Verification & coverage notes
Coverage window: standard (gap 24.0 h, previous run 2026-11-02T0256Z-intel; window 26 h). No new entry this fire: the window's yield was developments on covered findings, so the eight records below are changelog records and nothing is a second entry for a finding. CISA KEV has no addition after 2026-10-30 (mechanical sweep and S1 agree), and no covered CVE flipped its ransomware flag.
Changelog records (8: 6 update, 2 improvement). update: the refrigeration-controller attacks of 2026-11-02 on the Danfoss entry (S1 to S4 all returned it; Coop Switzerland reports failed attempts, the vendor of the new wave is unconfirmed); C3RB3R ransomware on the Synology DSM entry (vendor-confirmed exploitation, exploited CVE contested between SA-24:20 and SA-26:13, so verification: contradicted and no CVE marked exploited); VulnCheck's canary catching exploitation of CVE-2026-58115 on the SIMATIC IoT2050 entry (one source); Fortinet's FG-IR-26-188 investigation list, AWS per-service status and CloudLinux's failed reproduction on the Linux TCP use-after-free entry; the WordPress route to the Brotli decoder on the Node2Shell entry (crash only, libbrotli package is the fix); Trend Micro Web Security in the cloud fixed, the TWS Authentication Agent newly impacted and NetApp's ONTAP hotfix builds 9.12.1P20HF1 and 9.13.1P21HF1 on the PHP2Shell management-server entry (a fresh patch, so an update rather than an improvement after verifier iteration 2). improvement (no float): four missing critical CVEs and NCSC.ch's chain on the WS_FTP entry (the bulletin is unchanged, so an incomplete entry rather than a development); the police non-confirmation and the directorate's "internal matter" on the Vaud school entry. Main analyses were rewritten in place: Danfoss from 1,281 to 692 words (still over the 550 bound, but shrunk), SIMATIC, kernel, Synology and Brotli within it.
Source tension. S1 listed C3RB3R as a new finding because the store-wide CVE index check missed the 2026-09-22 Synology entry (outside the 14-day in-context window); S4 caught it and the gate would have FAILed a new entry sharing CVE-2026-13684. WS_FTP: the entry's three CVEs came from EUVD records and NCSC.ch lists six critical flaws of fifteen; four of them need privileges (a delegated Host Administrator for three, a low-privileged account for CVE-2026-90868 per Progress's CNA records, read through the CVE record API for verification only and cited through GitHub's advisory pages).
- borderline-drop: German federal-government Apple threat notifications (BSI "assume compromise"), incident floor: no vector, actor or behavior is public and no ATT&CK id is supportable.
- borderline-drop: Kaspersky CyberStrikeAI (LLM-orchestrated C2 against education victims in Africa and Latin America), Kaspersky itself says classic correlation rules suffice, no in-nexus victim, no actor.
- borderline-drop: Contact Form 7 6.2 to 6.2.3 file upload, conditional on a file field plus public directory listing, no CVE, no exploitation, so not an out-of-band case.
- borderline-drop: Langflow OSS CVE-2026-93680 and CVE-2026-110186 (9.8), no exploitation, the Metasploit module covers the bypass only, no constituency deployment; same shape as the struck IBM MQ and Langflow row.
- borderline-drop: DJ-Classifieds below 3.11.3 and Custom Tables for Joomla below 3.7.8, registration-dependent or content-hosting only, niche extensions, no exploitation.
- borderline-drop: GitLab Shadowserver exposure counts, one relayed post, exposure only, the entry is already high.
- borderline-drop: Northflank control-plane breach, vendor-confirmed but no Swiss or public-sector nexus, customers of the platform only.
- borderline-drop: Ukraine and Russia air-raid warning apps hacked; Bundestag Left Party mail-bombing; GTIG LLMJacking; GTIG XCPE botnet; Group-IB MadApe; HMICFRS inspection, no in-nexus victim or transferable decision, or already covered by three device-code entries.
- borderline-drop: Holcim (emperador listing), SALEG, Ined, ECOM, SunTechnics, fzmb, deom.be, leak-site claims with no confirmation (PD-6); German, French and Belgian municipal incidents (OSL, Eichstaett, Cham, Cholet, Verrieres-en-Forez, ITM Antwerp), stale, no vector or actor; Swiss Basketball, private federation; WIRED Pentagon story, US-only, outside the window.
- borderline-drop: LXD CVE-2026-112816 (10.0), TeamViewer CVE-2026-111585, TightVNC viewer, BSI Flowise, Linksys, Traefik, Gitea and Collabora rows, QNAP QuMagie and QNE ADRA rows, non-default configuration, client-side, or unexploited and below the bar.
Backlog. ARX Group SA (held to 2026-11-07): S4 re-searched in German, French, Italian and English and the hold condition is still unmet (Ransomware.live press field null, no ARX, SBB, ASTRA or Swiss press statement), so the row stays open to its expiry with no note. Added a hold row for ChimeraZ's forum-sale claims against four Bernese and Zurich commune sites, Davos and a Belgian rescue zone (single C-grade relay that itself says no intrusion is confirmed), expiry 2026-11-17.
Allocation. 88 standard and candidate records were excluded by the previous two fires' attempts; the breaches pool (22 records) was swept in full yesterday, so S4 took the oldest 14 on the rotation cursor with no exclusion rather than starve. Both rotation-priority records of S1 (connectwise-trust-center, resecurity), S2 (ec-digital-strategy-newsroom, golem-security) and S3 (ox-security) were attempted. Two candidates added (aws-security-bulletins, tagesschau); recipe notes appended for eleven sources (sentinellabs now pinned to its feed).
Operator notes. The extract rung served the ENISA EUVD single-page app through the metered jina reader during a probe of the four missing WS_FTP CVEs (eight reader calls, no result); GitHub advisory pages through WebFetch and the CVE record API were the working routes, and the probe was not repeated. extract also returned metadata only for the Akamai kernel post (read through WebFetch). The Progress WS_FTP bulletin is a JavaScript-only Salesforce page that no transport reads, so NCSC.ch and heise stand in for it.
Coverage gaps: ico-uk (403 on every transport, third run); connectwise-trust-center (403, status page read); ox-security (article bodies 403); golem-security (cookie-walled bodies, feed titles only); apa-ots (feed holds about 3 h, 145 h lookback impossible); cyberattaque-org (feed spans about 14 h); community.progress.com (WS_FTP vendor bulletin unreadable); resecurity (blog dormant since 2026-09-11)
Verification outcome. Six iterations: 1 to 4 NEEDS_FIXES (truth and editorial findings shrank from 14 to 4, every one remediated or declined with a reason above), iterations 5 and 6 two consecutive CLEAN verdicts from independent cold passes (216 of 216 claims each, truth 0, editorial 0), so the publish gate is a confirmed CLEAN and verification_residual_count is 0. Advisory items left for the quality audit, none blocking: the Danfoss main analysis runs about 690 to 740 words against the 550 bound (down from 1,281); the Vaud analysis keeps three sentences for a routine incident; the Synology ransomware extension and ransom-note file names stay as behavioural artefacts; the Brotli entry's carried sourcing_note says the Node.js advisory names no fixed versions although its download list names v22.23.4, v24.22.1 and v26.12.1 (correct through a changelog record); the WS_FTP and Vaud sourcing_notes carry fetch-pipeline and first-hand wording; the C3RB3R registry summary states BleepingComputer's name-borrowing reading in the registry's own voice; the kernel entry's NCSC-NL attribution gives one of its two reasons; the WS_FTP record could be typed update.