‹Tue · 20 Oct 2026

Daily brief · UTC day

Tuesday, 20 October 2026

4 verified findings from 2 runs · 18 updates to prior coverage · the settled record for this UTC day, in the classic brief order.

CriticalPatch every internet-facing NetScaler ADC/Gateway now and check for pre-patch compromiseCVE-2026-88771 +7 · exploited · updated 20 Oct 03:40Z CriticalPatch every Check Point Security Management / Multi-Domain / Log / SmartEvent server now, no LivePatch existsCVE-2026-93616 · exploited · corrected 20 Oct 08:42Z

Criticality

Kind

Topic

Region

TL;DR · the day in one read

01Three configuration-dependent NGINX heap flaws (CVSS 9.2) are fixed in 1.30.6 and 1.31.7; Debian stable is not yet. The nginx 1.30.6 (stable) and 1.31.7 (mainline) releases of 2026-10-14 fix five security flaws, three of them heap-corruption bugs that F5 scores CVSS 4.0 9.2 and an unauthenticated attacker can reach with crafted HTTP requests, but only on configurations that combine alias with rewrite and $request_filename, use a regex map whose captures are referenced before its output variable, or enable asynchronous file I/O with server-side includes; the other two concern HTTP/3 and TLS session ticket key rotation. F5 says the heap flaws restart the worker, with code execution only where ASLR is disabled or bypassed; no exploitation or public proof of concept is reported, nginx.org rates all five medium, and Debian's bookworm and trixie packages are still marked vulnerable. →
02OVHcloud CLI release binaries carried a secret-stealing build for about 90 minutes; a pinned hash caught it. OVHcloud says a hacker used a developer's GitHub account to replace the release binaries of its command-line tool for versions v0.11.0 to v0.15.0 on 2026-10-19 with a build meant to collect secrets from the disk; the first replacement was at about 12:47 UTC and OVHcloud deleted the files at 14:21 UTC after a customer's pinned SHA-256 failed. Anyone who installed or updated the tool from a release asset in that window must rotate every secret on that host; the source tag and the Go module were untouched; OpenSourceMalware has not analysed the payload and OVHcloud says it is still examining the binary. →
03Siemens confirms exploitation of a Software Center DLL side-loading flaw; attackers bring their own signed copy. Siemens ProductCERT says it validated active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center versions before V4.0.9.8, which it fixed in advisory SSA-580366 of 2026-10-15; installed copies update themselves the next time the application starts. The attackers did not abuse an installed copy: they delivered a genuine, validly signed copy of version 3.5.8.7 with their own files beside it through what Siemens calls the Romulus multi-platform ClickFix campaign, so the check that finds it is behaviour on any Windows PC, not a Software Center inventory. →

01Active threats, incidents & disclosures1 item

NOTABLENATOA2

OVHcloud CLI: release binaries of already-published versions were replaced on 2026-10-19 with a build that steals secrets from disk, uploaded through a developer's GitHub account

OVHcloud's founder says a hacker used the GitHub account of one of its developers to add to the official command-line tool's releases a binary whose job is to retrieve secrets from the disk, that versions v0.11.0 to v0.15.0 are compromised, and that v0.10.0 and v0.16.0 are clean (Octave Klaba, 2026-10-19). A user whose CI pins a SHA-256 reported on GitHub that the assets of v0.13.0 to v0.15.0 were replaced between about 12:47 and 13:12 UTC, weeks after publication, by an uploader who is not a public member of the ovh organisation, with a local build of a later commit that has uncommitted changes and no release version flag, while the v0.15.0 tag and the Go module proxy still point at the original commit (GitHub issue #300, 2026-10-19). An OVHcloud maintainer replied that all the binaries involved were deleted at 16:21 (GMT+2) and that v0.16.0, with a signed tag, is an immutable release (GitHub issue #300, 2026-10-19). OpenSourceMalware, working from GitHub's server-side records, says no tag was pushed and no release workflow ran, ties the same account's earlier force-pushes carrying a hidden loader (from 2026-03-05) to the GlassWorm campaign while saying that whether the same actor did both is its inference, notes that the project's release tooling replaces existing assets as normal behaviour, and says it has not analysed the payload because the files were deleted before anyone archived them (OpenSourceMalware, 2026-10-19). How the account was taken over, whether any secret was stolen and the actor are not public.

Triage: a replaced asset alone is not proof, since the project's release tooling replaces assets routinely; the discriminators are an uploader who is not the original publisher, a modified-tree build without the release version, and a digest that changed without a version bump (OpenSourceMalware, 2026-10-19; GitHub issue #300, 2026-10-19).

The release assets of v0.13.0, v0.14.0 and v0.15.0 were replaced today

All binaries involved have been deleted at 16:21 GMT+2.

This release is immutable, so the assets attached to it can be trusted.

GitHub issue ovh/ovhcloud-cli #300 (external reporter, with OVHcloud maintainer replies) 2026-10-19

The compromised versions are v0.11.0, v0.12.0, v0.13.0, v0.14.0 and v0.15.0. (translated from French)

The hacker used the GitHub account of one of the developers and added a binary whose job is to retrieve the secrets on the disk. (translated from French)

If you are concerned, please change all the secrets on your disk. (translated from French)

Octave Klaba, OVHcloud founder (post on X) 2026-10-19

No tag was pushed and no GitHub Actions workflow ran.

Whether the same actor did both is our inference

OVHcloud deleted the replaced binaries before anyone archived them, so we have not analyzed the payload

OpenSourceMalware 2026-10-19

Builds on: CrowdStrike, Google and Shadowserver simultaneously sever all four C2 channels of the GlassWorm…

incident20 Oct 03:36Zmulti-sourceOpen finding →

Sources: GitHub issue ovh/ovhcloud-cli #300 (external reporter, with OVHcloud maintainer replies) · Octave Klaba, OVHcloud founder (post on X) · OpenSourceMalware

NOTABLECVE-2026-15176 +4NATOA2

CVE-2026-15176 / CVE-2026-93479 / CVE-2026-97205, NGINX Open Source and NGINX Plus: three unauthenticated heap-corruption flaws rated CVSS 4.0 9.2, reachable only in specific configurations and fixed in 1.30.6 and 1.31.7

nginx's change log for 1.30.6, dated 14 October 2026, lists five security fixes, which nginx.org's advisories page ties to 1.30.6 (stable) and 1.31.7 (mainline) (nginx.org change log, 2026-10-14; nginx.org, 2026-10-14); three of them are CVE-2026-15176, a heap buffer overflow in the core module that CCB describes as reachable where a location uses alias together with rewrite and a set or return directive referencing $request_filename, or where $request_filename appears in an access-log format; CVE-2026-93479, a heap buffer overflow in script evaluation that affects configurations whose regex map captures are referenced in root or an access-log format before the map's output variable, or that use a non-cacheable variable in a string expression; and CVE-2026-97205, a use-after-free when asynchronous file I/O is enabled, which Daily CyberSecurity relays from F5 as triggered by an SSI page with include virtual commands (Centre for Cybersecurity Belgium, 2026-10-19; Daily CyberSecurity, 2026-10-14). Each is scored CVSS 4.0 9.2 and reachable by an unauthenticated network attacker, the first two under conditions beyond the attacker's control, with CCB's warning and vector covering the first two and Daily CyberSecurity all three (Centre for Cybersecurity Belgium, 2026-10-19; Daily CyberSecurity, 2026-10-14). F5's CNA text says the overflow may restart the worker process and that attackers can execute code where ASLR is disabled or can be bypassed (Debian Security Tracker, 2026-10-20). Daily CyberSecurity reports that F5 has confirmed no public proof of concept for any of the three, and no exploitation is reported (Daily CyberSecurity, 2026-10-14). Help Net Security reports that VulnCheck flagged exploitation attempts against an earlier NGINX flaw, CVE-2026-42945, three days after the flaw and its proof of concept were public (Help Net Security, 2026-05-18). The other two are CVE-2026-95101 (with HTTP/3, part of an unknown frame might be treated as the request body, bypassing client_max_body_size or injecting data into the proxied request) and CVE-2026-97629 (with TLS session ticket key rotation, one key was left uninitialised, which might allow forging a session) (nginx.org change log, 2026-10-14); nginx.org rates all five medium (nginx.org, 2026-10-14).

Security: when using TLS session ticket key rotation, one of the keys

nginx.org (change log for nginx 1.30.6) 2026-10-14

Not vulnerable: 1.31.7+, 1.30.6+

Use-after-free when using asynchronous file I/O (AIO)

nginx.org (security advisories) 2026-10-14

CVE-2026-93479: CVSS 9.2 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

On systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, an attacker could also execute code

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.

Centre for Cybersecurity Belgium (CCB) 2026-10-19

when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing

F5 (CNA text for CVE-2026-15176, as republished by the Debian Security Tracker)

Currently, F5 has confirmed no public proof-of-concept exploit code for any of the three flaws.

