CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →
‹Mon · 02 Nov 2026
All daily briefs →
Daily brief · UTC day

Monday, 2 November 2026

4 verified findings from 1 run · 3 updates to prior coverage · the settled record for this UTC day, in the classic brief order.

Criticality
Kind
Topic
Region
TL;DR · the day in one read
  1. 01PHP2Shell affects Xerox AltaLink and VersaLink printers and Fiery controllers; fixes due 6 to 23 November. Xerox's security bulletin XRX26-016 (published 2026-10-23, updated 2026-10-28) lists AltaLink, EC81xx, VersaLink C/B415, C/B625 and C/B620, WorkCentre 3655, EC7836 and EC7856, the Fiery Digital Front End and the Worldwide Ticketing Tool as affected by the PHP flaws CVE-2026-109618 and CVE-2026-109619, and no fixed build is out: Xerox expects the AltaLink, EC81xx and VersaLink fixes on 2026-11-06, Fiery patches are due between 2026-11-09 and 2026-11-23, and the WorkCentre and Ticketing Tool fixes are in development. The bulletin names no workaround, interface or attack on these devices; CISA lists both PHP flaws as exploited. →
  2. 02CERT-UA: Dahua cameras are taken over through the Easy4IP cloud even with no port exposed; turn P2P off. Ukraine's CERT-UA reports, in an alert dated 2026-10-23, compromises of Dahua IP cameras and video recorders in which attackers viewed the stream, changed device settings and created accounts of their own. The main vector is Easy4IP, Dahua's peer-to-peer remote-access feature, which reaches a device through Dahua's cloud by its guessable serial number without any published port; passwords are then guessed or, CERT-UA says, the 2021 authentication-bypass flaws CVE-2021-33044 and CVE-2021-33045 are used on outdated firmware, a use eSecurity Planet says is unconfirmed in these cases. →
  3. 03Android 'SMS of Death': one hidden SMS drops calls, emergency calls included; Android 12 and 13 get no fix. An independent researcher published a working proof of concept on 2026-10-29 for a zero-click remote denial of service in Android's telephony framework: one malformed WAP Push data message crashes the com.android.phone process, drops active calls including emergency calls and, because the message is retried, can leave a phone in a restart loop. Per the researcher, Google's fix shipped in the October 2026 update for Android 14 to 17, so Android 12 and 13 phones run the same code unfixed; no source reports exploitation. →

01Active threats, incidents & disclosures2 items

NOTABLECVE-2021-33044 +1exploitedNATOA2

Dahua cameras and recorders: CERT-UA warns that attackers take devices over through the Easy4IP cloud relay even when no port is exposed, then view video, change configuration and add accounts

CERT-UA's alert (CERT-UA, 2026-10-23; dated 2026-10-23 by Security Affairs, 2026-10-27) reports recorded compromises of Dahua IP cameras and DVRs in which attackers had the video stream, changed the device configuration and created accounts of their own (The Hacker News, 2026-10-27). The main vector is Easy4IP, Dahua's peer-to-peer remote-access feature: a device with it enabled opens an outbound connection to Dahua's cloud and registers by serial number, and access then runs through the cloud, bypassing NAT and firewall, with no published port and no public address (CERT-UA, 2026-10-23; Security Affairs, 2026-10-27). Serial numbers follow a predictable pattern, a 10-character model prefix and a five-character hexadecimal counter that rises almost sequentially, so attackers can guess them at scale and learn which devices are cloud-connected without hitting rate limits (The Hacker News, 2026-10-27). Authentication is then beaten with weak or known passwords or with the authentication-bypass flaws CVE-2021-33044 and CVE-2021-33045 in outdated firmware, which CISA added to its Known Exploited Vulnerabilities catalogue on 2024-08-21, although their use in the October cases remains unconfirmed (eSecurity Planet, 2026-10-27). Dahua fixed both in 2021 with model-specific firmware builds and rates them CVSS 8.1 (Dahua, 2021-11-15). CERT-UA does not say who was targeted, how many devices are affected or who is behind the activity (The Hacker News, 2026-10-27).

