6 verified findings from 1 run · 5 updates to prior coverage · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01Cisco ASA and FTD SSL VPN reload flaw is exploited and on CISA KEV; fixes in every branch, no workaround. Cisco's advisory of 2026-10-28 fixes CVE-2026-76418, a logic error in the remote access SSL VPN of Secure Firewall ASA and Secure FTD that lets an unauthenticated attacker reload the device with a crafted connection request when a tunnel group uses secondary authentication, and says Cisco's PSIRT became aware of active exploitation in October 2026; CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-29. Cisco names no actor, offers no workaround and lists first fixed releases for every ASA and FTD branch. →
02Lumen: Volt Typhoon's Silent Train relay chains fronted zero-days against SD-WAN, N-central and KACE. Lumen's Black Lotus Labs reports that Volt Typhoon ran exploitation, credential access and exfiltration through Silent Train, rotating chains of compromised SOHO, IoT and enterprise devices that it rebuilt for each operation, and that its monitoring uncovered one likely and four confirmed zero-day campaigns against endpoint and network management platforms and SD-WAN orchestrators, among them Cisco Catalyst SD-WAN, N-able N-central and Arista VeloCloud Orchestrator. The reported victims are US-centred and the report names no Swiss or European victim. →
03CrowdStrike: VAPOR PANDA runs ARTEX against 200+ organisations, European foreign ministries among them. CrowdStrike reports that from 2026-10-17 the China-nexus actor VAPOR PANDA used the ARTEX agent framework, driven mainly by the DeepSeek model, against more than 200 organisations worldwide, with the controller CrowdStrike saw directing exploitation in at least 14 countries, including foreign ministries in Europe, a European country's presidency, prime minister's office and defence, justice, finance and intelligence entities, and a Greek government entity. CrowdStrike confirmed post-exploitation at nine organisations, with the BLOODALCHEMY backdoor loaded by a renamed legitimate binary, and says this campaign is separate from the Storm-0940 ARTEX activity Microsoft reported. →
CrowdStrike OverWatch reports that from 2026-10-17 a single ARTEX controller linked to VAPOR PANDA infrastructure directed exploitation against entities in at least 14 countries over 11 days, and that the campaign reached more than 200 organisations, including foreign ministries in Europe (CrowdStrike, 2026-10-29). One engagement focused on a single European country, its foreign ministry, presidency, prime minister's office and defence, justice, finance and intelligence entities, and another targeted 19 US organisations in pharmaceuticals, semiconductors, defence, nuclear and finance (CrowdStrike, 2026-10-29). CrowdStrike confirmed post-exploitation at nine organisations and password spraying and credential scanning against at least 12 more, among them government entities in Europe (CrowdStrike, 2026-10-29). CrowdStrike states that the campaign is separate from the Storm-0940 ARTEX activity Microsoft reported and is VAPOR PANDA's first observed use of AI-driven tooling (CrowdStrike, 2026-10-29).
The framework ran mainly on the DeepSeek model, with a human operator steering the agents at decision points while they pursued web, cloud, container, Active Directory, mail and VPN paths in parallel (CrowdStrike, 2026-10-29). In transcripts at a US pharmaceutical company the agent chained an unsigned SAML assertion with an XML external entity flaw to query the cloud instance metadata service and obtain a role that could issue administration commands to thousands of instances; at a second it deployed web shells, abused an unauthenticated orchestration service for root in a container environment, read LAPS passwords and abused resource-based constrained delegation (CrowdStrike, 2026-10-29). Against a Greek government entity the operator supplied a 2022 directory export from the mail server whose authentication keys had likely not been rotated; the agent forged an administrator token, read mailboxes and used VPN configurations from a user's sent mail, with a VPN client key the operator described as coming from a May 2024 email leak, to reach the internal network (CrowdStrike, 2026-10-29). The operator also told the agents to find domain Windows hosts without the CrowdStrike Falcon sensor (CrowdStrike, 2026-10-29). At a Middle East interior ministry and a Latin American foreign ministry the actor loaded the BLOODALCHEMY backdoor through a legitimate GameHook binary renamed svchost.exe that loads a malicious DLL (CrowdStrike, 2026-10-29). No Swiss target is named.