Daily CyberSecurity 2026-10-14

A critical NGINX vulnerability (CVE-2026-42945) disclosed last week is being exploited by attackers

Help Net Security 2026-05-18

Builds on: F5 out-of-band patches a 15-year-old pre-auth heap overflow in nginx's script engine; credited… · CVE-2026-42945, NGINX Open Source / Plus / F5 WAF products: 18-year-old heap buffer overflow in… · CVE-2026-42530 / CVE-2026-42055, NGINX: HTTP/3 QUIC use-after-free and HTTP/2-proxy heap…

vulnerability20 Oct 03:55Zmulti-sourceOpen finding →

Sources: nginx.org (change log for nginx 1.30.6) · nginx.org (security advisories) · Centre for Cybersecurity Belgium (CCB) · Debian Security Tracker · Daily CyberSecurity · Help Net Security

NOTABLECVE-2026-110936exploitedNATOA2

CVE-2026-110936, Siemens Software Center: a ClickFix campaign runs a genuine signed copy of the application and side-loads its own DLLs, and Siemens confirms exploitation (CVSS 4.0 8.4)

Siemens ProductCERT says it has validated active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center that Siemens fixed in version 4.0.9.8 and described in advisory SSA-580366 of 2026-10-15 (Siemens ProductCERT, 2026-10-19). The advisory scores it CVSS 4.0 8.4 (6.7 on CVSS 3.1, with a local vector and high privileges required) and lists every version before V4.0.9.8 as affected (Siemens ProductCERT, 2026-10-15). The attackers did not rely on a copy already on the victim's PC: they used a genuine, validly signed copy of Software Center and placed their own files next to it, chosen as a carrier because it is signed and trusted and because version 3.5.8.7, the latest at the time, loaded helper files from its own folder without checking them; the Siemens program itself was not modified, and Siemens says no Siemens system, product or update channel was breached to its knowledge (Siemens ProductCERT, 2026-10-19). Siemens labels the activity the Romulus multi-platform ClickFix campaign and names no actor (Siemens ProductCERT, 2026-10-19); one address that Siemens lists as the distribution channel of its malware bundle also appears among the ROMULUS hosts in Forescout's write-up of a ClickFix delivery platform, which does not mention Siemens software, and Forescout says it has no evidence that its panel is related to RomulusLoader, the malware Proofpoint reported (Forescout Vedere Labs, 2026-10-15). Huntress documented the same chain with other signed applications on 2026-09-28 and warned to expect more signed hosts (Huntress, 2026-09-28).

Detection

In process-creation telemetry, the signed Software Center executable running from a folder under the user profile's local Programs directory and started by msiexec, which Siemens names as the signal; in image-load and file telemetry, unexpected DLL and data files beside that executable outside the default installation folder; in persistence telemetry, a Software Center start-up entry or scheduled task on a PC that never had the product, and a service-named folder that the malware creates under the same Programs directory (Siemens ProductCERT, 2026-10-19). Siemens says to detect on folder and behaviour rather than on the file's fingerprint, because the file itself is genuine; where a PC matches, it says to isolate it, stop the process first, then remove the start-up entry and the task and reset passwords.

Triage: a real installation runs from the Siemens install location; the same executable running from the user profile's Programs folder, started by msiexec, with unexpected files beside it or start-up entries on a PC that never had the product, is the abuse (Siemens ProductCERT, 2026-10-19).

The attackers used a genuine copy of Siemens Software Center with a valid signature and placed their own files next to it.

No Siemens system, product or update channel was breached to our knowledge.

Existing installations update automatically the next time they start.

Detect on folder and behaviour, not on the Siemens file fingerprint

Siemens ProductCERT 2026-10-19

Unfortunately, we (and you) should expect more costumes.

Huntress 2026-09-28

we have no evidence that this panel is related to the RomulusLoader reported by

Forescout Vedere Labs 2026-10-15

Builds on: Huntress: a ChatGPT Custom GPT lure feeds a ClickFix chain that ends in a signed-host DLL…

vulnerability20 Oct 03:36Zsingle-sourceOpen finding →

Sources: Siemens ProductCERT · Siemens ProductCERT (SSA-580366) · Huntress · Forescout Vedere Labs

03Research, reports & policy1 item

ROUTINENATOA2

BACS publishes five security classes for authentication methods: static secrets should in principle no longer be used, and only session-bound methods resist real-time phishing

BACS published on 2026-10-19 the technology assessment "Sicherheitsklassen für Authentifikationsverfahren, -mittel und -dienste", which sorts authentication methods, tokens and services into the three classes tief (low), mittel (medium) and hoch (high), with mittel and hoch each split further, five classes in all (BACS, 2026-10-19). The scheme follows the NIST authentication assurance levels 1 to 3 with slight adjustments and extends them for resistance to real-time phishing; BACS says the classification gives no basis for formal testing or certification and can serve organisations as a basis for security requirements and recommendations (BACS, 2026-10-19). In the assessment, class tief covers any method whose authentication information is static and identical at every login, such as a password or a cryptographic key, and the class does not rise when the secret travels over TLS; BACS concludes that methods in this class should in principle no longer be used (BACS, 2026-10-19). Class mittel needs authentication information generated anew for each login plus at least one further security feature, and the starred variant additionally needs session binding, which ties the session cryptographically to the authentication information or to the device, network or application; the assessment names TLS channel binding, Device Bound Session Credentials and OAuth DPoP as examples, against session hijacking, real-time phishing and adversary-in-the-middle attacks (BACS, 2026-10-19). BACS says the difference between mittel and hoch lies mainly in the use of additional hardware to store the cryptographic keys (BACS, 2026-10-19). Its annex of examples places a password, a static API key and a secret held in a cookie such as a session ID in tief; a password with an SMS code, a software authenticator app, Kerberos tickets, bearer tokens (SAML, OIDC, OAuth, JWT) and synced passkeys in mittel, the passkeys starred; and hardware OTP tokens, hardware certificates in TLS and FIDO2 without synchronisation or key export in hoch, with a footnote that SMS verification should be used only where no better alternative exists (BACS, 2026-10-19).

The classification offers no basis for formal testing or certification in its present form. (translated from German)

extended with regard to resistance to real-time phishing attacks (translated from German)

Bundesamt für Cybersicherheit (BACS) 2026-10-19

policy20 Oct 03:36Zsingle-source · national CERTOpen finding →

Sources: Bundesamt für Cybersicherheit (BACS) · Bundesamt für Cybersicherheit (BACS), Technologiebetrachtung (PDF)

04Updates to prior coverage18 items

NOTABLEupdatedNATOB2

ANNUAL REPORT: Mandiant AI Risk and Resilience Report 2026: eight frontline case studies of AI-related attacks, failures and assessments

First published 2026-09-17 · open finding →

Correction20 Oct 2026 08:54 UTCrun 2026-10-20T0835Z-auditbodyheadlinesummarytitle

In Mandiant's first case study the attacker, not the poisoned package, deployed the Shai-Hulud worm: after a hijacked AI coding-assistant session recommended the poisoned package, the attacker used that session to install an infostealer, harvest GitHub OAuth tokens and deploy the worm. The per-case hardening and hunting guidance is cited to the defensive controls in Mandiant's report.

Mandiant does not say the poisoned package spread the worm: after the hijacked AI coding-assistant session recommended a package the attacker had poisoned, the attacker used the developer's active session to install an infostealer through a poisoned PyPI package, harvest GitHub OAuth tokens and deploy the Shai-Hulud worm across approximately 100 internal code repositories (Mandiant, 2026-09). The hardening and hunting guidance under each case study is Mandiant's own, from the defensive controls the report lists for that case (Mandiant, 2026-09).

Sources: Mandiant / Google Threat Intelligence Group (Google Cloud) · Help Net Security

NOTABLEupdatedNATOA1

Liechtenstein's beneficial-ownership register breached: copies of ~31,000 legal entities' records taken, and four more e-government systems pulled offline as a precaution

First published 2026-08-04 · open finding →

Correction20 Oct 2026 08:53 UTCrun 2026-10-20T0835Z-auditbodysourcing_notesummary

NZZ attributes only the several-hours download, caused by an interface that allows no bulk query, to Liechtenstein IT-office head Fabian Schmid; the access mechanism through the reporting portal and a newly registered account is NZZ's own reporting, not a statement sourced to Schmid or the government's 2026-08-04 briefing.

NZZ attributes to Fabian Schmid, head of Liechtenstein's Office for IT, only the statement that the interface allows no bulk query, so the download of all 31,000 records took several hours. The access mechanism, a vulnerability in the reporting portal or in its interface to the database, used through a newly registered account that queried each record in turn, is NZZ's own reporting, which it does not attribute to Schmid or to the government's 2026-08-04 media conference (Neue Zürcher Zeitung, 2026-08-07).

Sources: Regierung des Fürstentums Liechtenstein · The Record (Recorded Future News) · SRF · Landesspiegel · Neue Zürcher Zeitung · Inside Paradeplatz (Lukas Hässig) · Exxpress (Reuters wire) · Inside IT · Federal Office of Justice (BJ)

HIGHCVE-2026-63077exploitedupdatedNATOA2

CVE-2026-63077: JetBrains TeamCity On-Premises unauthenticated RCE through the agent-polling protocol, every on-prem version affected (critical)

First published 2026-07-29 · open finding →

Correction20 Oct 2026 08:51 UTCrun 2026-10-20T0835Z-auditactionsbodycvessourcessourcing_note

JetBrains, as numbering authority, scores CVE-2026-63077 CVSS 3.1 9.8 in the CVE record, although its blog advisory gives no number. Because JetBrains reports exploitation since its 2026-07-27 announcement, the compromise-assessment window now starts on that date, and the interim mitigation follows JetBrains: restrict external access to the whole server rather than to one endpoint.

