Verification & coverage notes
Window: gap 24.0 h from 2026-10-18T0256Z-intel, window 26 h, developing-story window 72 h; the container clock agreed with the network date (skew 0 s) and the first fetch of origin/main was current. The window is a Sunday into Monday and thin: every authority listing the four sub-agents swept (NCSC-NL, BSI, CERT-EU, CERT-FR, NCSC.ch, BACS, CISA, Fortinet, Palo Alto, watchTowr, Mozilla) has its newest item dated 2026-10-16 or earlier, and the research majors published nothing new since 2026-10-18 00:56 UTC. No new entry clears the gate. Two changelog records: an improvement on 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse and a correction on 2026-10-13/danfoss-ak-sm-ak-sc-french-supermarket-refrigeration-attack. ConnectWise: the advisory update of 2026-10-18 01:00 UTC took SaaS Security and Cloud Management offline in addition to Cloud Backup, and Todyl and SpecterOps state that a token issued before an app is disabled stays valid for up to 90 minutes (ConnectWise says previously issued tokens may remain usable after its own certificate revocation), so the record carries the log-review period with the Graph activity logs as its telemetry, Todyl's instruction to find every SkyKick and ConnectWise app including inherited ones, and the search of the apps owned by the ConnectWise vendor tenant that Todyl and SpecterOps describe; the main text also states ConnectWise's no-successful-activity line. Danfoss: a correction, because verifier iteration 2 found that the Dixell France PDF the entry cites was replaced on 2026-10-18 and now carries Copeland's own bulletin of 14 October 2026 (XWEB EVO named as the affected, discontinued, end-of-life generation, an order to remove every XWEB EVO from the public internet at once, a restore procedure), so the entry's statements about XWEB PRO firmware 1.12.1, a CISA advisory and a March 2024 bulletin were removed and its summary, Exposure line, evidence, source date, sourcing note and the 2026-10-18 update section were brought to the guide's current text; the record also adds Le Monde's report that the defrost operation was lengthened from one hour to eight so that alarms trigger late, and the SecurityWeek and Cybersecurity Dive facts (S2 had returned them and the first draft wrongly dropped them as outside the window, which verifier iteration 1 corrected). Neither record re-floats its entry: no new actor, victim, flaw, patch or exploitation change. Three sub-agents (S1, S3, S4) returned the ConnectWise incident as update-of items and were folded into one record; ConnectWise's extra source addresses are indicators and were not carried.
KEV sweep (work/2026-10-19T0256Z-intel/kev-window.txt): no CISA KEV addition inside the window (catalogue 2026.10.16, fetched twice by S1 with an identical version and count), so no NOT COVERED, MENTION-ONLY, COVERED-STALE or RANSOMWARE row.
Backlog (state/coverage_backlog.md): the one open row, Beyond Gravity, was re-gated on today's facts by S2 and S4: nothing newer than the SRF report of 2026-10-15 and its relays, the vector, behaviour and data class are still not public and the China assumption rests on anonymous sources from one outlet, so an incident entry would carry no evidence-bound technique. Held unchanged on its named condition (BACS, the company or reporting names a vector, an actor or the data affected); it reaches its expiry on 2026-10-20 and the next fire strikes it if the condition is still unmet. Nothing changed state, so no note was appended.
borderline-drop lines:
- borderline-drop: PwnEscape CVE-2026-99999, Linux kernel guest-to-host escape through virtio-net checksum metadata (S1, S3) - a guest-code prerequisite and a local vector, no exploitation reported, not in CISA KEV, and RHEL, SUSE and Ubuntu fixes still pending; the 2026-10-16 and 2026-10-17 fires made the same call. New today is pwn.ai's full write-up with lab host root and a forecast of exploits within weeks. Red Hat's CVE page says it "tracks this flaw as a KEV active-exploit case" without explanation, which CISA's catalogue and The Hacker News contradict. Reopen on a public exploit, KEV listing or reported exploitation.
- borderline-drop: Juniper Junos October 2026 bundle, three unauthenticated CVSS 9.8 flaws in J-Web, MX kmd IKE and Extended Echo per NCSC-NL (S1) - no exploitation reported, J-Web needs the web-management service configured, Juniper's bulletin pages are unreadable; the 2026-10-15, 2026-10-16 and 2026-10-18 fires made the same call. Reopen on exploitation or a KEV listing.
