6 verified findings from 1 run · 2 updates to prior coverage · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01Entra app-credential abuse: agents hunt GitHub for secrets, an operator reaches MSP clients, government among them. Microsoft reports that since August threat actors have used the agentic framework ARTEX to query public GitHub for OAuth application secrets and cloud keys, and that from 2026-10-28 valid application credentials were used for service-principal sign-ins across dozens of applications in several tenants, a vendor-owned multitenant application among them. Todyl's telemetry shows one operator since 2026-11-01 targeting about 45 application registrations at MSPs, more than 33 of which authenticated, and reaching 27 organisations, government clients among them; Microsoft says a similar campaign involving the same addresses was reported by Todyl, while Todyl does not tie its case to ARTEX and cannot say where the secrets came from. →
02Qilin's October build spreads through vCenter and ESXi, reboots into Safe Mode and prints notes on office printers. Seqrite compares a March 2026 and an October 2026 Qilin (Agenda) sample and reports that the newer build embeds a PowerShell engine that logs in to vCenter, disables HA and DRS and pushes Linux payloads to ESXi hosts over SSH, shuts down the processes that lock files through the Windows Restart Manager instead of brute-force termination, sets a Safe Mode reboot so EDR drivers do not load, and sends ransom notes to TCP 9100 on local subnets. It is a vendor analysis of two samples with no incident confirmation. →
03Microsoft Q3 email report: overrides let authentication-failing spoofed mail through; SVG CAPTCHA phishing returns. Microsoft's Q3 2026 email-threat report finds that many malicious messages spoofing the sender domains of business services were delivered despite failing authentication because tenant- or user-level overrides applied, 63% of the messages with a recorded security outcome in September. It also reports SVG attachments leading CAPTCHA-gated phishing at quarter end, Teams impersonators shifting from help-desk display names to ordinary personal names, and an August device-code phishing campaign that used a QR code in a Word document against legal organisations. →
Microsoft reports that since August 2026 threat actors have used the agentic offensive framework ARTEX to submit large volumes of queries to public GitHub for secrets (Microsoft Threat Intelligence, 2026-11-05). As early as 2026-10-28 it saw successful service-principal sign-ins from two IP addresses, one a Tor exit node that may carry unrelated activity, across dozens of applications in several tenants, including a vendor-owned multitenant application whose credential was compromised at the source and used to reach multiple downstream tenants (Microsoft Threat Intelligence, 2026-11-05). Microsoft states that a similar campaign involving the same addresses was also reported by Todyl (Microsoft Threat Intelligence, 2026-11-05).
Todyl, from its managed-detection telemetry, describes one operator who since 2026-11-01 has signed in to MSPs' Microsoft 365 and Azure environments as their own applications with stolen credentials that are still valid: about 45 app registrations at roughly 18 organisations were targeted, more than 33 authenticated, and 27 organisations were reached, among them the MSPs' downstream clients in government (Todyl, 2026-11-03). For nearly every credential the operator requests an Azure Resource Manager token, then a Key Vault token, and within minutes applications that had never been used start authenticating; MSP multitenant and delegated-admin apps and Partner Center tokens reach client tenants, one app sweeping 15 client tenants in about 10-second loops (Todyl, 2026-11-03). Todyl says no Microsoft vulnerability is involved, that it saw no persistence and does not know how the credentials were obtained, and that several seed secrets had only ever been used from staff devices and office networks, which points to a file store or live backend rather than configurations crawled from the internet (Todyl, 2026-11-03). After its detections fired on 2026-11-03 the operator switched to spoofed browser user agents and replayed users' refresh tokens, all blocked by Conditional Access (Todyl, 2026-11-03).
Triage: the invalid-secret and expired-secret errors alone only show that someone holds an old or wrong credential for the app; Microsoft treats a failure followed by a success as the urgent case (Microsoft Threat Intelligence, 2026-11-05).
Starting in August 2026, Microsoft observed threat actors using an agentic AI offensive framework to submit large volumes of queries to GitHub for secrets.