JetBrains' blog advisory rates CVE-2026-63077 critical without a number (JetBrains, 2026-07-27), but the CVE record JetBrains published as numbering authority on 2026-07-27 scores it CVSS 3.1 9.8, for a network attack that needs no privileges and no user interaction (ENISA EUVD, 2026-07-27). JetBrains reports exploitation of unpatched servers since its 2026-07-27 announcement (JetBrains, 2026-08-07), so the compromise-assessment window starts on that date rather than at CISA's 2026-08-05 listing, and includes servers patched between the two. Until a fix is applied, JetBrains strongly recommends temporarily restricting external access to the server; as a separate, longer-term measure it says internet-facing servers should also consider requiring connections through a VPN or an additional security layer (JetBrains, 2026-08-07); it does not describe the agent-polling endpoint as something to close off separately. The advisory has carried a pointer to that follow-up since 2026-08-07 (JetBrains, 2026-07-27).

Sources: JetBrains (TeamCity PSIRT) · CISA · CISA KEV catalog · JetBrains (PyCharm Blog) · ENISA EU Vulnerability Database (JetBrains' CVE-2026-63077 record)

HIGHupdatedNATOB2

actions-cool/issues-helper GitHub Action compromised in Mini Shai-Hulud: 53 tags moved to imposter commits that read Runner.Worker memory, re-enabled in September with the tags intact

First published 2026-05-20 · open finding →

Update20 Oct 2026 08:49 UTCrun 2026-10-20T0835Z-auditactionsbodyevidenceheadlinesourcessummarytechniquestitle

Both compromised actions-cool GitHub Actions became reachable again on 2026-09-16 with their malicious tags intact, so workflows referencing them by tag ran the payload again; SafeDep found six more infected repositories by 2026-09-24, with the payload now also planting Claude Code and VS Code hooks, and GitHub disabled both again by 2026-09-25. GitHub had disabled both repositories, not only maintain-one-comment, on 2026-05-19.

Socket reported on 2026-09-24 that GitHub's security team had disabled both actions-cool/issues-helper and actions-cool/maintain-one-comment on 2026-05-19, not only maintain-one-comment, and that both became reachable again on 2026-09-16, between 09:09 and 16:16 UTC, with every release tag still pointing at the content introduced on 2026-05-18, so any workflow referencing either action by tag ran the payload again on its next run; Socket could not determine why they were re-enabled (Socket, 2026-09-24). Socket places the compromise in the May 2026 Mini Shai-Hulud campaign and notes that GitHub's dependency graph lists about 15,000 dependent repositories for issues-helper alone (Socket, 2026-09-24). SafeDep found six more repositories infected through issues-helper between 2026-09-20 and 09-24, and says the payload steals the CI secrets and then commits Claude Code and VS Code hooks into the repository, which run the malware on the machine of a developer who pulls the change and opens the project (The Hacker News, 2026-09-25). GitHub disabled both repositories again by 2026-09-25, so referencing workflows now fail at job setup (Socket, 2026-09-24; The Hacker News, 2026-09-25).

Sources: StepSecurity · The Hacker News · CybersecurityNews · Socket

NOTABLEupdatedNATOB2

OpenAI-attributed agents ran 16,500+ scans against a UN statistics API over two months, using public URL-scanner services as blind proxies and double-URL-encoding to bypass a GET/POST method filter

First published 2026-09-28 · open finding →

Correction20 Oct 2026 08:48 UTCrun 2026-10-20T0835Z-auditbodyevidencesummarytagstitle

No source describes an authentication bypass or a disclosure of non-public data at UNCTAD: the figures the agents sought were public, and so was the API key they used. The double-encoding trick defeated a method filter on a public data endpoint; the researcher declines to call it hacking but says such queries look like a hacker's to a site administrator, and Alex Stamos calls the activity borderline.

The activity at UNCTAD involved no authentication bypass and no non-public data. The agents wanted published figures, and the key they used was public too, since UNCTADstat's own data viewer sends it with every request; "None of the data was secret" (SiliconANGLE, 2026-09-27). The double-encoding trick defeated a method filter on a public data endpoint, and Howard-Jones, asked whether this was hacking, answers "I don't think I'd call it that", but adds that from a site administrator's perspective, seeing carefully contrived queries such as double-encoding, "that sure looks like the actions of a hacker" (Rowan Howard-Jones, 2026-09-26); Alex Stamos called the activity "borderline for what I would call hacking" (SiliconANGLE, 2026-09-27).

Sources: Rowan Howard-Jones (independent researcher) · SiliconANGLE · Transluce · Asymmetric Security · Canadian Centre for Cyber Security

ROUTINEupdatedNATOB2

CLOSEDQUORUM: Cisco Talos documents what it calls, to its knowledge, the first publicly documented Windows implant that lets a panel of four commercial LLMs vote on its next action instead of a human operator

First published 2026-09-24 · open finding →

Correction20 Oct 2026 08:47 UTCrun 2026-10-20T0835Z-auditbodyevidencesummary

Talos calls only the implant's tie-breaking fully deterministic, not its failure modes in general, and its list of weaknesses that give defenders an opening is provider refusals, rate limits, malformed output, predictable tie-breaking, constrained action schemas and dependence on commercial APIs; the sleep-and-retry fallback is behavior it describes, not one of them.

Talos does not call the implant's failure modes deterministic, and it does not present the sleep-and-retry response to total provider failure as a defender opportunity. Its list of weaknesses is "Provider refusals, rate limits, malformed output, predictable tie-breaking, constrained action schemas, and dependence on commercial APIs", which it says "all create failure modes and defensive opportunities"; the only behavior it calls "fully deterministic" is the tie-break, biased toward DeepSeek (Cisco Talos, 2026-09-22).

Sources: Cisco Talos · The Hacker News · Gambit Security

NOTABLEupdatedNATOB2

THORChain vault drain, about $10.7M from one vault: a newly joined validator exploited GG20 threshold signing (Switzerland-based protocol)

First published 2026-05-18 · open finding →

Correction20 Oct 2026 08:46 UTCrun 2026-10-20T0835Z-auditbodyevidenceheadlinesourcessourcing_notesummarytechniquestitle

THORChain's own reports count one of five vaults drained for about $10.7M (later about $10M), not the six vaults and about $11M taken from The Record and TRM Labs, and confirm the GG20 threshold-signature exploit that had been described as suspected. The analysis is rewritten from THORChain's post-mortem of 2026-07-03, which describes a malformed multi-prime Paillier key and 864 deliberately failed signing rounds, with exposure, detection and triage guidance for other GG20 deployments.

The loss came from one of THORChain's five vaults, not six, and THORChain puts it at about $10.7M (THORChain, 2026-05-20) and in its post-mortem at about $10M (THORChain, 2026-07-03); six vaults is The Record's figure (The Record, 2026-05-15) and more than USD 11M is TRM Labs' (TRM Labs, 2026-05-15), so the six vaults and about $11M stated earlier came from those outlets, not from THORChain. The GG20 flaw was not a suspicion: THORChain confirmed on 2026-05-15 that the attack exploited its GG20 TSS implementation to leak key material progressively (THORChain, 2026-05-20), and its post-mortem of 2026-07-03 sets out the exploit chain, a malformed multi-prime Paillier key and 864 deliberately failed signing rounds combined with two further weaknesses in its tss-lib fork (THORChain, 2026-07-03).

Sources: The Record · TRM Labs · CryptoTimes · Fireblocks · Verichains · THORChain (Exploit Report #1) · THORChain (Exploit Report #2, post-mortem)

NOTABLECVE-2026-28324 +1updatedNATOA2

CVE-2026-28324 / CVE-2026-28325: SolarWinds Observability Self-Hosted, two unauthenticated remote-code-execution flaws, no confirmed exploitation yet (CVSS 9.8 / 8.8)

First published 2026-09-24 · open finding →

Correction20 Oct 2026 08:46 UTCrun 2026-10-20T0835Z-auditactionsbodysourcing_note

SolarWinds' release notes do not tie the WPM player reconfiguration to either CVE, which is narrower than SolarWinds saying it connects to neither. Neither trust-center advisory gives a workaround, and CVE-2026-28325 is scored with an adjacent-network vector, so only CVE-2026-28324 is reachable from the internet.

The statement that SolarWinds connects the WPM player changes to neither CVE went beyond the source: what SolarWinds publishes is that its release notes do not tie the reconfiguration to either CVE (SolarWinds, 2026-09-22). Neither trust-center advisory gives a workaround or names the vulnerable configuration or communication mode (SolarWinds Trust Center, 2026-09-22; SolarWinds Trust Center, 2026-09-22), and CVE-2026-28325 is scored with an adjacent-network attack vector, so only CVE-2026-28324 is reachable from the internet.

Sources: SolarWinds (official Observability Self-Hosted 2026.2.3 release notes) · NCSC-NL (Dutch national CERT) · CERT-FR / ANSSI (French national CERT) · GBHackers · SolarWinds Trust Center (CVE-2026-28324 advisory) · SolarWinds Trust Center (CVE-2026-28325 advisory)

NOTABLEupdatedNATOB1

GhostAction returns: stolen maintainer credentials push a fake security-audit workflow into the victims' own GitHub repositories, which now harvests credentials from the entire git history

First published 2026-10-10 · open finding →

Update20 Oct 2026 08:42 UTCrun 2026-10-20T0835Z-auditbodyevidencesourcing_notesummary

GitGuardian's update of 2026-10-13 counts more than 30,000 repositories and about 1,900 compromised GitHub accounts in the GhostAction wave of 8 to 12 October, far beyond the 345 to 346 repositories of the first analysed burst, and says GitHub has prevented the malicious workflow from running since 9 October, so the waves of 10 and 12 October extracted no secrets.