Beginning on October 17, 2026, the adversary used ARTEX against more than 200 distinct organizations worldwide, including foreign ministries in Latin America, Europe, Asia, and the Middle East
The VAPOR PANDA campaign detailed in this blog post is separate from the ARTEX activity recently reported by industry sources under the Storm-0940 designation.
Against a Greek government entity, the operator supplied the agent with a 2022 directory export from the organization's mail server containing authentication keys that had likely not been rotated since the export.
Lumen's Black Lotus Labs reports that Volt Typhoon used a covert framework it calls Silent Train, first seen in late 2023, for the phases that need protection: exploitation, credential access, data exfiltration and continued access to victims (Lumen Black Lotus Labs, 2026-10-28). A session starts from a virtual private server outside the US, passes through compromised non-US SOHO and IoT devices and leaves through a compromised US device before the victim; more than 27 device classes were enrolled, from TP-Link routers and Netgear Orbi devices to Fortinet appliances and CyberPanel servers, and the enterprise platforms stayed in chains for one to three months as final hops (Lumen Black Lotus Labs, 2026-10-28). The operators exploit exposed web interfaces on the relay devices and deploy only what chained SSH needs, namely temporary SSH services, keys, configuration files and living-off-the-land utilities, with reverse tunnels over open-source proxies in later variants; sessions averaged about four hours, and at the end the operators removed all artifacts and dismantled the chain (Lumen Black Lotus Labs, 2026-10-28).
Lumen says its monitoring helped identify one likely and four confirmed zero-day campaigns against endpoint and network management platforms and SD-WAN orchestrators: Quest KACE, where the activity looked like an undisclosed flaw, affected more than 30 victims and fell after Quest's October 2025 updates (a moderate-confidence assessment); Versa Director in 2024; the N-able N-central flaws CVE-2025-8875 and CVE-2025-8876; Cisco Catalyst SD-WAN through CVE-2026-20127, exploited by late 2025 and after Cisco's February 2026 disclosure; and Arista VeloCloud Orchestrator through the zero-day later designated CVE-2026-16812 (Lumen Black Lotus Labs, 2026-10-28). Post-incident analysis found in-memory webshells, credential harvesting and abuse of native platform features such as endpoint control and remote file transfers, and in several cases erased or altered logs (Lumen Black Lotus Labs, 2026-10-28). The victims it names are US government, telecommunications, defence-industrial, managed-service and critical-infrastructure organisations, concentrated in Hawaii, California and Texas, and it names no European or Swiss victim (Lumen Black Lotus Labs, 2026-10-28). The Hacker News carries the same findings from a report Lumen shared with it (The Hacker News, 2026-10-28).
This insight helped identify one likely and four confirmed zero-day campaigns targeting network and endpoint management platforms and SD-WAN orchestrators used by critical organizations.
At the end of each session, operators removed all artifacts and dismantled the chain.
Post-incident analysis with partners uncovered in-memory webshells, credential harvesting and abuse of native features such as endpoint control and remote file transfers.
Cisco's advisory of 2026-10-28 describes CVE-2026-76418, a logic error in the remote access SSL VPN service of Secure Firewall ASA and Secure FTD: an unauthenticated, remote attacker who sends a crafted request while connecting to the SSL VPN makes the device reload, and a successful VPN login is not required to reach the affected processing path (Cisco PSIRT, 2026-10-28). Cisco says its PSIRT became aware of active exploitation in October 2026 and names no actor or victim (Cisco PSIRT, 2026-10-28); CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-10-29 (CISA, 2026-10-29), and CERT-FR restates the advisory (ANSSI / CERT-FR, 2026-10-29). The stated impact is a reload and denial of service, scored CVSS 3.1 8.6 with availability as the only impact; no code execution or data access is described (Cisco PSIRT, 2026-10-28).
The first fixed releases are ASA 9.16.4.104 (for 9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1, and FTD 7.0.11 (for 7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 (Cisco PSIRT, 2026-10-28). Cisco lists no workaround; its mitigation is to remove secondary authentication from the tunnel group, which lowers the security posture of the remote access VPN, or, where DefaultWEBVPNGroup does not use secondary authentication, to disable the tunnel group list with no tunnel-group-list enable (Cisco PSIRT, 2026-10-28). Cisco confirms that Secure FMC, Cloud-delivered Firewall, cdFMC and Secure Access are not affected (Cisco PSIRT, 2026-10-28).