Sign-in errors AADSTS7000215 (invalid secret) or AADSTS7000222 (expired secret) indicate someone holds a credential for your app; a failure followed by a success is urgent.
Through those apps the actor has reached 27 organizations so far, including the MSPs' downstream clients in government, energy, food and agriculture, transportation, construction and engineering, legal, education and nonprofits.
We have not tied the activity to a specific agentic workflow or offensive framework, and our telemetry does not show an AI model directing it, so we hold that possibility at low confidence.
Seqrite's reverse engineering of a March 2026 and an October 2026 Qilin (Agenda) sample finds that the Rust code was reworked into a modular workspace of 22 internal crates, that the command line grew from 6 to 42 switches, and that the October build carries subsystems the baseline lacked (Seqrite Labs, 2026-11-03). It uses the Windows Restart Manager API to shut down the processes that lock SQL Server, Exchange and virtual-machine disk files, instead of the brute-force process termination of the March sample, so that the files can be encrypted (Seqrite Labs, 2026-11-03). An embedded PowerShell engine, started with --spread-vcenter, authenticates to vCenter, disables HA and DRS, extracts the ESXi host addresses, opens SSH and SCP sessions, uploads Linux ransomware payloads to /tmp on the hosts and runs esxcli to power off virtual machines and encrypt .vmdk volumes (Seqrite Labs, 2026-11-03).
The build also installs the RSAT Active Directory module itself with DISM before enumerating computers, embeds 32-bit and 64-bit PsExec to spread over the ADMIN$ and C$ shares with harvested credentials, and sets a Safe Mode boot with bcdedit plus an AutoAdminLogon registry value so that it reboots into Safe Mode, where EDR drivers do not load (Seqrite Labs, 2026-11-03). A raw-printing module scans local subnets for TCP port 9100 and sends cleartext ransom notes to office printers, and the October binary masquerades as resmon.exe with a forged Microsoft code-signing overlay (Seqrite Labs, 2026-11-03). Seqrite lists healthcare, manufacturing, education and technology as the victim sectors in its telemetry (Seqrite Labs, 2026-11-03).
Triage: the Restart Manager and a DISM-installed RSAT component are normal in patching and administration, so each is weak alone; the combination with the print fan-out, the Safe Mode change and the vCenter actions is the signal.
the evolved binary contains a modular 20.8 KB PowerShell automation suite (–spread-vcenter). It authenticates to VMware vCenter servers, disables High Availability (HA) and Distributed Resource Scheduler (DRS), extracts ESXi hypervisor IP addresses, and establishes SSH/SCP sessions.
Detection of both Qilin strains is possible using static and behavior-based signatures, such as bcdedit Safe Mode modification and rstrtmgr.dll process termination.
Kaspersky's retrospective analysis of a December intrusion at a customer's on-premises SharePoint server found activity consistent with Storm-2603, with the access and control layer held entirely inside the IIS worker process w3wp.exe and nothing written to disk (Kaspersky, 2026-11-05). On December 20 a single request to a SharePoint administrative endpoint tied to the ToolPane component fingerprinted the host for ToolShell (CVE-2025-53770); the full exploit chain ran on December 24 against the same endpoint, and the gap kept the probe from being correlated with it (Kaspersky, 2026-11-05). The payload was loaded into the ASP.NET runtime and lost when the application pool recycled or IIS restarted (Kaspersky, 2026-11-05).
The memory shell registers a custom VirtualPathProvider through a non-public method of the ASP.NET HostingEnvironment class, subverts trust controls so that the registration works even in a precompiled application, intercepts requests at the GetCacheKey() hook and stays dormant unless a specific User-Agent header arrives (Kaspersky, 2026-11-05). It speaks a custom XOR-obfuscated binary protocol, and the open-source suo5 tool proxies traffic so connections from the command server reach arbitrary hosts inside the network through the SharePoint server (Kaspersky, 2026-11-05). It reaches SYSTEM by named-pipe token impersonation adapted from EfsPotato and creates administrative accounts through native SAM RPC calls (Kaspersky, 2026-11-05).