GitGuardian updated its analysis on 2026-10-13 from its own dataset: between 8 and 12 October the campaign targeted more than 30,000 repositories across 3,000 users and organisations by compromising the GitHub accounts of about 1,900 users, and tried to extract 3,174 secrets from public repositories' CI, with the largest spike on 8 and 9 October (GitGuardian, 2026-10-07). Socket's update of 9 October, with more than 500 accounts and tens of thousands of repositories since 7 October, is of the same order (Socket, 2026-10-09). GitGuardian says GitHub started preventing the malicious workflow from running on 9 October, so the further waves it saw on 10 and 12 October, with the same payload, could not extract any secrets (GitGuardian, 2026-10-07); a workflow from those later waves still means the account that committed it is compromised. Part of the October victims had already been hit in the September 2025 and August 2026 waves, and GitGuardian assesses that the operator likely relies in part on secrets left unrotated since earlier campaigns (GitGuardian, 2026-10-07).

Sources: StepSecurity · Socket · GitGuardian

CRITICALCVE-2026-93616exploitedupdatedNATOA1

CVE-2026-93616, Check Point Security Management: pre-authentication path traversal to arbitrary script execution, exploited as a zero-day, with attacks observed on 2026-07-23 (CVSS 9.8)

First published 2026-09-23 · open finding →

Correction20 Oct 2026 08:42 UTCrun 2026-10-20T0835Z-auditbodyevidenceimmediate_actionsummary

The urgent patch instruction now lists the R82.20 Jumbo Hotfix Accumulator from Take 10, which also carries the fix. Bishop Fox's finding that Check Point's indicators miss its route is dated to its 2026-10-01 post, before Check Point revised its indicators; whether the new indicators catch that route is not documented. Check Point's current first indicator still pairs an over-long username with a simultaneous core dump, which Bishop Fox attributes to the separate CVE-2026-91843.

The urgent patch instruction omitted the Jumbo Hotfix Accumulator for R82.20 from Take 10, which Check Point lists as carrying the fix alongside the R82.20 Security Hotfix (Check Point Support, sk1000171, 2026-09-22).

Bishop Fox's statement that Check Point's indicators miss its route dates from its 2026-10-01 post and concerned the upgrade-tools load-error indicator, which its scheduled-task-file route never trips (Bishop Fox, 2026-10-01); sk1000171 as revised on 2026-10-13 no longer lists that indicator and gives three post-authentication checks instead (Check Point Support, sk1000171, 2026-09-22), and neither party states whether they catch the route. The revised first indicator is not only an over-long username: Check Point pairs it with a management-process core dump written at the same moment, "If a core dump file was generated at the same time as the login attempt returned by the first command, there has been a potential attempt to exploit this vulnerability" (Check Point Support, sk1000171, 2026-09-22), and that pairing is the one Bishop Fox calls the crash signature of CVE-2026-91843 rather than evidence of this traversal (Bishop Fox, 2026-10-01).

Sources: Check Point Support (sk1000171) · Check Point Research (blog) · The Hacker News · CISA KEV · Bishop Fox · Bishop Fox (detection tool README)

NOTABLECVE-2026-87886exploitedupdatedNATOB2

CVE-2026-87886, Acronis Backup plugins for cPanel/WHM and DirectAdmin and extension for Plesk: local privilege escalation via insecure default permissions, CISA KEV-listed (CVSS 7.8)

First published 2026-09-18 · open finding →

Improvement20 Oct 2026 08:40 UTCrun 2026-10-20T0835Z-auditbodytitle

CISA's KEV listing describes only the cPanel & WHM plugin and the Plesk extension; the DirectAdmin plugin is named as affected only in Acronis's advisory, whose exploitation statement covers cPanel & WHM deployments alone.

CISA's KEV listing describes the flaw only in the Acronis Backup plugin for cPanel & WHM and the extension for Plesk (CISA KEV catalog, 2026-09-16). The plugin for DirectAdmin is named as affected only in Acronis's advisory, which limits its exploitation statement to cPanel & WHM deployments (Acronis, 2026-09-17); a DirectAdmin server needs the fixed build whether or not an inventory matched against the KEV description flags it.

Sources: Acronis Security Advisory SEC-10986 · Help Net Security · BleepingComputer · CISA Known Exploited Vulnerabilities Catalog (JSON feed)

HIGHCVE-2026-81642 +1updatedNATOA2

CVE-2026-81642 / CVE-2026-82717: NLnet Labs Unbound, a self-referencing DNSSEC compression pointer overflows the validator's digest buffer, reaching remote code execution (CVSS4.0 9.1 and 8.4)

First published 2026-09-19 · open finding →

Correction20 Oct 2026 08:40 UTCrun 2026-10-20T0835Z-auditbodycvesheadlinesourcessourcing_notetitle

The CVSS 4.0 score of 9.1 for CVE-2026-81642 is NLnet Labs' own, published as the CVE's numbering authority, and NCSC Switzerland restates it; it had been attributed to NCSC Switzerland. The headline now states the sourced mechanism, a digest-buffer overflow in the DNSSEC validator, instead of the validator being pointed at attacker-controlled memory. The title gives both scores again, 9.1 and 8.4.

The CVSS 4.0 score of 9.1 for CVE-2026-81642 was attributed to NCSC Switzerland. It is NLnet Labs' own: NLnet Labs rates the flaw Critical and links its CVSS 4.0 vector (NLnet Labs, 2026-09-16), and the CVE record NLnet Labs published as numbering authority scores it 9.1 (ENISA EUVD, 2026-09-16), and NCSC Switzerland restates that score (NCSC Switzerland, 2026-09-18). The headline said a malicious zone could point the validator at attacker-controlled memory; NLnet Labs describes a DNSKEY whose owner compression pointer references its own RDATA overflowing the digest buffer, with "remote code execution is possible through attacker controlled data" (NLnet Labs, 2026-09-16).

Sources: NLnet Labs · NCSC Switzerland (Cyber Security Hub) · NLnet Labs (Unbound 1.26.1 release announcement, oss-security list) · ENISA EU Vulnerability Database (NLnet Labs' CVE-2026-81642 record)

HIGHCVE-2026-102489 +1exploitedupdatedNATOA2

CVE-2026-102489 / CVE-2026-102490, Zammad helpdesk: a session-hijack remote code execution and a zammad-to-root escalation, both reported exploited since 21 September; 7.2.2 fixes the root flaw on DEB and RPM installs

First published 2026-10-02 · open finding →

Update20 Oct 2026 08:40 UTCrun 2026-10-20T0835Z-auditactionsbodycvesevidenceheadlinesourcessummary

Zammad shipped 6.5.5 on 2026-10-15, an emergency release for the unsupported 6.5 series that hardens the WebSocket server code against the exploited code-execution flaw CVE-2026-102489; it installs only from a new package repository and does not extend 6.5 support. Zammad still tells every self-hosted installation to upgrade to 7.2.2, and the 6.5.5 notes do not mention the root escalation.

Zammad released 6.5.5 on 2026-10-15 as an exceptional security release for the unsupported 6.5 series: it hardens the WebSocket server code to address CVE-2026-102489 and is meant for customers who cannot yet move to a supported version (Zammad, 2026-10-15). It is available only through a new package repository that administrators must switch to before updating, and Zammad says it is a temporary measure that does not extend the 6.5 support lifecycle; 6.5 users who cannot upgrade to 7.2.2 yet are told to install it immediately, and every self-hosted installation is still told to upgrade to 7.2.2 as soon as possible (Zammad, 2026-10-15). The release notes name only CVE-2026-102489 and do not say whether the 6.5.5 packages also carry the root-escalation fix that 7.2.2 brought to DEB and RPM installs (Zammad, 2026-10-15). The release is for the 6.5 series only, so 6.3 and 6.4 installations, which DIVD lists as vulnerable (DIVD CSIRT, 2026-09-29), still have to be upgraded.

Sources: NCSC-NL · DIVD CSIRT (case DIVD-2026-00015) · DIVD CSIRT (case DIVD-2026-00014) · DIVD CSIRT (public statements on the hack) · DIVD CSIRT (CVE record) · Zammad GmbH (vendor statement) · CISA Known Exploited Vulnerabilities Catalog · DIVD log-check script · Zammad GmbH (security advisory) · Zammad GmbH (release notes) · Zammad GmbH (GitHub security advisory) · Zammad GmbH (GitHub advisory records) · Horizon3.ai

HIGHexploitedupdatedNATOA1

ConnectWise Cloud Backup (formerly SkyKick): the vendor's Microsoft 365 application credential was used to sign in to customer tenants, with directory-role self-assignments in about 50 tenants and, Huntress reports, added credentials in two

First published 2026-10-18 · open finding →

Update20 Oct 2026 03:57 UTCrun 2026-10-20T0256Z-inteltitlesummaryactionssourcesevidencesourcing_notebody

Huntress's update of 2026-10-19 reports a second tenant with scripted post-compromise activity (the application granting itself Global Administrator and planting a secret on other applications, the choice of applications apparently random), bounds the sign-in activity to the morning of 2026-10-15 UTC with the last successful sign-in at 08:44 UTC, and says Graph directory reads leave no audit record; the secret check therefore has to cover every application.

