Sunday, 18 October 2026

Verification & coverage notes

Window: gap 24.0 h from 2026-10-17T0256Z-intel, window 26 h, developing-story window 72 h; the container clock agreed with the network date (skew 0 s) and the first fetch of origin/main was current. The window is a Saturday into Sunday and thin. Two new entries and three changelog records. New: ConnectWise Cloud Backup (formerly SkyKick), high, a vendor-held Microsoft 365 application credential used against 162 or more customer tenants with directory-role self-assignments in about 50 tenants and added credentials in one (S3 and S4 surfaced it independently, merged on one incident key; Admiralty A1); Rank Math SEO PRO 3.0.123, notable, a vendor-confirmed backdoor in packages served for about eleven hours, kept short on precedent (the store carries the ShapedPlugin and Awesome Motive WordPress supply-chain entries) and single-source-victim because Wordfence only relays the vendor. Records: Danfoss and refrigeration controllers (update: CERT-FR's third version of 2026-10-16 changes the compromised-unit sequence to restart first and adds the whole-configuration check, and the Dixell France operator guide gives the XWEB PRO firmware boundary and the factory Admin account; the Detection line, summary and actions were rewritten where they stood), AhsayCBS (improvement: Horizon3's root cause and server-side hunt artifacts, first covered through the horizon3-ai lookback), Citrix NetScaler CVE-2026-88771 (improvement: Zscaler's first-party telemetry adds a Perl CGI handler and a FreeBSD binary delivery; the Magento infrastructure overlap is Zscaler's own lead, not attribution).

KEV sweep (work/2026-10-18T0256Z-intel/kev-window.txt): no CISA KEV addition inside the window (catalogue 2026.10.16 of 2026-10-16 is the newest S1 read), so no NOT COVERED, MENTION-ONLY, COVERED-STALE or RANSOMWARE row. S1 confirmed that no covered CVE moved from not-exploited to exploited and that the ENISA exploited list is fully covered.

Backlog (state/coverage_backlog.md): the one open row, Beyond Gravity, was re-gated on today's facts by S2: nothing newer than the SRF report of 2026-10-15, the vector, behaviour and data class are still not public, so an incident entry would carry no evidence-bound technique. Held unchanged on its named condition (BACS, the company or reporting names a vector, an actor or the data affected), expiry 2026-10-20; nothing changed state, so no note was appended.

borderline-drop lines:

• borderline-drop: Keycloak 26.8.1 (S1; 19 CVEs) - advisories read are Low or Moderate, EPSS 0.0044 or below, no exploitation or KEV listing, so the regular patch cycle covers it; the SAML HTTP-Redirect signature parser differential has no CVE and rests on an issue title.
• borderline-drop: Zimbra 10.1.21 advisory table (S1) - the vendor table and heise are 2026-10-01 and 2026-09-29, outside the window, with no exploitation; the password-recovery, WebDAV and OnlyOffice rows carry no CVE or severity, and the covered Zimbra entry already directs readers to 10.1.21. Reopen on Rapid7's next part or a CVE with severity.
• borderline-drop: October Windows updates default the NTLMv1-derived single sign-on block to Enforce (S3; Microsoft KB5066470) - a vendor hardening default with an outage consequence, no attacker behaviour to map, outside the window; an operations notice, not a hunt, patch or block decision.
• borderline-drop: IDC Frontier sixth report of 2026-10-18 (S4) - service-status change only on a routine, out-of-region entry; no new cause, route or actor.
• borderline-drop: FBI PSA I-101326-PSA on North Korean IT-worker facilitators (S2) - US-written, no Swiss nexus, adds little to the three covered DPRK IT-worker entries.
• borderline-drop: FBI and CISA PSA on election and campaign officials, heise's CDU Heilbronn mailbox hijack, Europol's digital-forensics report, Truesec commentary, Arkadia RAIDEN (S2, S3) - US-midterm or German party focus, no vector or actor, or commentary without telemetry; incident floor.
• borderline-drop: German universities (Halle-Wittenberg, HU Berlin, LMU), the ChimeraZ burst of French forum claims, the Atexo/Docaposte supplier breach, Eurofiber France, Inter-Etab, ABC Bank, Eichstätt, Brenner Base Tunnel (Everest claim), the French hacktivist DDoS wave, ETS California, Cyber Daily exclusives, BAE Systems (S4) - claims without victim statements (PD-6), no vector or actor (incident floor), or out of nexus.
• borderline-drop: Elastic Apex Accelerator, Group-IB KGB RAT, Report URI skimmer write-ups, Noma SneakPeek, Any.Run lure statistics, Unit 42's monthly ranking, Volexity part 3, the MALFEX npm package, iVerify recap, The Register on building automation, CSA Lab notes (S3) - no constituency nexus, no new behaviour, or vendor statistics.
• borderline-drop: Fortinet FG-IR-26-176 to -185, the October Microsoft, Adobe and Palo Alto remainders, Juniper JSA112186, Chrome 155, phpMyFAQ 4.1.9, HPE ClearPass, Splunk SVD-2026-1006 (S1) - none exploited and none KEV-listed; unchanged calls on the facts earlier fires used. Splunk says its advisories publish 2026-10-21, so splunk-advisories should be rotated into S1 on 2026-10-21 or 2026-10-22.