Triage: a reload also follows upgrades, HA events and hardware faults; a reload that coincides with unauthenticated SSL VPN connection attempts from an external address is the pattern the stated mechanism produces.
In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group.
A successful VPN login is not required to reach the affected processing path.
WordPress 7.1.4, released on 2026-10-28, fixes a weakness in the upgrade process that can lead to remote code execution during the upgrade window, and backports follow for every branch that receives security fixes, currently through 4.7 (WordPress.org, 2026-10-28); WordPress's release documentation counts 22 vulnerabilities, as Wordfence reports (Wordfence, 2026-10-29). During a core update with a complete package, the new files are unpacked into a predictable directory under wp-content/upgrade; the temporary copy includes the installer, and an unauthenticated attacker who requests it at the right moment can interact with the staged copy and reach PHP code execution (Wordfence, 2026-10-29). Wordfence scores it CVSS 8.1 for versions 4.7 through 7.1.3 and states that the attack complexity is high, because the attacker needs web access to the staging tree and must win a race that lasted only seconds in its lab (Wordfence, 2026-10-29). Patchstack reads the same flaw as needing wp-content/upgrade/ to be reachable over the web, notes that the sink dates back to WordPress 2.8 and that the window returns on every update, unattended ones included, and would not call it practical to exploit (Patchstack, 2026-10-28).
Wordfence reports that its new firewall rule matched within nine minutes of deployment and that it recorded more than 18,500 requests for staged setup-config.php installer paths in the first 21 hours, with two large sources polling small groups of sites for about 14.5 hours, which it reads as attempts to catch the update window (Wordfence, 2026-10-29). No source reports a successful compromise, and no source assigns a CVE identifier. The fix randomises the staging directory, adds an index guard and prevents unsafe promotion of staged configuration data (Wordfence, 2026-10-29). Most sites receive the release through automatic background updates, which Wordfence says should be checked rather than assumed (Wordfence, 2026-10-29).
Triage: a request to a staging path outside an update window finds only an index.php and is probing, not compromise; a successful response from the staged installer during an update is the event that matters.
A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window
privatim, the conference of the Swiss data-protection authorities, dates version 3.02 of its guidance "Cloud-specific risks and measures" to 2 October 2026 (privatim, 2026-10-02); it replaces the version of 3 February 2022 (DCOD, 2026-10-27). For particularly sensitive personal data the public body must encrypt, the keys may be available only to it, and outsourcing such data, or data under a statutory duty of confidentiality, to SaaS from large international providers, with Microsoft, Google, AWS and SAP named, is in most cases inadmissible because of the untenable risk (privatim, 2026-10-02). Keys may stay with the provider only where no untenable risk follows and the provider is bound by contract to use them only with the body's express consent and to log every access (privatim, 2026-10-02).
The body, or its top management, is to confirm in writing that it has understood the risks and accepts the residual risk, and data the cloud services generate about their users, such as telemetry and logging data, is to be treated with the same care and contract terms as the content data (privatim, 2026-10-02). The five risk areas are contract design, places of processing including foreign authority access, confidentiality with encryption and key management, user data, and sub-processors (privatim, 2026-10-02).
Outsourcing personal data that is particularly sensitive or subject to a statutory duty of confidentiality to SaaS solutions of large international providers (such as Microsoft, Google, AWS and SAP) by public bodies is in most cases inadmissible because of the untenable risk. (translated from German)
Cisco Talos Incident Response reports that in Q3 2026 financial organisations made up 18 percent of its engagements, tying with public administration as the most targeted sector (Cisco Talos, 2026-10-29). Phishing was the leading initial-access technique at 37 percent of engagements and exploitation of public-facing applications second at 33 percent; the phishing cases include numerous actors who phone the victim as the IT help desk to get remote access allowed through a legitimate remote monitoring and management (RMM) tool (Cisco Talos, 2026-10-29). Ransomware and pre-ransomware cases were 27 percent of engagements, with The Gentlemen, Qilin, Rhysida and the closed group Interlock among the families and a new variant, VYPR, that Talos calls operationally immature: it had no leak site when seen, reused leaked Conti-derived source code and exfiltrated over several days (Cisco Talos, 2026-10-29).