Huntress's update of 2026-10-19 13:30 ET identified a second tenant with post-compromise activity, a tenant Huntress did not originally protect, where it got deployed to collect telemetry (Huntress, 2026-10-16). In both tenants the activity was fast and scripted, within two minutes of each other around 03:45 UTC on 2026-10-15: the application granted itself Global Administrator and then planted a new secret on a small number of other applications to keep a foothold (Huntress, 2026-10-16). The choice of applications appeared random: the same flow picked two different sets, one application present in both was backdoored in only one, and in one tenant the applications that received secrets were among the least privileged in the environment while far more powerful ones were untouched (Huntress, 2026-10-16).

Huntress says the unauthorized sign-ins with the credential were tightly bunched across the morning of 2026-10-15 UTC, the last confirmed successful sign-in it observed was at 08:44 UTC, and it saw only failed attempts afterwards in the tenants where it can read sign-in logs (Huntress, 2026-10-16). The access may have been used for Microsoft Graph directory reads, which leave no audit record, and in the two tenants Huntress reviewed it found no evidence of mailbox or file manipulation or of user or policy changes (Huntress, 2026-10-16). The check for planted credentials therefore has to cover every application registration and enterprise application in the tenant, and a clean audit log does not exclude directory reads. ConnectWise's latest readable update (2026-10-19 01:15 UTC) gives no restoration time (ConnectWise, 2026-10-19).

Sources: ConnectWise Trust Center (advisory) · Huntress · Todyl · BleepingComputer · SpecterOps · Sophos X-Ops

HIGHCVE-2026-21589exploitedupdatedNATOA1

CVE-2026-21589, Atlassian Data Center: unauthenticated arbitrary file access in every version of eight self-managed products, patch or take them off the internet (CVSS 4.0 9.3)

First published 2026-10-06 · open finding →

Improvement20 Oct 2026 03:41 UTCrun 2026-10-20T0256Z-intelheadlinesummarysourcesevidencesourcing_noteactionsbody

ENISA's EUVD record for CVE-2026-21589, which carried the rejection sentence from 2026-10-16, was updated on 2026-10-19 and again carries the full vulnerability description and the fixed versions; exploitation since 2026-10-15 is still listed and Atlassian's advisory is unchanged. Tooling keyed on the ID may have dropped the flaw while the record was rejected and should be re-run.

ENISA's EUVD record EUVD-2026-92807 for CVE-2026-21589, which named Atlassian as the assigner and carried the rejection sentence from 2026-10-16, was updated at 18:26 UTC on 2026-10-19 and again carries the full vulnerability description and the fixed versions instead of the rejection text; it still lists exploitation since 2026-10-15 (ENISA EUVD, 2026-10-19). Atlassian's advisory, read on 2026-10-20, is unchanged: it uses the same ID, lists the same fixed versions and carries no note on the record's status (Atlassian, 2026-10-05). No source read says why the record was rejected or why it was restored, and no replacement ID exists. The consequence is for tooling: a scanner plugin, SIEM enrichment rule or ticket keyed on the ID, or on a feed that excludes rejected IDs, may have dropped this exploited flaw between 2026-10-16 and 2026-10-19, so re-run them to be sure no affected Data Center instance stays reported as closed.

Sources: Atlassian · The Register · watchTowr Labs · watchTowr Labs (GitHub) · BleepingComputer · Previdian · SANS Internet Storm Center · Canadian Centre for Cyber Security (AV26-1002, update 1) · NCSC Switzerland (Security Hub advisory) · CISA · ENISA EUVD

HIGHCVE-2026-88779exploitedupdatedNATOA2

CVE-2026-88779, Citrix NetScaler ADC and Gateway: a SAML-triggered memory overflow still hits appliances on the September fixed builds, and Citrix confirms targeted attacks (CVSS 4.0 8.7)

First published 2026-10-04 · open finding →

Update20 Oct 2026 03:40 UTCrun 2026-10-20T0256Z-intelsummaryactionssourcesevidencebody

Rapid7's incident analysis shows CVE-2026-88779 used as the crash and reboot trigger of a root-execution chain with CVE-2026-88771 on an affected 14.1 NetScaler, with the call-home crash handler running the attacker's payload as root after the reboot; repeated crashes on an appliance not yet patched for CVE-2026-88771 now call for a compromise check.

Rapid7's incident analysis of an early-October compromise of a NetScaler ADC on an affected 14.1 build shows CVE-2026-88779 used as the crash and reboot condition in a two-flaw sequence with CVE-2026-88771, the pre-authentication log-poisoning flaw that supplies attacker-controlled command text: repeated nsaaad crashes and a Pitboss reboot followed text inserted into an authentication username, and after the reboot the call-home crash handler processed the retained text and executed a payload as root (Rapid7, 2026-10-19). The root execution therefore came through the log-poisoning flaw and the crash handler, with this flaw supplying the reboot, and Rapid7 reports persistence, internal reconnaissance and exfiltration of the appliance configuration after it; the full account is in the CVE-2026-88771 analysis (Rapid7, 2026-10-19).

Sources: Citrix (Cloud Software Group) · ASD's ACSC · heise online · Cyber Press · CISA Known Exploited Vulnerabilities Catalog · CISA · Rapid7

CRITICALCVE-2026-88771 +7exploitedupdatedNATOA1

CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)

First published 2026-09-28 · open finding →

Update20 Oct 2026 03:40 UTCrun 2026-10-20T0256Z-intelsummarytechniquesactionssourcesevidencebody

Rapid7's incident analysis of an early-October NetScaler compromise shows CVE-2026-88771 chained with the SAML crash CVE-2026-88779, with the call-home crash handler running the payload as root after a reboot, followed by persistence that synchronises to the HA peer, internal reconnaissance and exfiltration of the appliance configuration and key material; an appliance that was reached needs the configuration secrets rotated as well as the patch.

Rapid7 published an incident analysis on 2026-10-19 of an early-October compromise of a NetScaler ADC on an affected 14.1 build, build number not given (Rapid7, 2026-10-19). Its logs show CVE-2026-88771 chained with CVE-2026-88779: text similar to a Pitboss crash message was inserted into an authentication username, repeated nsaaad crashes and a Pitboss reboot followed, and after the reboot the call-home crash handler processed the retained text and executed a payload as root, a chaining that avoided waiting 24 hours for the injected payload to run (Rapid7, 2026-10-19). The crash-and-reboot cycle recurred over several days and let the operator refresh persistence and deploy new components (Rapid7, 2026-10-19).

After the first root execution the operator installed cookie-authenticated PHP web shells behind Apache aliases that look like CSS files and answer with HTTP 404 bodies, set /bin/sh to mode 6555, and kept access through cron entries, boot scripts, watchdog loops, an outbound agent that polls every 15 seconds and an HTTP-fronted TCP proxy, with logic that synchronises implant files to the HA peer and forces a failover so the implanted node stays active (Rapid7, 2026-10-19). A Go tool recovered from the appliance mapped routes, DNS, LDAP and Active Directory, management services and VMware vCenter, and the configuration, historical configurations and system backups were staged and exfiltrated, one archive through the web root; Rapid7 says the archive can hold encrypted credentials, LDAP and RADIUS bind information, SSL private keys and key-encryption material (Rapid7, 2026-10-19). Rapid7 says the activity overlaps public WHIPSHOT and SLAPSHOT reporting and names no actor (Rapid7, 2026-10-19).

Rapid7 recommends patching to the fixed builds for both CVEs and verifying the September builds, collecting volatile evidence before rebooting or rebuilding, inspecting both nodes of every HA pair, and rotating all credentials and keys exposed through the configuration (Rapid7, 2026-10-19).

HIGHupdatedNATOA2

PK Softech, software supplier of Swiss pension funds: malware and a data outflow at Publica, with the City of Zurich fund PKZH saying its insured persons' test data was stolen, the Bernese funds BPK and BLVK and Pensionskasse Post also reporting the supplier incident, and the Federal Prosecutor's Office investigating

First published 2026-10-09 · open finding →

Update20 Oct 2026 03:39 UTCrun 2026-10-20T0256Z-intelheadlinesummarysourcesevidencesourcing_noteactionsbody

SonntagsBlick reports, from a confidential federal information note, that the Confederation rates the incident as serious and says the security organs of the Confederation are particularly affected, which it glosses as the Federal Intelligence Service, the Defence Group and fedpol, that the Federal Council was briefed on 2026-10-14 and that the cantons were informed; the Finance Department confirms only the briefing. NZZ adds that the pension consultancy Libera AG is also affected, that the Bernische Pensionskasse now says it must be assumed personal data left, and that Publica ran no regular on-site audits at the supplier.

SonntagsBlick reports that Federal Councillor Karin Keller-Sutter brought information on the supplier incident to the Federal Council's meeting of Wednesday 2026-10-14, and that a confidential information note says the Confederation internally expects "considerable damage", calls the incident "serious" and tells current and retired federal staff to expect longer-term effects (translated from German; Blick, 2026-10-18). The note says the security organs of the Confederation are particularly affected, which Blick glosses as the Federal Intelligence Service (NDB), the Defence Group in the VBS department and the Federal Office of Police (fedpol) (Blick, 2026-10-18). Blick adds, from its own information, that the cantons were also informed because a combination of certain stolen data sets may allow conclusions about Swiss defence capability, and that the Confederation warns internally that some employees could be recognised and questioned by the authorities of another country (Blick, 2026-10-18). The Finance Department confirms only that the Federal Council was informed on Wednesday and says neither the Federal Council nor a department supervises Publica; Publica says it set up a crisis staff and is still establishing which data and how many people are affected (Blick, 2026-10-18). The scenario of matching stolen federal data against entry lists is Blick's reading and an unnamed insider's, not an authority finding.