The Hacker News says the activity shares similarities with Hunt.io's earlier Operation CameraSwarm, which reported more than 14,530 Dahua cameras compromised between 2026-06-17 and 2026-07-22 with brute-forced credentials and the same two-flaw chain, nearly 2,000 of them given a backdoor account that survives a password change and, on most firmware, a factory reset (The Hacker News, 2026-10-27); eSecurity Planet says no connection to the October incidents has been established (eSecurity Planet, 2026-10-27). Dutch intelligence services warned in July that Russian state actors compromise IP cameras to collect intelligence on military transports (The Hacker News, 2026-10-27).

Triage: a login from 127.0.0.1 shows only that the session arrived through the P2P relay, so where staff or an installer legitimately use Easy4IP it is normal; the account name, the time and the configuration change that follows separate the two.

Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded

The Hacker News 2026-10-27

CERT-UA warns that devices with Easy4IP enabled may be vulnerable even when they cannot be accessed directly from the internet.

Security Affairs 2026-10-27

Audit logs containing authentication events using the manufacturer's native protocol (DVRIP) and from a local address (127.0.0.1), a sign of P2P access.

using a combination of credential brute-force attacks and the exploitation of the CVE-2021-33044-CVE-2021-33045 chain.

The Hacker News 2026-10-27

although their use in the October incidents remains unconfirmed.

eSecurity Planet 2026-10-27

Builds on: Dutch intelligence: Russia hijacked default-credential internet cameras along military-supply…

threat02 Nov 03:46Zsingle-source · national CERTOpen finding →
Sources: CERT-UA (State Service of Special Communications and Information Protection of Ukraine) · The Hacker News · Security Affairs · eSecurity Planet · Dahua Technology (DHCC-SA-202106-001)
ROUTINENATOB2

NIK C2: Talos documents a Go Windows implant that sends operator prompts to the OpenAI API from the infected host and falls back to the victim's own API key

Cisco Talos found a command-and-control framework it calls NIK C2, with a live server, whose 64-bit Go implant for Windows takes more than 52 commands: browser and Wi-Fi credential theft, keylogging, screen, camera, microphone and clipboard capture, hidden VNC, RDP session interaction, an embedded SOCKS5 and HTTP proxy with a reverse tunnel for lateral movement, AMSI patching, UAC bypass and process hollowing (Cisco Talos, 2026-10-29). It talks to its server over TLS WebSockets on port 443 with an HTTP polling fallback about every 250 milliseconds under AES-256-GCM, persists through registry Run keys and COM hijacking, masquerades under a system-process name such as svchost.exe and runs a watchdog process (Cisco Talos, 2026-10-29). The new part is the ai_generate command: the implant builds an OpenAI Chat Completions request from an operator prompt on the infected host, posts it to OpenAI from the victim's address and returns the answer to the panel; if the operator gives no key it reads the OPENAI_API_KEY environment variable, so OpenAI charges the victim's payment method and its logs show the victim's key (Cisco Talos, 2026-10-29; Infosecurity Magazine, 2026-10-29). A screen-locking ransomware module encrypts no files: PowerShell copies the boot sector to a temporary file, and a looping batch file reopens a lock page shown through mshta.exe (Cisco Talos, 2026-10-29). Talos sees at least three implant versions and assesses with moderate confidence that the framework is functional; its post names no victims, sector or delivery method (Cisco Talos, 2026-10-29).

allowing operators to route arbitrary prompts to the OpenAI Chat Completions API directly through the infected host

OpenAI's billing system will charge the victim's payment method, and OpenAI's access logs will show the victim's API key as the one that made the requests

It does not encrypt any files, which means it leaves no forensic trail of file modification timestamps or encryption markers

Cisco Talos 2026-10-29
threat02 Nov 03:46Zsingle-sourceOpen finding →
Sources: Cisco Talos · Infosecurity Magazine
NOTABLECVE-2026-109618 +1exploitedNATOA2