The VYPR intrusion began with a vishing call that had the user start a Microsoft Quick Assist session; the actor then used RMM software that ran PowerShell to download and install an MSI from a remote address, with MeshAgent, Rclone, PsExec, an IP scanner and mstsc as tools, and disabled EDR with several vulnerable drivers (Cisco Talos, 2026-10-29). Interlock operators repeatedly tried to uninstall Cisco Secure Endpoint, used PsExec and taskkill to end security services and integrity checkers, turned off Windows Defender real-time protection and cleared event logs (Cisco Talos, 2026-10-29). Talos names insufficient logging (over 40 percent of engagements), weak credential and secret handling, and absent or incomplete MFA as the most common weaknesses, and recommends centralised logging with at least 90 days of retention (Cisco Talos, 2026-10-29).
Targeting of the financial industry increased from last quarter to comprise 18 percent of all engagements, tying with public administration as the most targeted sector.
numerous threat actors conducting voice phishing (vishing) in tandem with IT desk impersonation to socially engineer the victim into allowing remote access via a legitimate remote monitoring and management (RMM) tool
making multiple attempts to impair endpoint detection EDR capabilities by trying to uninstall Cisco Secure Endpoint (CSE) on compromised systems
The entry said that neither the Confederation nor Publica had named the actor. Publica's own newsletter of 2026-10-22 says the Akira group is being associated with the attack, and that Publica filed a criminal complaint with the Federal Prosecutor's Office on 2026-10-15; the summary, the sourcing note and the paragraph on the Akira reporting now say so, a population figure was trimmed from the analysis, and the demand and the Prosecutor's Office confirmation still rest on press reports.
Publica's own newsletter of 2026-10-22 says that the hacker group Akira is being associated with the attack, referring readers to the Federal Office for Cybersecurity's description of the group's methods, and that Publica filed a criminal complaint with the Federal Prosecutor's Office on 2026-10-15 (Publica, 2026-10-22). The same newsletter says Publica must assume that data left the supplier and that whether and to what extent Publica's personal data is among it is still being investigated (Publica, 2026-10-22). The ransom demand and the Federal Prosecutor's Office confirmation of the exfiltration by Akira remain press reports.
Check Point's sk1000302 now notes a hotfix for the end-of-support R81.10 gateway release, published on 2026-10-29 at 11:30 GMT; the entry recorded hotfixes only for R81.20, R82, R82.10, R82.20 and Spark. The summary, the CVE records and the hotfix paragraph name it.
Check Point's sk1000302 carries a new note of 2026-10-29 at 11:30 GMT, "Released Hotfix for R81.10" (Check Point, 2026-10-29). R81.10 is an end-of-support gateway release that the sk still lists as affected, so a gateway on it now has a hotfix to install. The other hotfixes and the exploitation statement are unchanged.
HPE's revision 3 of bulletin HPESBNW05171, dated 2026-10-29, exceptionally adds ClearPass 6.12.8 with a hotfix patch beside the 6.14.1 and 6.11.16 trains, and its affected-products note now reads 6.14.0 and earlier and 6.11.15 and earlier; the earlier wording that named 6.14.1 and 6.11.16 as versions with some mitigation is gone. The title, headline, summary, CVE records, evidence, action and text now follow revision 3.
HPE's revision 3 of bulletin HPESBNW05171, dated 2026-10-29, updates its affected and resolution sections to exceptionally include ClearPass 6.12.8 (HPE Networking, 2026-10-29). A ClearPass 6.12.8 hotfix patch for CVE-2026-109618 and CVE-2026-109619 is now named beside the 6.14.1 and 6.11.16 patches, downloadable from the HPE Networking Support Portal (HPE Networking, 2026-10-29). The affected-products note of this revision reads 6.14.0 and earlier in the 6.14 train and 6.11.15 and earlier in the 6.11 train, while its machine-readable record gives 6.14.1, 6.11.16 and 6.12.8 as boundaries, and the wording of revision 2 that named 6.14.1 and 6.11.16 as versions providing some level of mitigation is no longer in the bulletin (HPE Networking, 2026-10-29). The bulletin still says nothing about exploitation of ClearPass.