The NZZ reports that the pension consultancy Libera AG confirmed on Friday 2026-10-16 that it also works with PK Softech and is therefore affected, and that PK Softech first told Libera on 2026-10-14 that personal data had also left, without knowing which; Libera can neither confirm nor rule out that the funds it manages or individual insured persons are affected (NZZ, 2026-10-17). The Bernische Pensionskasse told the NZZ that, contrary to the supplier's earlier information, it must be assumed that personal data left, which replaces its earlier statement that it had no indication of theft, and PK Softech cannot currently say which of its customers are affected (NZZ, 2026-10-17). Publica concedes that it did not carry out regular on-site security audits at PK Softech, although after the Xplain incident it had old data deleted there (NZZ, 2026-10-17). The access vector, the actor and any ransom demand were not public in any source read as of that date.

Sources: Swiss Federal Administration (admin.ch) · PK Softech AG · watson.ch · Netzwoche · Bernische Pensionskasse (BPK) · Bernische Lehrerversicherungskasse (BLVK) · Pensionskasse Post · Inside IT (AWP) · Publica (Pensionskasse des Bundes) · cash.ch (AWP) · Pensionskasse Stadt Zürich (PKZH) · Publica (Pensionskasse des Bundes), page updated through 2026-10-20 · Cybercrimepolice (cantonal police platform) · SwissCybersecurity.net · Inside IT · NZZ · Blick (SonntagsBlick) · Tages-Anzeiger (Tamedia, paywalled)

05Action items24 items

Upgrade every internet-facing NetScaler ADC/Gateway to 14.1-73.37+ (14.1-FIPS 14.1-73.37 FIPS+) or 13.1-64.23+ (13.1-FIPS/NDcPP 13.1-37.279+) now (a SAML-configured appliance needs the later builds named for CVE-2026-88779, and an identity provider 14.1-73.46 or 13.1-64.29); on a 13.1-branch appliance run show ns variable first; if it returns any variables, install 13.1-64.24 instead to avoid a known reboot loop. Capture logs, an instance snapshot where the appliance is virtual, a support bundle and a core dump from each exposed appliance BEFORE patching, since the upgrade can remove forensic evidence of prior exploitation.
FindingCVE-2026-88771 +7
Run Mandiant's compromise checks, extended by the Unit 42 artifacts described in the update below, Zscaler's (appliance-initiated downloads to unfamiliar addresses, an unexpected executable under /var, a Perl CGI handler added to the web server configuration) and Rapid7's (the setuid bit on /bin/sh, nsaaad crashes followed by Pitboss reboots, an outbound agent polling an external endpoint every 15 seconds), on every NetScaler that was internet-facing and unpatched at any time since early September, patched or not; isolate any hit, check both nodes of an HA pair, halt HA configuration sync until both nodes are validated, and rotate the LDAP and RADIUS bind credentials, SSL private keys and key-encryption material held in the configuration, since Rapid7 saw the configuration and backups staged and exfiltrated.
FindingCVE-2026-88771 +7
Find any NetScaler ADC or Gateway still on the end-of-life 12.1 or 13.0 branches and decide isolation or replacement now: they receive no security updates and Citrix has not said whether they are affected.
FindingCVE-2026-88771 +7
Tell the helpdesk, HR and payroll teams of every body whose staff are insured with Publica (including the federal administration and the ETH domain) or with the Pensionskasse Stadt Zürich, which says data of its insured persons and pensioners was stolen, that AHV number, date of birth, address, salary and IBAN may now be known to criminals and must not count as proof of identity, and route requests that quote them, a request to change a payout account included, to a call-back on a known number; for staff insured with Pensionskasse Post, the Bernische Pensionskasse (which now says it must be assumed personal data left), a fund administered or advised by Libera AG or the Bernische Lehrerversicherungskasse apply the same rule until those funds report the scope; also tell insured staff that cantonal police warn of investment-fraud calls from people who know their salary and pension details, which prove nothing about the caller.
FindingPK Softech: Tamedia says Akira holds about 100 GB…
If your organisation's pension administration, HR or payroll runs on PK Softech software, is being migrated to it or tested on it, or your staff are insured with Pensionskasse Post, ask the supplier or the fund in writing whether your data, test data included, was in the affected environment and what it holds.
FindingPK Softech: Tamedia says Akira holds about 100 GB…
Copy the application and network logs of every self-hosted Zammad instance, then upgrade it to Zammad 7.2.2 (7.2.0 is affected by the 27 advisories Zammad published on 2026-10-06); a 6.5 instance that cannot be upgraded yet gets the 6.5.5 emergency fix from Zammad's new 6.5 package repository, and an older instance that cannot be upgraded goes offline.
FindingCVE-2026-102489 +1
On every instance that was internet-reachable on 6.3.0 to 6.5.4 since 2026-09-21, run DIVD's log-check script, and treat a hit, or any DEB or RPM host where code ran as the zammad account, as compromised.
FindingCVE-2026-102489 +1
Apply the R82.20 Security Hotfix or the appropriate Jumbo Hotfix Accumulator to every Check Point Security Management / Multi-Domain Security Management / Log / Multi-Domain Log / SmartEvent server now; no LivePatch exists for this issue.
FindingCVE-2026-93616
Until patched, restrict TCP/19009 to trusted administrative IP ranges via Trusted Clients / implied rules on every affected server.
FindingCVE-2026-93616
On every affected server that was reachable on TCP/19009 while unpatched, check /etc/cron.d, authorized_keys, the startup paths and anything new under $FWDIR/conf/SMC_Files for unexpected changes, alongside Check Point's revised log indicators in sk1000171.
FindingCVE-2026-93616
In every Entra tenant you or your MSP administer, disable without deleting the seven ConnectWise application identities that ConnectWise lists by client ID (Cloud Backup is 506e08f9-6e9a-4da4-942b-a099a03644ae; the other six are in ConnectWise's advisory), dormant connections included, and keep them disabled until ConnectWise gives restoration instructions; where Graph activity logs were enabled, review them for these apps until at least 90 minutes after you disabled them, because a token issued before the disable stays valid for up to 90 minutes, and preserve the sign-in and audit logs promptly without delaying containment, because Entra ID Free keeps only 7 days.
FindingConnectWise SkyKick app credential used in 162+…
In the same tenants list the apps owned by the ConnectWise S-K LLC tenant (3f9cd7a0-127a-4ed4-bf06-2f830d5616b7), and disable each that you do not use or cannot verify as safe.
FindingConnectWise SkyKick app credential used in 162+…
In the same tenants review every enterprise application and app registration, MSP management and security tools first but none skipped (Huntress saw the secrets planted on apparently random applications, in one tenant on some of the least privileged ones), for client secrets, certificates and federated credentials added since 2026-10-13 and remove any you did not create; also check the directory roles, owners and consent grants held by ConnectWise and SkyKick service principals, Conditional Access exclusions for them, and mailbox forwarding, inbox and transport rules and delegated access, because disabling the vendor applications does not remove access planted through them.
FindingConnectWise SkyKick app credential used in 162+…
Upgrade every Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo and Crowd Data Center installation to a fixed version of its line (Bitbucket 9.4.26, 10.2.8 or 10.5.1; Confluence 9.2.26 or 10.2.19; Jira Service Management 5.12.40, 10.3.26 or 11.3.12; Jira Software 9.12.40, 10.3.26 or 11.3.12; Bamboo 10.2.24 or 12.1.12; Crowd 6.3.7, 7.0.3, 7.1.7 or 7.2.4) and Crucible and Fisheye to 4.9.15, internet-reachable instances first; until each is upgraded, take it off the internet or put Atlassian's web application firewall or Tomcat rewrite rule in front of it.
FindingCVE-2026-21589
On every Jira instance that was internet-reachable and unpatched and is integrated with Crowd, treat the Crowd application password in its WEB-INF/classes/crowd.properties as readable: rotate it after the upgrade and review Crowd for user accounts created or group memberships changed since the exposure began; on every affected instance search the web server and proxy logs back to 2026-10-05, the day the advisory published (honeypots recorded the first attempts on 2026-10-06), for '..' next to '/', '\\' or '::'.
FindingCVE-2026-21589
Confirm that every vulnerability scanner, SIEM enrichment rule and ticket keyed on CVE-2026-21589 reports each affected Atlassian instance as open again; where a feed dropped the ID while the record was rejected between 2026-10-16 and 2026-10-19, re-run it so no exploited instance stays reported as closed.
FindingCVE-2026-21589
Upgrade every SAML-configured NetScaler (add authentication samlAction or add authentication samlIdPProfile) that is still below 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS or 13.1-37.282, including appliances on the 14.1-73.37 or 13.1-64.23 builds, to at least those builds; identity providers then need the builds named for CVE-2026-107406. Where the upgrade has to wait and NetScaler Console virtual patching is available, confirm with show appfw signatures that the Global Deny List signature version is at least v24, which Citrix offers as a bridge for CVE-2026-88779 only.
FindingCVE-2026-88779
Before restarting a SAML-configured NetScaler that has crashed or rebooted repeatedly, preserve its logs and crash artifacts, open a Citrix support case, which Citrix asks for when an appliance is experiencing the impact, and search its authentication logs for shell metacharacters next to Pitboss crash-message text, because Rapid7 saw a crash-and-reboot cycle used to make the call-home crash handler run an attacker's payload as root.
FindingCVE-2026-88779
Upgrade TeamCity On-Premises to 2025.11.7 or 2026.1.3 on the matching branch, or install JetBrains' security-patch plugin where the version is older than that but at least 2017.1, and until that is done restrict external access to the TeamCity server, as JetBrains advises, because the flaw needs nothing but HTTP(S) reachability.
FindingCVE-2026-63077
Treat any TeamCity On-Premises server that was internet-reachable and still unpatched at any point after 2026-07-27 as a compromise-assessment target rather than a completed patch: review build-agent registrations for agents you did not enrol, and rotate the VCS credentials, artifact-repository tokens and signing keys the server holds, because an upgrade evicts the entry point but not what was taken through it.
FindingCVE-2026-63077
Find every workflow in your GitHub organisations that references actions-cool/issues-helper or actions-cool/maintain-one-comment by tag; where either ran successfully on 2026-05-18 to 05-19 or 2026-09-16 to 09-25, rotate every secret that workflow could read and check the repository's commits since 2026-09-16 for added Claude Code or VS Code hook files, then remove the action or pin it to a full commit SHA from before 2026-05-18.
FindingThe compromised actions-cool GitHub Actions were…
Run nginx -T on every internet-facing NGINX reverse proxy, load balancer and ingress and upgrade each one whose configuration uses alias with rewrite and $request_filename, a regex map whose captures are referenced before its output variable, or aio together with ssi, HTTP/3 or TLS session ticket key rotation to nginx 1.30.6 or 1.31.7 (NGINX Plus 37.0.5.1 or 37.1.0.1); where the package comes from Debian bookworm or trixie, which the tracker still marks vulnerable, apply F5's configuration workaround until the distribution ships a fix.
FindingCVE-2026-15176 +4
Find every workstation, build agent and container image build that installed or updated the OVHcloud CLI from a release asset (install script, Homebrew cask, direct download or a CI step fetching the release tarball) between 12:47 and 14:21 UTC on 2026-10-19, and rotate every secret readable on each of those hosts before installing v0.16.0 or later.
FindingOVHcloud CLI release binaries carried a…
Upgrade every SolarWinds Observability Self-Hosted deployment to 2026.2.3, and remove any internet exposure of SolarWinds management and communication services (CVE-2026-28324 is network-reachable) while SolarWinds' advisories and release notes name neither the vulnerable configuration nor the communication mode.
FindingCVE-2026-28324 +1