CVE-2026-109618 / CVE-2026-109619, Xerox AltaLink, EC81xx, VersaLink and WorkCentre printers and Fiery print controllers: Xerox lists them as affected by the PHP2Shell flaws, with fixes expected on 2026-11-06 and Fiery patches between 2026-11-09 and 2026-11-23

Xerox's security bulletin XRX26-016, published 2026-10-23 and updated on 2026-10-28, lists Xerox AltaLink and EC81xx products, VersaLink C/B415, C/B625 and C/B620, WorkCentre 3655, EC7836 and EC7856, the Fiery Digital Front End and the Worldwide Ticketing Tool as affected by the PHP flaws CVE-2026-109618 and CVE-2026-109619 (Xerox, 2026-10-28). No fixed build is out: Xerox says the AltaLink, EC81xx and VersaLink fixes are being tested and expected on its website on 2026-11-06, the WorkCentre models and the Ticketing Tool are in development, and Fiery's target patch dates are by 2026-11-09 for FS800, FS700, FS600 and FS500 including the Pro editions, by 2026-11-16 for FS400, FS350 and FS300, and by 2026-11-23 for FS200 (Xerox, 2026-10-28). The bulletin does not name the affected interface or PHP version, offers no workaround and reports no attack on these devices, while CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26 and describes each as allowing unauthenticated remote code execution in PHP (CISA KEV, 2026-10-30).

Xerox is aware of the recently disclosed critical vulnerabilities in the PHP runtime

Fix being tested. Expected to post to web November 6, 2026.

Xerox (Security Bulletin XRX26-016, version 4) 2026-10-28

Builds on: PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the… · PAN-OS management interfaces were rooted in the wild via PHP2Shell and a kernel flaw: hotfix… · NetScaler's PHP2Shell fix is out: 14.1-73.49, 13.1-64.32 and FIPS builds; restrict management… · PHP2Shell hits QNAP NAS before login: QTS, QuTS hero, QVR, TVR OS and Notes Station 3 fixed… · PHP2Shell hits NetModule routers (fix: NRSW 5.0.0.105), macmon, Schneider, B&R, HMS, Wibu and… · Cisco's final PHP2Shell advisory: Expressway needs 15.5.21, Duo Access Gateway 3.2.0; Cisco… · HPE ClearPass 6.14, 6.12 and 6.11 are affected by PHP2Shell; a hotfix patch exists for each… · Check Point: PHP2Shell hits gateway VPN and portal web interfaces; hotfixes out, R81.20 package… · F5 BIG-IP is affected by PHP2Shell: fixes are in 17.1.3.7, 17.5.1.11 and 21.1.0.4; APM data… · PHP2Shell: Trend Micro Apex Central and Apex One await patches to 11 Nov; Quest KACE and NetApp… · PHP2Shell hits Broadcom endpoint-security servers: App Control 8.12.2 or 8.13.2; SEPM fix… · CVE-2026-46300 (Fragnesia): CISA lists the Linux kernel root flaw as exploited, chained with… · Camping.Care booking data stolen: TCS and a second campsite warn of WhatsApp fraud; PHP link…

vulnerability02 Nov 04:24Zsingle-sourceOpen finding →
Sources: Xerox (Security Bulletin XRX26-016, version 4) · CISA Known Exploited Vulnerabilities catalog (version 2026.10.30)
NOTABLENATOB2

Android telephony ('SMS of Death'): one hidden WAP Push message crashes the phone process and drops calls, emergency calls included; fixed for Android 14 to 17 in the October 2026 update according to the researcher, Android 12 and 13 stay exposed, public proof of concept

A researcher who signs as Mark B published a working proof-of-concept app on 2026-10-29 for a zero-click remote denial of service in Android's telephony framework (smsofdeath.com, 2026-10-29). One malformed WAP Push data message to port 2948 makes WapPushOverSms.decodeWapPdu() cast a 64-bit header length to a signed 32-bit integer and allocate a negative-sized array; the uncaught NegativeArraySizeException kills the com.android.phone process, which drops active calls, emergency calls included, and cuts service for one to two seconds per message (smsofdeath.com, 2026-10-29). The poison message stays in the pending queue and is retried on every boot and on carrier redelivery: the researcher reports that about 20 messages leave a device unusable and that one Android 12 phone rebooted into recovery roughly every 90 seconds until the messages were deleted over ADB (smsofdeath.com, 2026-10-29). The crash reproduced on Android 12 to 16, on a Pixel 9 and on Samsung Galaxy and A-series phones (smsofdeath.com, 2026-10-29); Security Affairs restates the mechanism and the October fix for Android 14 to 17 (Security Affairs, 2026-11-01).