Shortly after the injection w3wp.exe started msiexec.exe to install a remote MSI that was Velociraptor 0.73.4.0, vulnerable to CVE-2025-6264, which the actor used for persistence, discovery, data collection and payload execution and to deploy Zoho Assist unattended access, a VS Code CLI tunnel, Cloudflare Tunnel and a reverse proxy, so access no longer depended on the IIS process (Kaspersky, 2026-11-05). The actor then uploaded a vulnerable driver that is used to terminate EDR products and sideloaded a DLL that Kaspersky identified as Warlock ransomware's AV killer, possibly meant to use that driver; Kaspersky's endpoint product blocked the ransomware process (Kaspersky, 2026-11-05).
Triage: App_Web_* assemblies come from ordinary ASP.NET page compilation and Microsoft.GeneratedCode from legitimate XmlSerializer use, so neither is a signal alone; the signal is the pair in one application domain right after a ToolPane request, and any VirtualPathProvider that is not on the application's inventory (Kaspersky, 2026-11-05). The December 20 probe came from infrastructure associated with ONYPHE, an attack-surface discovery platform whose vulnerability checks use non-intrusive probes, so a probe alone looks like a benign scanner; Kaspersky's retrospective analysis established the probe as the initial phase of the intrusion that followed on the same endpoint (Kaspersky, 2026-11-05).
This activity involved the attacker using the IIS worker process as an in-memory bridge to the customer’s infrastructure, keeping the access and control layer entirely within w3wp.exe without writing anything to disk.
Consequently, the presence of positive events 25 and 47 combined with the absence of the expected events 17, 18, 19, and 21 for the same path forms a reliable detection pattern
this allows us to attribute this case to Storm-2603 with moderate confidence.
SignalWire's advisory GHSA-mg63-h38w-8p9p describes CVE-2026-116779: FreeSWITCH's sofia_presence_handle_sip_i_message() splits the To user of an inbound SIP MESSAGE on + and treats the left half as a chat proto name, the mod_dptools module registers an api chat interface that hands its address to switch_api_execute(), and a peer that can deliver a MESSAGE to a profile therefore selects which FreeSWITCH API command the server runs (SignalWire, 2026-10-28). The impact is command execution with the privileges of the FreeSWITCH process, including arbitrary operating-system commands, disclosure of configuration and credentials and full call control, and where mod_lua is loaded, as the stock configuration does, inline Lua is a second route (SignalWire, 2026-10-28). The advisory scores it CVSS 3.1 9.8, lists 1.11.2 and earlier as affected and 1.11.3 as patched, and states that exploitation of this path has been observed in the wild without naming an actor or a victim (SignalWire, 2026-10-28). BSI CERT-Bund rated its advisory on the flaw critical and lists versions before 1.11.3 as affected (BSI CERT-Bund, 2026-11-05).
The default posture is exposed: chat handling is on unless a profile sets enable-chat=false, the stock vanilla configuration leaves it on for the internal and external profiles, and the inbound ACL does not cover MESSAGE; where MESSAGE authentication is enforced (the default from 1.10.7) any one account on the profile is enough, and installations that still carry the sample directory user default, which has no password, need no account of their own (SignalWire, 2026-10-28). The fix is a per-profile enable-chat-api-proto parameter that is off unless set, so the route is closed by default and a MESSAGE that selects the proto is answered with 403 and logged with the source and the requested command (SignalWire, 2026-10-28). auth-messages alone does not close the path, and disable_system_api_commands=true removes the system API but leaves the route to every other registered API, module loading and call origination included (SignalWire, 2026-10-28).
Exploitation of this path has been observed in the wild.
A peer that can deliver a MESSAGE to a profile therefore selects which FreeSWITCH API command the server runs.