- borderline-drop: Fortinet FG-IR-26-176 to -185 including FortiSandbox CVE-2026-107656 and FortiSIEM CVE-2026-106173, Next.js out-of-band update (CVE-2026-96889 and the
use cache flaw), nginx 1.30.6 and 1.31.7, SAP Cloud SDK for Python CVE-2026-89111 and the other SAP and Microsoft rows (S1) - none exploited or KEV-listed, narrow trigger conditions (FortiSIEM 7.5.0 only; Cache Components typed arrays; SVG optimisation on glibc with SVG enabled; ASLR defeat for nginx, which nginx.org rates medium), published 2026-10-13 to 2026-10-14; earlier fires dropped the same sets on the same facts. - borderline-drop: SiteGuard Server Edition CVE-2026-106931 (S1) - the vendor and JPCERT/CC confirm exploitation of a root or SYSTEM command injection, but it is a Japan-market host-based WAF with no deployment identified in Switzerland, and the vendor and JVN score it 8.5 (4.0) and 7.8 (3.0) with AV:L/PR:L; the vendor and JVN themselves label it Critical, and only BleepingComputer's 500,000-site figure conflates the separate SiteGuard WordPress plugin. Doubt about relevance resolves to drop. Reopen on a European deployment, a KEV listing or exploitation reporting outside Japan.
- borderline-drop: Oracle October 2026 CPU pre-release (S1) - a heads-up with no CVE ids, versions or exploitation data; the CPU lands Tuesday 2026-10-20 and the 2026-10-21 fire's window carries it. Broadcom 802.11/WPS EAP reassembly overflow (S1) - no CVE, consumer and ISP gateways, Wi-Fi proximity, demonstrated on Belgian devices, no Swiss nexus.
- borderline-drop: Seqrite's WP2Shell host-artifact write-up (S3), no changelog record - the covered WordPress core entry already carries the compromise assessment and the unauthenticated-batch-then-administrator-then-file-write Triage sequence; Seqrite adds a staging path that legitimate plugin installs also produce, and its writability-test artifact is lab-derived, so no reader decision changes.
- borderline-drop: the remaining Danfoss scope details (S2) - Shadowserver's exposure counts and Sekoia's unverified claim, relayed by Reuters through SecurityWeek, of stores in other countries; no decision depends on them. Reopen if a source names the vector or the flaw.
- borderline-drop: IDC Frontier sixth report of 2026-10-18 (S4) - backup service resumed and snapshot function still suspended on a
routine, Japan-only entry; the 2026-10-18 fire made the same call. - borderline-drop: Loxone Group security incident (S3, S4) - one relay (the Borns blog quoting a Facebook post), the company's own post not found, no vector, actor or data class, and Loxone's wording as relayed suggests the Miniserver and Loxone Cloud are not affected; incident floor. Loxone is widely installed in Swiss buildings, so re-check once for a vendor statement or heise or derStandard coverage.
- borderline-drop: Brenner Base Tunnel (Everest claim), the Swiss leak-site claims (a masked cloak listing, MAP SA, Camandona SA), CDU Heilbronn mailbox phishing, ETS California, BAE Systems and the Bankruptcy Noticing Center, Piyolog roll-ups, the Denmark CPR letter to register users (S4) - claims without victim statements, no vector or actor, or out of nexus; the 2026-10-18 and earlier fires made the same calls.
- borderline-drop: Symantec Aoki, ARTEX, AhnLab's September APT digest, IBM X-Force AI-vulnerability statistics, Infoblox Help TDS, AIR OpenAI Sesame, two SANS ISC diaries, Truesec commentary, Talos Q3 Vulnerability Pulse, Unit 42's monthly ranking, Semperis survey (S3) - digests, statistics, commentary or no constituency nexus.
- borderline-drop: CHUV vishing at a partner laboratory (primary notice 2026-09-08), Montreux and Radix (recycled 2021 and 2025 items), the Army-subcontractor and Republik leads (S2) - stale or already judged by the 2026-10-17 fire.
- borderline-drop: ShinyHunters arrests (Dutch suspect 2026-09-15, Jordan custody 2026-10-03, a further FBI arrest 2026-10-09) (S4) - all older than the window, a law-enforcement fact that changes no defender decision;
2026-09-24/shinyhunters-fbi-peoplesoft-breach-claim does not carry them and the next audit may add them as an improvement.
Single-source and carve-outs: none new; the ConnectWise record rests on the vendor's own advisory with Todyl and SpecterOps as independent assessors of the token and owner-tenant points (SpecterOps's post mislabels its own Huntress link as The Hacker News, which the entry does not rely on). Reduced-confidence inclusions: none. Contradictions carried only in drops: PwnEscape CNA 9.3 (PR:N) against Red Hat 8.8 (PR:L), and Red Hat's KEV statement against CISA's catalogue.