Google's fix, titled "Fix remote DoS in decodeWapPdu", catches the exceptions the malformed messages trigger and deletes the malicious messages from the SMS database (BleepingComputer, 2026-10-31); per the researcher it shipped in the October 2026 update for Android 14 to 17, so Android 12 and 13 phones outside the update window run the same code unfixed (smsofdeath.com, 2026-10-29). BleepingComputer adds that the fix is not listed in Google's October bulletin (BleepingComputer, 2026-10-31). The proof-of-concept app and its source are public (smsofdeath.com, 2026-10-29; BleepingComputer, 2026-10-31), and none of the sources reports use in the wild.

Triage: a single telephony restart has many benign causes; a restart that recurs on every boot or on each carrier redelivery, with the exception above in the crash log, matches this flaw.

The message is delivered as a data SMS and is never shown to the user: there is nothing in the inbox, and the victim never sees the sender's number.

Devices updated to the October 2026 patch level or later are protected; devices on earlier patch levels remain vulnerable.

Mark B (smsofdeath.com) 2026-10-29

the flaw is not listed in Google's October security bulletin, and older Android 12 and 13 devices remain vulnerable because they did not receive the fix.

BleepingComputer 2026-10-31
vulnerability02 Nov 03:46Zsingle-sourceOpen finding →
Sources: Mark B (smsofdeath.com) · BleepingComputer · Security Affairs

03Updates to prior coverage3 items

HIGHexploitedupdatedNATOA2

Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers compromised, with forced defrost at hundreds of French supermarkets and, on 2026-11-02, refrigeration failures at more than 115 shops in at least six more countries; CERT-FR and NCSC Switzerland say to remove internet exposure

First published 2026-10-13 · open finding →

Updaterun 2026-11-02T0256Z-intelsummarysourcesevidencebody

Reuters reports that the Pentagon treats late-August freezer failures at at least six US military commissaries as a suspected hack, with Cyber Command and Army investigators in touch with their French counterparts, and Nextgov adds that two people familiar with the matter say US officials suspect Iran-linked hackers; neither says how the intruders got in, and no official has attributed the activity on the record.

Reuters reported on 2026-10-29, citing four officials, that the Pentagon is treating the late-August freezer failures at military bases across the United States as a suspected hack (Reuters, 2026-10-29). On Reuters' own review of the bases' social-media posts at least six commissaries were hit, and in at least one case the cooling units' temperatures were raised overnight instead of the units stopping; Fort Huachuca said its freezer "went into defrost mode where it heated up all the food" (Reuters, 2026-10-29). A Cyber Command unit and the Army Criminal Investigation Division's Cyber Field Office are involved, and one official said the investigators are in touch with their French counterparts about the French attack; Reuters could not establish whether Danfoss or any other controller brand was in use at the bases, nor how far the investigation had got or who might be responsible (Reuters, 2026-10-29).

Nextgov reported on 2026-10-30, citing two people familiar with the matter, that US officials suspect Iran-linked hackers, that the intrusions began around late August, that how the intruders got in is not clear and that the assessment may change (Nextgov, 2026-10-30). No official has attributed the activity on the record, and the sources give no technical evidence for the suspicion. The only stated link between the two cases is the investigators' contact, and Reuters notes that the French attack, like the Fort Huachuca failure, raised temperatures instead of switching units off (Reuters, 2026-10-29).