Verification & coverage notes2 runs

2026-10-20T0835Z-audit · audit · Opus 5.5 · 0 entries published

Verification & coverage notes

Cleanup wave 01 of the one-time store cleanup program (prompts/cleanup-coordinator.md), an operator-directed partial audit with a partial claim; it ran no coverage re-sweep, so it does not move the weekly audit's window anchor. Report: docs/audits/2026-10-20-cleanup-wave-01.md. Tracker: docs/cleanup/STATUS.md.

Scope. § C0 bootstrap (tracker and plan on main as 0f2be64), then wave 01: the record tool and the gate false positives (§ C7 items 1 and 2), the one open store warning, and the 16 entries the 2026-10-18 audit's truth passes T1 to T9 found with factual errors outside its week. Those passes read the store before the 2026-10-11 audit's records landed, so the repair workers re-checked every defect against the current text.

Outcome. 13 entries carry a record from this fire (9 corrections, 3 updates, 1 improvement); Kairos Libercourt, Bitget and Apple CoreGraphics needed none, the 2026-10-11 audit having fixed all their listed defects. Two legacy entries (THORChain, actions-cool) left the legacy queue, 408 to 406 pending. The SolarWinds repair worker's CVE-2026-28324 workaround was removed by the main agent: no citable page carries it (EUVD's record, both trust-center advisories and SolarWinds' secure-configuration page were read). Registry: THORChain incident summary rewritten, one part-of edge (actions-cool to campaign:mini-shai-hulud, Socket 2026-09-24). cves_seen: last_seen moved for CVE-2026-102489 and CVE-2026-63077.

Standalone merges during the wave (each its own branch, auto-merged): 6c75002 record tool, 4ca3e3b page-check false positives, bfded2c migration tools removed, f06331d backlog trim and work/ chaff, 11ff607 site leftovers, 7864387 doc maps, f037aa0 tool suites in the gate, f5df6fe source decisions (2026-10-11 recommendations 5 to 7), 8678b51 registry summaries (Eurail, BeaverTail, InvisibleFerret). The wave commit itself carries one tool change: the verification-confirmation messages of check_run.py name the iteration from the iteration: key.

Warnings. One acknowledgment added: the 2026-10-18 audit's duration_seconds=117266 spans its rate-limit pause, as its own notes say. check_run.py --all ends 0 warn, 0 fail.

Budget. 8 of 20 spawns (work/2026-10-20T0835Z-audit/budget.tsv): one Explore inventory for § C0, two repair workers and five verifier passes, about 2.93 M sub-agent tokens in all (repairs 0.61 M, verifier 2.13 M). No spawn was blocked or retried, and no budget cut was needed.

Verification. Five passes of cti-verification. Iteration 1 (all 152 changed claims) returned NEEDS_FIXES with two truth and two editorial findings, among them an F4 on the SolarWinds detection line; iteration 2 found one stale report cell (F4); iteration 3 returned CLEAN; the confirmation pass, iteration 4, read all 158 claims cold and refuted it with three citation-precision findings (TeamCity's VPN advice, Unbound's numbering-authority attribution, Check Point's "replaced" indicator); iteration 5 confirmed those fixes and found the same Check Point wording in a third place. That one truth finding was fixed after the pass and published on the early-exit rule (truth plus editorial at most 2, no F1 or F4), so the residual is 1. Iteration 5 also found that tools/claim_ledger.py lists no claims for sentences a fire edits inside earlier sections; the tracker carries it as W7-14.

2026-10-20T0256Z-intel · Sonnet 5.5 · window 26 h · 4 entries published

Verification & coverage notes

Window: gap 24.0 h from 2026-10-19T0256Z-intel, window 26 h, developing-story window 72 h; the container clock agreed with the network date (skew 0 s) and the first fetch of origin/main was current. A Tuesday window with a quiet authority surface (every Swiss and neighbouring-authority listing the sub-agents swept had one item at most inside it), and a thin day for new disclosures: the signal was mostly developments on covered findings, four new entries and five changelog records.

KEV sweep (work/2026-10-20T0256Z-intel/kev-window.txt): no CISA KEV addition inside the window (catalogue 2026.10.16, read again by S1 and FU1), so no NOT COVERED, MENTION-ONLY, COVERED-STALE or RANSOMWARE row.

Backlog (state/coverage_backlog.md): the one open row, Beyond Gravity, reached its 2026-10-20 expiry. S2 and S4 searched in four languages and read the SRF original, BACS, the NCSC.ch Security Hub and the federal news listing and found nothing newer than 2026-10-16; still no vector, behaviour or data class, and the China assumption rests on one outlet's anonymous sources. Struck with that reason and a reopen condition.

Published: cve-2026-110936-siemens-software-center-clickfix-sideload (notable, vendor-confirmed exploitation, attackers ship their own signed copy), ovhcloud-cli-release-assets-replaced-secret-stealing-build (notable), nginx-three-unauth-heap-corruption-flaws-fixed-1-30-6 (notable; F5's October bundle had never been dispositioned, FU1 read the vendor channel; three CVSS 4.0 9.2 heap flaws plus two companions in the same release, no exploitation or proof of concept) and bacs-authentication-security-classes-technology-assessment (routine policy; the national authority's reference for grading authentication, non-binding). Updated: Publica / PK Softech (federal security organs named by Blick, Libera AG and the Bernese fund per NZZ; both missed by the 2026-10-19 sweep although published before it), ConnectWise Cloud Backup (Huntress's second tenant and the random secret planting), Citrix CVE-2026-88771 and CVE-2026-88779 (Rapid7's incident analysis chaining the two) and Atlassian CVE-2026-21589 (ENISA's record restored after the rejection).

