAG-193 (Talos with Recorded Future Insikt; CIS governments only, a generic WinRAR CVE-2025-8088 Startup-folder chain), Check Point on LiteLLM CVE-2026-35029 and CVE-2026-59823 (fixed 2026-04-17, authenticated, five LiteLLM entries already in the store) (S3).
borderline-drop: Offerz, a Swiss voucher webshop whose January order-data copy in a less-monitored test environment was accessed on 2026-10-07 (S2), no public-sector nexus, no vector, incident floor; the transferable lesson (a supplier holding real data of a customer that has not yet moved onto its system) rides the PK Softech update through the PKZH notice.
borderline-drop: Wolsfeld fire-service operations centre (Rhineland-Palatinate; single SWR relay of the prosecutors) and Mandurah SES (Western Australia; The Gentlemen listing, one server of pre-2022 records) (S4), no vector, no actor behaviour beyond impact, single source each, incident floor. SRF's blanket line that the Stadt Zürich fund is potentially affected (S2) is narrower in PKZH's own notice; the update carries PKZH's own statement and does not cite SRF.
borderline-drop: NCSC.ch hub 13059, Citrix XenServer CVE-2026-79610, CVE-2026-102700, CVE-2026-102701, CVE-2026-79611 (S2, S1); host compromise needs a privileged guest, exploitation unknown. SAP October Patch Day (16 notes, none exploited; the one unauthenticated 9+ item is a Cloud SDK for Python library flaw), NGINX CVE-2026-97205, CVE-2026-93479, CVE-2026-15176 (configuration-dependent, high complexity), Gitea CVE-2026-59774 (fixed 2026-07-27, CVE published only now), AnyDesk "AnyPwn" (aged out), Siemens (third-party components and authenticated items), Ivanti Neurons for Patch Management and Xtraction (9.9 but authenticated), Oracle (the October CPU is dated 2026-10-20) (S1).
borderline-drop: n0n maritime extortion batch, Ledger hardware-wallet implants, Femern Link Contractors (Fehmarnbelt tunnel contractor, no vector or actor; re-check next fire), Blueberry Pediatrics (a downstream Metabase victim, already covered), Egide, Medley At-Link, SpeeCAN, Park Dental, Joliet District 86 and the fuitesinfos claims (S4), out of nexus, claim-only or no behaviour.

Single-source: 2026-10-15/fake-watchguard-vpn-client-site-credential-capture is single-source (Huntress is the only source for this iteration; B2). Reduced-confidence inclusions: none.

Contradictions: the Danfoss improvement records that BleepingComputer reports no tie to the 2025 AK-SM 8xxA flaws while Censys points to them without Danfoss confirming the vector and NCSC.ch lists them as alleged; no source confirms a tie, and the entry says so. For the next audit: the verifier read Claroty's own page as saying the code-of-the-day gives a fully authenticated administrative session, as Censys does, so the older entry 2026-08-28/claroty-danfoss-ak-sm-800a-code-of-the-day-rce, which describes CVE-2025-41450 as an information disclosure, probably needs a correction record; this fire did not touch it.

Priority and ground calls: the Cisco gateway flaw is critical on the bar (exploited, unauthenticated root on the mail path, no workaround, compromised Secure Email Cloud tenants contacted by Cisco) although the fix ships as an automatic content update; PAN-OS is high (exploited, root, no workaround, but it needs credentials and management-interface reach); the Collabora flaw was first written notable for its single deployment mode and raised to high after verifier iteration 2: it is exploited, unauthenticated and critical, the web shells survive the update, and Collabora's own advisory says disabling the app does not stop it, so the decision this week is to update or remove it; the high bar asks for plausible exposure, and the store already carries Nextcloud entries for the public sector.

Candidate sources: cyberdaily-au added (S4). Not added: juniper-sirt and f5-security-advisories (S1; both vendor portals are JavaScript shells and no recipe exists, so they would only add standing repair orders), and Netskope Threat Labs and Bloom Security (S3; recipes unverified); the next audit may revisit them. blick-ch promoted to active per promotion_due although S2 judged it general news of limited depth; content_scope: general-news and a 48 h recipe note record that.

Rotation: the digest built, so no source was excluded as a recent attempt; slices ranked on the rotation cursor. S4's pool is 12 records and all were attempted by the previous two fires, so its ten oldest by cursor were allocated anyway.

Coverage gaps: inside-it-ch (article bodies behind the 429 checkpoint; RSS teasers only); fuitesinfos (listing shows 4 of 15 entries); swisspost-cybersecurity (marketing content); srf-news (feed and sitemap reach 36 to 48 h, so the 122 h lookback cannot be served); news-admin-ch (ignores date filters); kaspersky-securelist (no post since 2026-09-24); fortinet-fortiguard-blog (newest 2026-10-05); redcanary (blog moved to zscaler.com, own feed frozen); juniper-sirt (JSA pages are a JavaScript shell); reliaquest (sitemap lastmod bulk re-stamped, confirm every item by page date).

Operational notes: stop-hook nudges to commit arrived mid-run and were not acted on (nothing is committed before Phase 6). The harness offers no TodoWrite tool, so the phase plan lived in these notes. tools/source_health.py ran in Phase 5 and printed one UNSOLVED row, cnil-fr (url repointed, see sources_changed; CNIL's whole site answered a 503 maintenance page). One reader (jina) fetch was spent on a WatchGuard Secplicity page and one on the ENISA EUVD page inside extract's own fallback; neither is cited.

Verification: four independent cold passes (every ledger claim answered each time, 99 to 100 claims). Iterations 1 to 3 returned 12, 5 and 4 findings (the five of iteration 2 all came from the vendor's own Collabora advisory, which no earlier pass had read); iteration 4 returned one F3, a chained CISA citation in the PAN-OS entry. With one truth finding and no F1 or F4 the early exit applies: the fix was applied by the main agent against the saved Palo Alto page and the run publishes with verification_residual_count: 1, the final iteration's count. No CLEAN verdict was reached, so there was no confirmation pass; the Collabora entry (rewritten in iteration 2 and edited again in iteration 3) is the one the next audit should give an independent look. Declined findings: none after iteration 2 (the iteration 1 priority rebuttal was withdrawn in iteration 2).