Sources: CERT-FR (alert CERTFR-2026-ALE-012) · AFP (via Khaleej Times) · BFMTV · Infosecurity Magazine · BleepingComputer · CERT-FR (alert CERTFR-2026-ALE-012, revised version) · NCSC Switzerland (Security Hub advisory 13054) · Cooling Post · Blick · Censys · CERT-FR (alert CERTFR-2026-ALE-012, third version) · Dixell France (Copeland) · Le Monde · SecurityWeek · Cybersecurity Dive · Public Sénat · Le Monde Informatique · Forescout Research (Vedere Labs) · Reuters (republished by Internazionale) · Nextgov · The Guardian · Euronews · Tagesschau (ARD) · CyberInsider · 20 Minuten
NOTABLEupdatedNATOB2

Berlin's state government confirms an extortion attempt after a phishing click opens the shared Landesnetz; media reporting names Rhysida

First published 2026-08-30 · open finding →

Updaterun 2026-11-02T0256Z-intelsourcing_notesourcesevidencebodypriorityconfidenceclassification

rbb24 Recherche reported on 2026-10-21 that the Senate department for urban development's attack-detection licences covered only five percent of devices and that neither the entry endpoint nor the servers the data left from were covered; BSI told rbb24 it does not confirm that the Berlin attack followed the TerminalFix pattern.

rbb24 Recherche reported on 2026-10-21 that the attack-detection system introduced in 2026 had licences for only five percent of all devices, according to the Senate department for urban development, which also said that extending it to every device was not possible "for financial reasons"; rbb's research shows that neither the endpoint identified as the criminals' entry point nor the servers from which data later flowed were covered by it (translated from German) (rbb24, 2026-10-21). Both departments also said that in 2024 the funds needed for IT security were available only in part to the extent required, although the state's information-security guideline has obliged agencies since 2017 to provide enough staff and money (translated from German) (rbb24, 2026-10-21). The stolen data includes a copy of the transport senator's identity card and of her digital signature and, rbb's analysis shows, further identity-card copies and personal documents of employees; the mobility department confirmed to rbb that the data is mostly unstructured files from shared and personal directories (translated from German) (rbb24, 2026-10-21).

BSI told rbb that it had warned repeatedly since at least March 2025 of fake security prompts that make users run a malicious command themselves, publicly and in daily situation reports that also went to representatives of the federal states, and that it described the TerminalFix variant in September 2026; it does not confirm to rbb that the Berlin attack followed that pattern, saying only that it is in close contact with Berlin and supporting the response (translated from German) (rbb24, 2026-10-21). BSI's advisory of 2026-09-04 does not name Berlin (BSI, BITS-2026-287419-1032, 2026-09-04), so the link between TerminalFix and this incident rests on BSI's Mastodon post, which heise reads as confirmation (heise online, 2026-09-07), and not on a BSI statement to rbb that the Berlin attack followed that pattern. rbb describes the chain for such warnings: the Berlin-CERT run by the IT service centre ITDZ passes relevant reports to each agency's information-security officers, and each agency is itself responsible for acting on them; the ITDZ and the Senate Chancellery did not say whether BSI's warnings reached the two departments or what followed (translated from German) (rbb24, 2026-10-21).

Sources: Der Tagesspiegel · heise online · Security Affairs · Berliner Zeitung · rbb24 (Rundfunk Berlin-Brandenburg) · BornCity · CISA / FBI / Multi-State ISAC · BSI (Bundesamt für Sicherheit in der Informationstechnik), BITS-2026-287419-1032, v1.0 · heise online (Nico Ernst) · heise online (Stefan Krempl) · rbb24 Recherche (Rundfunk Berlin-Brandenburg) · BSI (Mastodon post)
NOTABLECVE-2026-109618 +1exploitedupdatedNATOA2

CVE-2026-109618 / CVE-2026-109619, QNAP QTS, QuTS hero and QuTScloud: the PHP2Shell flaws reach the NAS web components before authentication; fixed builds of 2026-10-23, QVR Surveillance, TVR OS and Notes Station 3 now fixed, QNE (ADRA) still unfixed

First published 2026-10-25 · open finding →

Updaterun 2026-11-02T0256Z-intelsummarycvessourcesbody

Synology's advisory now lists fixed PHP 7.4, PHP 8.0, Calendar and Mail Station builds for DSM 7.0 to 7.1 and DSM 6.2 (PHP 7.4, Calendar and Mail Station only on 6.2), added in its revisions of 2026-10-29 and 2026-10-31.