borderline-drop lines:

borderline-drop: Eptura Archibus CVE-2026-107186, CVE-2026-107187, CVE-2026-107188 (S1) - Rapid7's pre-authentication DWR chain to JSPX code execution has no exploitation reported, no vendor advisory was found, the application is normally internal and no constituency deployment is established; reopen on exploitation, a KEV listing or a Swiss deployment report.
borderline-drop: PwnEscape CVE-2026-99999, Linux kernel guest-to-host escape (S1, S2, S3) - a local primitive that needs guest code execution, no exploitation, not in KEV, stable fixes listed; the 2026-10-16, 2026-10-17 and 2026-10-19 fires made the same call. S2 and S3 returned it as a new item; pwn.ai's part 1 forecasts exploits in weeks to a month, which is the researcher's expectation and not a development. Reopen on a public exploit, a KEV listing or reported exploitation.
borderline-drop: Adobe Commerce and Magento CVE-2026-103849 public reproduction lab (S1) - the lab says it does not show a stock remote-code-execution chain, no exploitation is reported and the covered entry already carries Sansec's four reproduced routes and the warning that attackers will follow; reopen on a working public exploit or exploitation.
borderline-drop: WPSplinter, Broadcom WPS Monitor (S3) - a proximity-only attack, a single researcher source, no exploitation, no CVE, no Swiss device named, and replacement the only lever.
borderline-drop: Storm-3119 and Storm-2990 phishing ecosystem (S3) - Microsoft's primary is dated 2026-10-14, outside the record's lookback; no Swiss nexus; hardening advice generic.
borderline-drop: Loxone cyberattack (S2, S4) - the 2026-10-19 note asked for a re-check for a vendor statement, and one now exists (CRM, support and applicant data copied, website defaced by a group calling itself Samurai), but the access path is undisclosed, the actor is a defacement claim and no source ties a Swiss customer to it; incident floor. Reopen on a vector, a Swiss customer or partner notification, or a leak of installer data confirmed by the vendor.
borderline-drop: Roundcube 1.7.5 and 1.6.20 (S2, FU1) - twenty fixes without CVE ids, per-fix severity or exploitation; FU1 saw the previous two Roundcube releases receive CVE ids about eight to nine days after release, so the CVE ids are likely around 2026-10-27 to 28; re-check then.
borderline-drop: Rank Math PRO 3.0.123 BleepingComputer sample (S4) - a PHP sample of unconfirmed provenance adds a cloud-credential theft capability, and the covered entry already directs rotation of every credential the site can reach.
borderline-drop: Check Point Swiss attack statistics, Ontinue Teams report, Windows 10 LTSB and Server 2016 lifecycle notices, OFAC PAIPA designations, the biometric identity card rollout, the Republik leak, French leak-forum claims (I-CAD, Vackelys, Blissim and others), Canva, Bullhorn, OpenCode, Nikkei, Sourcenext, abc Bank, the CDU Heilbronn mailbox phishing, Eichstätt, Yamato, Burger King Japan and ETS (S2, S4) - vendor statistics, lifecycle notices, out-of-nexus or unconfirmed claims.
borderline-drop: Apache Camel batch, Mercury, Craft CMS, GeoVision, Searchlight AEM, Calif Hexacon demos, Plex2Shell, SiteGuard WAF, the BeyondTrust PRA claim (S1, S3) - no exploitation or no constituency nexus; BeyondTrust's own advisory page is walled (403 on every rung).
borderline-drop: Darktrace CikaBika, Calif Big Fish OpenBSD, KELA reports, AhnLab ARTEX, Sonatype Q3 index (S3) - outside the lookback, no CVE or exploitation, or statistics.

Single-source and carve-outs: cve-2026-110936-siemens-software-center-clickfix-sideload rests on Siemens ProductCERT alone for the exploitation of its own product (single-source, Admiralty A2); bacs-authentication-security-classes-technology-assessment is BACS on its own publication (single-source-national-cert). The Publica update attributes the federal note to SonntagsBlick (Blick is reliability C); the Finance Department's confirmation is limited to the Federal Council briefing. Reduced-confidence inclusions: none. Contradictions carried: OVHcloud lists v0.11.0 to v0.15.0 as compromised and the GitHub reporter checked v0.13.0 to v0.15.0 (both stated in the OVHcloud entry); the Debian tracker marks bookworm and trixie vulnerable while upstream marks 1.30.6 fixed (carried as distribution lag in the NGINX entry).

Dates for the next fires: Oracle's October Critical Patch Update lands 2026-10-20 (S1 read the pre-release: 1283 patches, 34 unauthenticated in E-Business Suite and 132 in Fusion Middleware; CVSS 9.9 for Essbase and Trusted Answer Search; the risk matrices carry the CVE ids, read with extract of oracle-cpu), the Atlassian monthly security bulletin is due 2026-10-20 and was not listed at 03:00 UTC, and Cisco publishes Expressway, IOS XR for ASR 9000, Secure Client, Snort and Unified Communications advisories on 2026-10-21. The 2026-10-21 fire should carry all three.

Candidate sources: opensourcemalware (S4) and forescout-research (S1) added, each cited by an entry this run. Not added: cve-services-api (S1's suggestion to sweep covered CVEs for state and SSVC changes through the CVE Services API found the Atlassian restoration and CISA-ADP's rating of CVE-2026-103849; the endpoint is on the gate's blocked-URL list, so a fire may read it but not cite it, and the audit can decide whether to make it a standing duty) and d3lab (S3, Italian phishing lab, no item this fire).

Coverage gaps: blick-ch (the 121 h lookback cannot be served: RSS holds about 12 h and the news sitemap about 48 h, so Blick items of 2026-10-15 to 2026-10-17 were not enumerated), kela-cyber (undated listing and gated reports), ahnlab-asec (reader-only listing and two of three reader keys exhausted), reliaquest (sitemap lastmod is not a publication date; no new post found), connectwise-trust-center (403 on every rung, no ConnectWise update after 2026-10-19 01:15 UTC could be read), my.f5.com (JavaScript shell on every transport; F5's text came through the CNA record as republished by Debian and by relays), parlament.ch committee pages (JavaScript-only), cyber.gouv.fr (Incapsula wall on the direct transport), hub.ivanti.com (unreadable on every transport; ivanti-advisory-hub is a stale fetch-gap id, the record is ivanti-psirt), ec-digital-strategy-newsroom and Europol feed items (undated listings).

Essential-coverage: all 21 essential records were attempted (S1 11, S2 10) and returned content; every authority feed was quiet.

Excluded as recent attempts: the belt-and-braces exclusion of the previous two fires' attempts removed 19 candidates from the S1 to S3 allocation; the breaches pool for S4 is 19 sources and both previous fires had attempted all of them, so S4 took 14 of them oldest-first from the rotation cursor instead of an empty slice. The slices were S1 14, S2 14, S3 14 and S4 14 standard or candidate records.

Source bookkeeping: last_successful_fetch moved for the sources whose items shipped, and consecutive_quiet_periods rose by one for the 41 sources whose ledger rows show a swept source with no in-horizon item. Promotions: bishopfox-blog, borncity and gambit-security met the three-run bar (sources.promotion_due).

Process: the container restarted mid-run (about 03:38 UTC) and killed the first FU1 spawn, which had written only progress lines; its work was lost and it was re-spawned once with the progress carried forward. The repository state on disk was intact. A stop hook asked three times for a commit while the run was mid-pipeline; nothing was committed before Phase 6.

Source health: tools/source_health.py probed 253 records; the first sweep put two on the UNSOLVED list (redcanary, stale since 2026-08-20 after its blog moved into Zscaler's, repointed to Zscaler's dated feed; connectwise-trust-center, unreadable on every transport today, set to blocked), and the second sweep ended with one needs-demote row for connectwise-trust-center that the blocked setting classes as handled on the next probe.

Self-identification: main agent Claude Sonnet 5.5 (claude-sonnet-5-5) from the harness-injected model line; all five research sub-agents (S1 to S4 and the FU1 follow-up) reported Sonnet 5.5 from their own prompt line.

Verification: four iterations, none CLEAN, ending on the low-residual early exit (rule 5). Iteration 1 (NEEDS_FIXES, 11 truth, 5 editorial, 4 advisory) caught that the NGINX entry named three flaws where nginx's own change log lists five and cited a rolling index page as a dated source, a stale ConnectWise title, an unsupported "about a week", an unsourced "unsigned" in the Siemens triage line, a Romulus name collision with RomulusLoader, a false run-record note about Forescout and the Publica enumeration that is Blick's gloss rather than the note's; all but four low-confidence items were fixed. Declined with rebuttal: the NGINX vulnerability-gate objection (F7: three unauthenticated pre-auth flaws scored 9.2 by F5 in the web server public-sector estates rely on, a national authority warns to patch at once, an earlier NGINX flaw was exploited three days after its public proof of concept, Debian stable is unfixed, and the entry says plainly that nothing is exploited), the Publica priority-high suggestion (F16: one outlet's reading of one confidential note, standing actions unchanged), the unreadable Citrix SAML guidance page (403 on every rung, unchanged earlier text) and the ConnectWise rolling advisory index (no per-incident permalink exists). The Atlassian record was retyped from update to improvement on the verifier's reading of the update-versus-improvement rule, so the entry is not re-floated. Iteration 2 (6 truth, 1 editorial, 4 advisory) was all wording precision (a "nobody analysed" absolute, a superlative in the Publica headline, an attack-complexity qualifier attached to a flaw whose page does not carry it, shorthand and a missing reference). Iteration 3 (2 truth, 2 editorial, 2 advisory) found that one address in Siemens' indicator list also appears among Forescout's ROMULUS hosts, which the Siemens entry now says without printing it. Iteration 4 (1 truth, 0 editorial, 1 advisory) found a weakness label that only the advisory carries and a vague closing sentence in an old Citrix paragraph; both were fixed and the fire published on the early exit with a residual count of 1 (the iteration's own truth count, already remediated). The 2026-10-19 note that Loxone was worth a re-check is answered in the borderline-drop list.

Tuesday, 20 October 2026

01Active threats, incidents & disclosures1 item

02Trending vulnerabilities2 items

03Research, reports & policy1 item

04Updates to prior coverage18 items

05Action items24 items

2026-10-20T0835Z-audit · audit · Opus 5.5 · 0 entries published

Verification & coverage notes

2026-10-20T0256Z-intel · Sonnet 5.5 · window 26 h · 4 entries published

Verification & coverage notes