Portable OpenSSH 10.6p2 carries what its release notes call a critical security workaround for Linux systems that use the musl libc with PAM disabled (OpenSSH, 2026-11-05). NCSC Switzerland says remote, unauthenticated attackers can bypass SSH password authentication over the network and gain access, and rated the exploitation status unknown (NCSC Switzerland, 2026-11-05). OX Security explains the mechanism: musl's crypt() refuses inputs over 256 bytes and returns the string * when it fails, * is also what /etc/shadow holds for an account with no valid password, and OpenSSH, whose 2016 user-enumeration countermeasure can hash a password with settings taken from another account, reads the two matching values as a successful login (OX Security, 2026-11-05). OX gives the conditions: sshd on musl without PAM (Alpine's openssh-server by default), password logins enabled, an account whose password field is * (key-only users, LDAP users, root on Alpine) and at least one other account on the host with a real password; accounts that hold !, glibc systems, PAM setups, Dropbear and OpenBSD are not affected, and OX scores the flaw CVSS 3.1 8.1 (OX Security, 2026-11-05). On Alpine's official AWS and Azure images the passwordless account is the default alpine user, which can run doas without a password, so the bypass chains to root (OX Security, 2026-11-05); Alpine says those tiny-cloud images are safe on first boot and exploitable once any $6$ hash exists, and that cloud-init images, which write PasswordAuthentication no, are not affected (Alpine Linux, 2026-11-05).
The OpenSSH developers do not consider the root cause to lie in OpenSSH (heise online, 2026-11-05), and NCSC Switzerland adds that other software with similar authentication paths may be affected (NCSC Switzerland, 2026-11-05). Alpine pushed the fix to every branch back to 3.16 (OX Security, 2026-11-05); on release day other distributions and many OpenSSH download servers still offered 10.6p1 (heise online, 2026-11-05).
Triage: an accepted password login is normal for an account with a real hash; the same event for an account whose password field is * has no benign explanation, because such an account cannot match any password.
Successful exploitation allows remote, unauthenticated attackers to bypass SSH password authentication over the network and gain unauthorized system access.
NCSC Switzerland
This release contains a critical security workaround that affects
OpenSSH project
The vulnerability allows an attacker to authenticate to certain password-disabled accounts using an arbitrary password between 257 and 1,024 bytes long.
Previdian sensor observations are exploitation attempts targeting this vulnerability. They do not show that the target was vulnerable or that the attempt succeeded.
Previdian's page for CVE-2026-123158, as read on 2026-11-07, says its sensors observed 15 exploitation attempts from 10 addresses in 8 countries, first on 2026-11-06 and last on 2026-11-07, a live counter, and that these observations do not show that a target was vulnerable or that an attempt succeeded, and its timeline lists public proof-of-concept code from 2026-11-05 17:30 UTC (Previdian, 2026-11-07). The Hacker News, quoting a statement from Previdian's chief executive, reports that Previdian confirmed successful root access on a honeypot running Alpine Linux and OpenSSH, where the attacker used oversized passwords to bypass authentication and ran the reconnaissance commands id, uname and hostname in non-interactive SSH sessions, and that the first attempt came less than nine hours after the CVE was published (The Hacker News, 2026-11-06); the honeypot detail is not on Previdian's page, and the article's own total, eight attempts from one address geolocated to Japan, differs from the page's totals. Previdian's page lists the flaw as not in CISA's catalog (Previdian, 2026-11-07).
Alpine's advisory adds that updating the package does not restart a running sshd, so sshd must be restarted, and that on exposed machines the administrator should review doas use and recently created users, files and authorized keys, treating the machine as compromised if a login cannot be ruled out (Alpine Linux, 2026-11-05). No vendor or authority source reports attacks on production systems.