Synology's advisory Synology-SA-26:14 now lists fixed builds for DSM 7.0 to 7.1 and DSM 6.2. Revision 3 of 2026-10-29 adds PHP 7.4 for DSM 6.2, 7.0 and 7.1 and PHP 8.0 for DSM 7.0 and 7.1, and revision 4 of 2026-10-31 adds Calendar and Mail Station for DSM 6.2, 7.0 and 7.1 (Synology, 2026-10-31). The fixed builds are PHP 7.4.33-0122, PHP 8.0.30-0104, Calendar 2.4.8-10948 and Mail Station 30000002.3.19-10333 on DSM 7.0 to 7.1, and PHP 7.4.33-0010, Calendar 2.4.8-0948 and Mail Station 30000002.3.19-0333 on DSM 6.2; the table lists no PHP 8.0 build for DSM 6.2, gives the PHP 8.1 to 8.4 builds without a DSM split and still offers no fix for PHP 7.3 (Synology, 2026-10-31).

Sources: QNAP PSIRT (QSA-26-18, revision V1.1) · QNAP PSIRT (QSA-26-18, affected-products table as of 2026-10-27) · QNAP PSIRT (QSA-26-18, revision V1.2) · QNAP PSIRT (QSA-26-19, QNE (ADRA)) · CISA Known Exploited Vulnerabilities catalog (version 2026.10.26) · QNAP (statement on PHP2Shell) · Synology PSIRT (Synology-SA-26:14) · Synology PSIRT (Synology-SA-26:14, revision 4)

04Action items2 items

Verification & coverage notes1 run

2026-11-02T0256Z-intel · Sonnet 5.5 · window 26 h · 4 entries published

Verification & coverage notes

Quiet window (gap 24.0 h, window 26 h, the Sunday-into-Monday stretch): CISA KEV has no addition after 2026-10-30 (S1 read catalog 2026.10.30 and the mechanical sweep agrees), none of the Swiss, EU or national-CERT records published inside the window, and the yield came from rotational lookbacks and the 72 h developing-window sweep. Coverage window: standard (gap 24.0 h, previous run 2026-11-01T0256Z-intel).

Published. New: the Android telephony "SMS of Death" crash (S3, in window); the Xerox and Fiery PHP2Shell printer estate (S1, recovered after verifier iteration 1 under PD-7 (c): an advisory for a flaw whose exploitation is in-window news, with fixes still unreleased); the Dahua Easy4IP camera takeover (S3, lookback: true from the securityaffairs 168 h record, PD-7 d); NIK C2 (S3, lookback: true from the talos 168 h record, PD-7 d, routine and short). Changelog records: Synology-SA-26:14 revisions 3 and 4 added to the QNAP/Synology PHP2Shell entry (S1); rbb24's report of the Berlin departments' own answers added to the Berlin Landesnetz entry (S4); the US military commissary freezer investigation added to the Danfoss refrigeration entry (S2).

Recency note (PD-7 against PD-11). The Berlin and Danfoss records rest on sources older than 26 h (rbb24 of 2026-10-21, surfaced inside the developing window by Born's relay of 2026-10-30; Reuters of 2026-10-29 and Nextgov of 2026-10-30). I applied the update exemption (a changelog record carrying a delta new to the store inside the 72 h developing window) to those two and held every new entry to the 26 h window, a rotational lookback, or PD-7 (c). Verifier iteration 1 (F10) flagged the dropped Xerox and Fiery bulletin as a blind spot for a public-sector reader; I accepted it and published it under PD-7 (c). The other S1 PHP2Shell vendor estates stay dropped as out-of-window with weaker constituency nexus (Siemens energy, Delta Controls, pfSense and OPNsense): the next audit may recover them.