Palo Alto's advisory timeline of 2026-10-29 23:54 UTC removes the estimated date of 11.1.7-h12 because the build is released, so all twenty PAN-OS hotfixes are now available and no estimate remains; the exploitation statement is unchanged. The title, headline, summary, fixed-release strings, the action and the hotfix sentences in the text are updated to match.
Palo Alto Networks' advisory timeline of 2026-10-29 at 23:54 UTC removes the estimated date of 11.1.7-h12 "as the version is released" (Palo Alto Networks, 2026-10-30). With it, all twenty PAN-OS hotfixes are available and the advisory table gives no estimated date for any build (Palo Alto Networks, 2026-10-30). The exploitation statement is unchanged.
CISA added CVE-2026-97229 to the Known Exploited Vulnerabilities catalog on 2026-10-29 and NCSC Switzerland updated its advisory the same day to active exploitation, citing Alpine Linux's report that a newly registered account crashed its GitLab 19.3.4 workers eight times on 2026-10-20 and 21, after which Alpine rebuilt the instance. Alpine also found that GitLab's fix is a patch to the Ruby bundled in its own packages and images, so an installation with its own Ruby needs Ruby 3.3.13, 3.4.12 or 4.0.9 as well, and GitLab's builds of 2026-10-21 also fix a second CVSS 10 flaw, CVE-2026-110264. The CVE record moves to exploited and KEV-listed, the summary, detection, takeaway and action are rewritten, and the superseded status lines are removed.
CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on 2026-10-29, "based on evidence of active exploitation" (CISA, 2026-10-29), and NCSC Switzerland edited its advisory the same day to add reports of exploitation attempts, moving the exploitation status to active exploitation (NCSC Switzerland, 2026-10-29). The report behind it is Alpine Linux's: on 2026-10-20 and 21 a newly registered account sent crafted CI configurations to its GitLab instance, which still ran 19.3.4, crashed the worker processes eight times and got partway through the exploit in four of them; the attacker returned on 2026-10-25 and 26 and failed, Alpine found no evidence that code ran but could not rule it out, and it rebuilt the instance (Alpine Linux, 2026-10-28). Alpine's upgrade to GitLab 19.3.6 on 2026-10-22 did not close the flaw, because the fix is a set of patches to the Ruby that GitLab applies only in its official packages and images, so an installation that runs its own Ruby needs Ruby 3.3.13, 3.4.12 or 4.0.9 or later as well (Alpine Linux, 2026-10-28). GitLab's release page now says its security team has released six threat detections for self-managed instances (GitLab, 2026-10-12). GitLab's release of 2026-10-21 (19.5.1, 19.4.3, 19.3.6, 19.2.9) also fixes a second CVSS 10 regular-expression compiler flaw, CVE-2026-110264, so those builds are the better upgrade target (GitLab, 2026-10-21). Rapid7's statement of 2026-10-13 that it saw no confirmed exploitation predates all of this.
Upgrade every Cisco ASA and FTD unit that has webvpn enabled and secondary authentication on any tunnel group, DefaultWEBVPNGroup included, to the first fixed release of its branch (ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 or 9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1), internet-facing units first, because Cisco reports exploitation and its only mitigation removes secondary authentication.
Take the management interface of every PA-Series and VM-Series firewall and Panorama off the internet now by restricting it to a jump box or trusted internal addresses, because Palo Alto reports active exploitation against internet-exposed management interfaces, and install the hotfix for your maintenance release, which Palo Alto's table lists for every line from 10.2.7 to 12.2.4 (11.2.10-h17 adds the Brotli fix).
Upgrade every self-managed GitLab CE and EE instance on 19.2, 19.3 or 19.4 to 19.2.8, 19.3.5 or 19.4.2 now, preferably to 19.2.9, 19.3.6, 19.4.3 or 19.5.1, which also fix CVE-2026-110264, internet-reachable instances and instances that allow open sign-up or public projects first, because CISA lists the flaw as exploited and NCSC Switzerland reports active exploitation; where GitLab runs on its own Ruby (a source install or a container image that does not use GitLab's packages) also install Ruby 3.3.13, 3.4.12 or 4.0.9, because the fix is a Ruby patch that only GitLab's official packages carry. On any instance that was reachable on an affected version, run the six detections GitLab published on its release page and treat the CI/CD variables, runner registration tokens and deploy keys of any hit, or of an instance where compromise cannot be ruled out, as exposed.