Dates for the next fires: Oracle's October CPU lands 2026-10-20 (S1's oracle-cpu page is read with extract; the risk matrices carry the CVE ids this pre-release lacks); Splunk and Cisco advisories publish 2026-10-21 (Cisco: Expressway, IOS XR ASR 9000, Secure Client, Snort, Unified Communications per S1; the 2026-10-18 record already asks for splunk-advisories in S1); ConnectWise's living advisory promised its next update by 13:00 UTC on 2026-10-19; the Beyond Gravity row expires 2026-10-20.
Candidate sources: edoeb-ch-press (S2) and nextjs-blog (S1) added. Not added: nginx-security-advisories (S1; a static list of flaws nginx.org itself rates medium, F5's own PSIRT relays are the corroboration) and infoblox-threat-intel (S3; this fire returned only dropped leads from it, commodity infrastructure research).
Coverage gaps: ibm-support-security-bulletins (no listing or feed transport reachable; IBM changes surface only through NCSC-NL relays), juniper support portal and hub.ivanti.com (JavaScript shells; the Junos data came from NCSC-NL's CSAF and CCCS), the ConnectWise remediation-guide PDF (403 on every transport; the Trust Center page carries the same workflow), the Politico body behind the ETS lead (navigation shell). WebSearch was not date-aware this weekend and returned mostly 2019 to 2025 material for Swiss incident queries; the curated feeds and authority listings were the effective discovery path.
Essential-coverage: all 21 essential records were attempted (S1 11, S2 10) and returned content; every authority feed was quiet.
Excluded as recent attempts: 0; the rotation cursor ranked the four slices (S1 14, S2 14, S3 14, S4 14 standard or candidate records) and the belt-and-braces exclusion removed none. S3's twelve extra major-lab listing sweeps and S4's Swiss and DACH leak-feed checks are in the sub-agent ledgers.
Self-identification: main agent Claude Sonnet 5.5 (claude-sonnet-5-5) from the harness-injected model line; all four research sub-agents reported Sonnet 5.5 from their own prompt line.
Source health: tools/source_health.py probed 251 records and the first sweep put four on the UNSOLVED list, all fixed in this run and the second sweep ended with 250 relevant, one stale (threatpost, a demoted record) and no action: ox-security (the blog listing refuses every transport including WebFetch, the WordPress feed reads direct, so its recipe moved to the feed), nextjs-blog and cash-ch-awp (general-news scope: mostly non-security feeds), ncsc-ch-incidents (a low-cadence list at 61 days against a 60-day limit, max_staleness_days: 120).
Source-recipe notes (for the next audit): the Dixell France guide PDF cited by the Danfoss entry was replaced in place on 2026-10-18 (same file name, new content, Last-Modified 16:39 GMT) after the entry had quoted it, and check_run.py's quote-literal check cannot read PDFs, so a changed PDF is invisible to the gate; the audit's --page-checks-since pass is also blind to it. The ConnectWise Trust Center page is a living stack whose earlier dated blocks and FAQ are edited in place, so a statement about when something first appeared on it needs a dated update or an archive snapshot, never the current FAQ.
Verification: three iterations. Iteration 1 (NEEDS_FIXES, 5 truth, 2 editorial, 3 advisory) caught an error of mine, a claim that SaaS Security and Cloud Management were suspended since the advisory's first version, which rested on an undated FAQ block added later, plus a misstated token mechanism, two over-attributions and the Danfoss delta I had wrongly dropped. Iteration 2 (NEEDS_FIXES, 4 truth, 2 editorial, 2 advisory) found that the Dixell France PDF the Danfoss entry cites had been replaced on 2026-10-18, which turned that entry's record into a correction. Iteration 3 (NEEDS_FIXES, 2 truth, 0 editorial, 4 advisory) reported two low-confidence wording points and no F1 or F4, so the low-residual early exit applies (truth plus editorial of 2): the fixes were applied after the pass, five of the six findings, and one advisory was declined with its reason; no confirmation pass followed. This is an early-exit publish on a NEEDS_FIXES final verdict with verification_residual_count 2, and the two wording fixes were not independently re-read. After the pass the gate ended 56 pass, 0 warn, 0 fail apart from the run-clock stamp that Phase 6 re-stamps.