Source tension. The Berlin entry's sourcing note said BSI "now independently confirms" TerminalFix as the Berlin vector. rbb24 (2026-10-21) says BSI does not confirm that to rbb, and BSI's advisory BITS-2026-287419-1032 never names Berlin; the link rests on heise's reading of BSI's Mastodon post. The sourcing note is corrected in the changelog record; verifier iteration 1 (F16, F17) then led me to move the entry's priority to notable (a 66-day-old single-victim event whose new section adds a governance lesson), confidence to medium and credibility to 2, because the phishing click rests on Der Tagesspiegel alone and the TerminalFix link on heise's reading of BSI.

  • out-of-window: Siemens Spectrum Power, AMIS TS, Energy Engage and KACO blueplanet PHP2Shell (SSA-166980 V1.2), primary source 2026-10-29, window_hours=26; energy-utility nexus only.
  • out-of-window: Delta Controls enteliWEB and V4 controllers (SecB0015 rev 3, SecB0016 rev 2), primary source 2026-10-22 and 2026-10-28, window_hours=26; no Swiss deployment established.
  • out-of-window: pfSense and OPNsense PHP2Shell fixes, primary source 2026-10-21 and 2026-10-22, window_hours=26; GUI is LAN-only by default.
  • out-of-window: Dell PowerProtect Data Domain DSA-2026-416, Juniper Session Smart Router and Conductor JSA112183, TianoCore EDK II CVE-2026-97631, TeamViewer TV-2026-1011, newest sources 2026-10-19 to 2026-10-30, window_hours=26; none exploited.
  • borderline-drop: Canonical LXD, MicroCloud and Incus CVE-2026-112816 (CVSS 10.0 certificate-chain authentication bypass), in window (The Hacker News 2026-11-01) but PD-11 relevance doubt: the HTTPS listener is opt-in, no constituency deployment established, no exploitation; revisit on exploitation or a KEV listing.
  • borderline-drop: Siemens Industrial Edge Management applications, Node2Shell (SSA-443410, 2026-10-30), industrial-edge OT niche, no constituency nexus, no exploitation against Siemens products reported.
  • borderline-drop: CVE-2025-8088 ransomware-use flag on the MDaemon/ClamAV entry, metadata only; CISA's flag is undated and attached to the WinRAR record, and it changes no decision on the covered mail-server path.
  • borderline-drop: BSI tells German MPs and ministers to assume their iPhones are compromised (ARD, heise, 2026-11-01), incident floor: no vector, actor or behavior, no Swiss case; revisit if a Swiss authority or Apple notices reach Swiss officials.
  • borderline-drop: Ukraine's Air Alert app pushing false radiation and chemical alerts (BBC, Fox News, BNO, 2026-11-01), no Swiss nexus, analogy to civil-protection alerting only, no vector.
  • borderline-drop: WIRED's report of a contractor's AI coding agent on a DoD NIPRNet environment (2026-10-29), single anonymous source contested by Accenture, low confidence.
  • borderline-drop: Talos VOLTA infostealer (2026-10-31), a distinct finding from NIK C2 (separate entry under item granularity), commodity crimeware with no sector, actor or vector; the LLM-API egress detection concept is carried by the NIK C2 entry.
  • out-of-window: ARTEX thread delta, Microsoft on DPRK Onyx Sleet and Pearl Sleet using ARTEX (2026-10-29) and CrowdStrike's gated report on four agentic actors (2026-10-30), older than the 72 h developing window, CrowdStrike detail gated; the audit may fold the DPRK sentence into the ARTEX entry.
  • borderline-drop: Swiss municipal forum claims (ChimeraZ selling data attributed to ebikon.ch, gersau.ch, meggen.ch, stadtwil.ch and davos.ch), FBI attribution of the Binance theft to TraderTraitor, Chainalysis breach, Universität Leipzig outage, French communes Cholet and Verrières-en-Forez, Holcim claim, Alpine Linux GitLab attempt, Ruag tank-fraud inquiry, per S4: PD-6 not cleared (single tracker relaying a forum advert, sample looks public), incident floor, not new, or not a cyber incident.
  • Single-source: 2026-11-02/android-sms-of-death-wap-push-telephony-crash; the researcher is the origin; BleepingComputer and Security Affairs restate it; which release carries Google's fix rests on the researcher's word. BleepingComputer's CVE-2026-58882 does not resolve (MITRE CVE API: record does not exist), so cves[] is empty.
  • Single-source: 2026-11-02/dahua-easy4ip-p2p-cloud-camera-takeover-cert-ua; CERT-UA's alert page is script-rendered; verifier iteration 3 read it through the reader and the entry now cites it as primary (its text carries no date, 2026-10-23 is Security Affairs' dating), with The Hacker News, Security Affairs and eSecurity Planet restating it (one assessor, four publishers). Dahua's 2021 advisory read directly for CVSS 8.1 and the per-model fixed builds.
  • Single-source: 2026-11-02/xerox-fiery-php2shell-printers-fixes-due-6-to-23-november, Xerox's own bulletin XRX26-016 (version 4), read through the PDF reader; CISA KEV listing read from the catalog (version 2026.10.30), which covers the PHP runtime and not these devices.
  • Single-source: 2026-11-02/nik-c2-go-implant-sends-prompts-to-openai-from-victim-host, Cisco Talos only; Infosecurity Magazine restates it. S3's suggested link to CAIRN and CLOSEDQUORUM was left out because the Talos post does not state it.
  • Backlog: ARX Group SA (Aurora leak-site claim, row surfaced 2026-10-24), held, state unchanged: S4 re-checked on 2026-11-02 (ransomware.live press: null, no victim statement, no Swiss press in DE, FR, IT or EN, name clash with an unrelated thermal-management company noted); hold condition unmet, expiry 2026-11-07, nothing appended to the row.
  • Candidate sources added: rbb24-recherche, xerox-security-bulletins. Left for a later fire: onyphe-blog, signalandsilence-substack, varonis-threat-labs, delta-controls-security (each flagged by one sub-agent; recipes verified only for varonis and the two Delta and Xerox pages).
  • Recipe changes from sub-agent findings: securityaffairs rss_url pinned (paged feed), resecurity moved to the bridge, notes appended for lumen-black-lotus-labs, cnil-fr, ncsc-nl-php2shell-tracker, ico-uk and ec-digital-strategy-newsroom.
  • Pre-existing history noted, not touched: the Danfoss entry's main analysis (about 1,290 words) and the Berlin entry's (about 710 words) exceed the 550-word bound; this fire's records did not grow either analysis, and trimming them is audit work.