Confirm in Dashboard > Updates that every WordPress site your organisation, its web agencies or its hosting suppliers run is on 7.1.4 or the fixed release of its branch, and deny web access to wp-content/upgrade/ in the web server configuration of each, because the race can be probed during any full-package core update and a firewall that WordPress itself loads does not run for that request.
Install the HPE ClearPass 6.14.1, 6.12.8 or 6.11.16 hotfix patch for CVE-2026-109618 and CVE-2026-109619 on every ClearPass Policy Manager node from the HPE Networking Support Portal, and until it is installed take the guest portal and the CLI and web management interfaces off public networks, confining management to a dedicated layer 2 segment or behind firewall policy.
2026-10-30T0255Z-intel· Sonnet 5.5 · window 26 h · 6 entries published
Verification & coverage notes
A moderate window: six new entries and six changelog records. No deep dive and no critical entry: nothing met the stop-and-act bar, and the one candidate for a priority raise (GitLab CVE-2026-97229, now on CISA KEV) stays high: exploitation is reported by one observer (Alpine Linux, attempts against its own instance on 2026-10-20 to 26 with no confirmed code execution; CISA lists it and NCSC Switzerland restates the report), and the demonstrated path needs an account that can push to a public project. Reopen as critical on mass exploitation or a confirmed compromise.
KEV sweep (work/2026-10-30T0255Z-intel/kev-window.txt): CVE-2026-76418 (Cisco ASA/FTD) is a new entry; CVE-2026-97229 (GitLab, COVERED-STALE) is an update record that moves its CVE status to exploited. No RANSOMWARE row.
Backlog: the ARX Group SA row (Aurora leak-site claim) stays held. S4 re-checked it on 2026-10-30 (Ransomware.live press field empty, no victim, SBB, USTRA or Swiss press report in DE, FR, IT or EN); expiry 2026-11-07, struck then if unconfirmed.
Window: the previous intel run started 24 h earlier, so gap 24.0 h and window 26 h. The two earlier fires' attempts excluded 89 standard records from the slices; the breaches pool (20 records) was so small that S4 took its 12 oldest-cursor records without the exclusion, which is why bleepingcomputer, cnil-fr and similar records were swept again.
Mid-run stop-hook nudges to commit were noted and ignored: the run commits atomically in Phase 6.
Dates: Lumen's Silent Train page carries the metadata date 2026-03-16, but its text covers events through July 2026 and The Hacker News reported it on 2026-10-28; the new entry uses 2026-10-28 and an internal record corrected the same citation date on the KeyDrift entry.
Publica: its own newsletter of 2026-10-22 associates Akira with the attack, so a correction record replaced the entry's statement that Publica had not named the actor. The newsletter PDF extracts with broken line spacing, so the correction cites it inline and carries no evidence quote.
Single-source: Silent Train (Lumen's own research; The Hacker News relays it), Talos IR trends (first-party report), VAPOR PANDA (CrowdStrike telemetry and recovered controller transcripts), privatim guidance (the PDF; DCOD summarises), Cisco ASA/FTD (vendor advisory; CISA restates the listing). All carry the matching sourcing_note.
borderline-drop: Linux kernel CVE-2026-98432, patch-cycle class: NCSC Switzerland carried it on 2026-10-29 as a critical advisory with the exploitation status unknown, and Anthropic reports a lab remote-root exploit against MPTCP listeners with the code unpublished, but vendors rate attack complexity high (scores 5.9 to 8.1), no exploitation is reported, and no mitigation exists beyond the kernel update (Ubuntu and RHEL still unfixed on 2026-10-29). Reopen if exploitation or public exploit code is reported.
borderline-drop: Sophos UTM CVE-2026-118633, out-of-window: primary source 2026-10-28, window_hours=26; the 2026-10-29 BSI and ANSSI relays add no development, and there is no exploitation report; a pre-auth root flaw on an end-of-life appliance that needs a manual patch, so reopen if exploitation is reported.