Single-source and carve-outs: Rank Math is single-source-victim (the vendor discloses its own distribution incident and Wordfence relays it; Admiralty A2); the Horizon3 and Zscaler additions are first-party analyses of their own reverse engineering and telemetry and carry no verification change on their entries. Reduced-confidence inclusions: none. Identifier omission: Wordfence's page lists CVE-2026-111862 for the Rank Math incident, but the NVD API returned no record and the CVE Services API a 404 on 2026-10-18T03:27Z, so no cves[] record was written for it.

Contradictions: Huntress's count of 162 confirmed tenants (as of 2026-10-16 19:00 UTC) is the number cited; The Hacker News reports 173 for Huntress and the entry does not repeat it. Todyl's post is dated 2026-10-15 on its page yet references ConnectWise's advisory of 2026-10-16, so it was updated after first publication; the entry cites the page date and says Huntress and Todyl run living posts.

Source-recipe notes (for the next audit): ConnectWise's Trust Center page and Wordfence's blog were read through the metered reader (extract fell to jina); S2 spent about five reader fallbacks, four of them on guessed feed paths, which the source records now describe. The Dixell France guide is undated; the 2026-10-13 date given is the file's last modification on the vendor's server (HEAD request), disclosed in the Danfoss entry's sourcing note.

Coverage gaps: prodaft (no dated listing on any transport), apa-ots (no listing or feed route), hpe-networking-psirt (single advisory readable, no listing), hu-berlin.de notice (Anubis challenge, read only as quoted by borncity).

Essential-coverage: all 21 essential records were attempted and returned content; ncsc-ch-security-hub was an edit scan with no post edited since 2026-10-16T06:56Z.

Excluded as recent attempts: 90 standard or candidate records were held out of the rotation slices because the previous two fires attempted them (belt and braces over the rotation cursor); S4's slice took the twelve oldest-cursor breach and ransomware sources regardless, because that pool is small and entirely attempted by the previous two fires.

Self-identification: main agent Claude Sonnet 5.5 (claude-sonnet-5-5) from the harness-injected model line; all four research sub-agents reported Sonnet 5.5 from their own prompt line.

Verification: four iterations. Iteration 1 (NEEDS_FIXES, 8 truth and 6 editorial findings, 17 with the advisories) and iteration 2 (NEEDS_FIXES, 5 truth) were fixed in place; iterations 3 and 4 are two consecutive CLEAN verdicts from independent cold passes, the second a full-ledger confirmation (141 of 141 claims). After iteration 4 the main agent applied three trivial wording fixes from its advisories (dropped 'paid' from the Rank Math summary, 'the malicious host Rank Math names', a missing verb in the Danfoss update section), none changing a sourced claim, and declined the other five advisories with the reasons recorded on the iteration. The Trust Center page for ConnectWise returned 403 to every live transport in the later passes, so those claims were checked against the body the gate saved at 2026-10-18T03:36Z.

Source health: tools/source_health.py probed 249 records, 247 relevant, one stale (threatpost, a demoted record) and one unreadable; the one UNSOLVED row, znuny-advisories (a candidate that has never been fetched), is a host outage: the site answers HTTP 503 to WebFetch and resets the connection from the container, so the recipe is unchanged and a note says to re-probe next fire.