Coverage gaps: ico-uk (every transport 403, host outage as on 2026-11-01); connectwise-trust-center (403 on every transport, status page read, no security item); ox-security (feed parses, every article body 403); databreaches-net (site catching up after its own outage, newest post 2026-10-29); F5 K000163821, Check Point sk1000302, the Fiery Communities article and Juniper's support portal (script-only pages, revision stamps not comparable with covered entries).

Verification: six iterations of the single cti-verification definition, confirmed CLEAN at iterations 5 and 6 (two consecutive independent cold passes, each covering all 155 claims), final residual 0. Iterations 1 to 4 returned NEEDS_FIXES with 9, 5, 3 and 4 truth findings and 7, 1, 2 and 1 editorial findings; iteration 1 produced the Xerox and Fiery entry (F10), a Berlin recalibration (priority notable, confidence medium, credibility 2) and a corrected Berlin sourcing note, and iteration 3 turned CERT-UA's own page into the Dahua entry's primary source. Two iterations (4 and the Triage hedge before it) caught defects my own fixes introduced. Declined: the Danfoss update-versus-new suggestion (the section states the only stated link to the US commissary case is the investigators' contact; regions and sectors untouched) and the Dahua carve-out host remark (cip.gov.ua is now in NATIONAL_CERT_HOSTS, with the tool tests passing). Left as pre-existing: em dashes and a few "this entry" cross-references in the older Berlin sections, and Berlin's T1567.002 (BSI's TerminalFix-general sentence); the next audit may take them.