borderline-drop: Progress WS_FTP CVE-2026-84295, unauthenticated CVSS 10.0 but no exploitation statement, and only CNA record text relayed by EUVD and GHSA (included with reduced confidence was considered and rejected: the vendor advisory is login-gated).
borderline-drop: Juniper JSA112183 Session Smart Router and Conductor, no exploitation, the 9.8 router row is limited to devices not yet onboarded, constituency deployment unknown, vendor page unreadable.
borderline-drop: Xerox and Fiery PHP2Shell (XRX26-016), out-of-window: primary source 2026-10-28, window_hours=26; no exploitation against printers, fixes from 2026-11-06.
borderline-drop: Oracle E-Business Suite CVE-2026-101767 (Canadian Centre wording of 2026-10-28), an authority restating open-source reporting with no first-hand observation; the entry already carries the Defused decoy attempts.
borderline-drop: OpenText Advanced Authentication CVE-2026-112256, a single CNA record via EUVD, vendor text unreadable, no exploitation statement.
borderline-drop: Microsoft's report of Onyx Sleet and Pearl Sleet using ARTEX (update on the Storm-0940 entry), two more ARTEX users in trend reporting; the Storm-0940 entry is already past 1,900 words, so an update record would add bulk for a marginal delta. VAPOR PANDA's entry references it.
borderline-drop: EFK audit of Microsoft 365 in the federal administration, recommendations on one tenant, no obligation or near-term action, primary 2026-10-21.
borderline-drop: Sophos GOLD OGRE and Aur0ra AI-agent intrusions; standard Active Directory chain run with AI agents, first reported by Gambit and CloudSEK in August; adds no new technique.
borderline-drop: Group-IB MadApe, SOCRadar n0n, Arctic Wolf Teams external-chat impersonation, Talos NIK C2, Cyble INJ3CTOR3 FreePBX, covered techniques or commodity capability with no victimology, vector or constituency exposure.
borderline-drop: OpenSourceMalware trojanized Claude Code extension, a single source that disclaims provenance; reopen on a vendor or second-source statement.
borderline-drop: EDK II PXE CVE-2026-97631, out-of-window: advisory 2026-10-22, firmware class, no exploitation.
borderline-drop: Binance theft (about 6.3 billion US dollars), global scale but nothing transferable beyond a preliminary "compromised engineer laptop"; reopen when the post-mortem names the vector.
borderline-drop: Polymarket and DebugBear script compromise, no Swiss or public-sector customer known; reopen if DebugBear names scope or a root cause.
Out-of-window items kept as developing stories (72 h window): the Silent Train report (2026-10-28), because it develops the KeyDrift story published on 2026-10-29.
Lookback: the privatim guidance (document 2026-10-02, announced 2026-10-13) entered through the dcod-ch lookback and is first coverage for the reader.
Coverage gaps: ox-security (article bodies 403 on every transport, lead-only); lab52 (feed SSL EOF, reader listing undated); resecurity (empty JavaScript shell on extract); golem-security (cookie wall, titles only); edoeb-ch-press (listing stale, sitemap recipe found); Juniper support portal, Progress and OpenText advisories (script shell or login wall).
Source health and recipes: S2 and S1 returned working recipes for ec-digital-strategy-newsroom (extract), edoeb-ch-press (sitemap), le-monde-info, github-advisory, enisa-euvd and ransomware-live; they are in the notes of those records. Three candidates added (privatim-ch, ncsc-nl-php2shell-tracker, infostealers-hudson-rock) and three promoted to active (veeam-kb-security, dream-research, safedep).
For the next audit: the GitLab, PAN-OS and Publica entries are 600 to 1,160 words in the main text although earlier records grew them; this run shortened the GitLab and Publica text but did not rewrite them to the 550-word bound.
Verification: four iterations; iterations 1 to 3 returned NEEDS_FIXES (23, 10 and 4 findings, all remediated or declined with a reason) and iteration 4, a post-fix pass over 111 of 241 claims plus the full text of all twelve entries, returned one editorial finding (the WordPress firewall wording), which was remediated before publication under the low-residual early exit (truth plus editorial 1). No CLEAN iteration ran, so this publication rests on the early exit, not on a confirmed double-CLEAN; the next quality audit should give these twelve entries an independent pass.