Microsoft Threat Intelligence's report on Q3 2026 draws four points that matter to a Microsoft 365 defender (Microsoft Threat Intelligence, 2026-11-05). First, malicious messages that spoof the sender domains of business services, such as document-signing and survey platforms, were often delivered because tenant- or user-level overrides applied, even after the messages failed email authentication and were identified as malicious: in September overrides applied to 63% of messages with a recorded security outcome, most of them tenant-level (Microsoft Threat Intelligence, 2026-11-05). Microsoft says the figures do not show that recipients opened the messages and that an overly broad exception made for a legitimate workflow can weaken protection against messages impersonating it (Microsoft Threat Intelligence, 2026-11-05).
Second, CAPTCHA-gated phishing recovered while QR-code phishing kept falling, with SVG attachments central to the recovery: they carried 65% of CAPTCHA-gated attacks in August and 49% in September (Microsoft Threat Intelligence, 2026-11-05). Third, in Teams, ordinary personal-name display names rose from 46% of the observed July sample to 88% in September while explicit help-desk identities fell from 17% to 2%; Microsoft notes a personal name can accompany a help-desk claim while the account address keeps technical wording, and that more targeted attempts used domains resembling the victim organisation's (Microsoft Threat Intelligence, 2026-11-05). Fourth, an August campaign against legal organisations sent a Word document with a personalised QR code that led to a device-code phishing page and the genuine Microsoft device sign-in portal; completing the sign-in would have transferred a valid session token that gave persistent access without exposing the password or re-triggering MFA (Microsoft Threat Intelligence, 2026-11-05).
In September, overrides applied to 63% of messages with a recorded security outcome, with tenant-level overrides accounting for most of them.
The figures do not establish that recipients opened the messages or that accounts were compromised.
SRF reported on 2026-11-05 the first publicly known cases of the refrigeration attacks in Switzerland, a butcher in Köniz whose freezer reached 50 to 70 degrees and three Volg stores with changed cooling parameters; BACS has received one reportable notification about an attack on commercial refrigeration, and CISA, FBI, HHS, USDA and DOT published a joint fact sheet on refrigeration and cold-chain controllers that names no vendor, CVE or actor. No source names the controller make or the access route in the Swiss cases.
SRF reported on 2026-11-05 the first publicly known attack of this kind in Switzerland: the butcher Lüthis Fleischwaren in Köniz, canton Bern, told customers that manipulation of the electronic control of its cooling and freezer systems caused considerable temperature deviations, the owner told SRF he found 50 to 70 degrees in the freezer, and the firm disconnected the installation from the network and closed the branch (translated from German) (SRF, 2026-11-05). Keystone-SDA adds that the shop can probably only reopen on 20 November and that the Bern cantonal police were briefly informed on Monday and had received no complaint yet (Keystone-SDA via swissinfo.ch, 2026-11-05). Volg says three of its stores noticed that parameters in the cooling shelves had been changed (SRF, 2026-11-05). No source names the controller make, the access route or a maintenance provider in the Swiss cases; Keystone-SDA notes that operators can supervise cooling plants centrally over the internet and that the butcher apparently has such an installation, which is the agency's inference and not the owner's statement (Keystone-SDA via swissinfo.ch, 2026-11-05). BACS told Keystone-SDA that it does not comment on specific incidents and has received one reportable notification about a cyberattack on commercial refrigeration so far, and it stressed that voluntary reports are welcome at any time (Keystone-SDA via swissinfo.ch, 2026-11-05). Blutspende SRK Schweiz told Keystone-SDA that no attacks on Swiss blood-donation services are known to date (SRF, 2026-11-05).
On the same day CISA, the FBI, HHS, USDA and DOT published a joint fact sheet on malicious cyber activity against industrial refrigeration and cold-chain monitoring systems worldwide: the actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, through authentication bypass, arbitrary code injection or weak configurations, with loss of visibility into current temperatures as a further effect (CISA, 2026-11-05). It names no vendor, CVE, victim or actor; its mitigations include keeping controller panels off the internet, allowlisting the devices and IP addresses that may change settings, defining reasonable setpoint limits for downstream devices with alerting on deviations, and collecting network traffic between OT assets where logs are not available (CISA, 2026-11-05).
watchTowr Labs published the full chain on 2026-11-05 and a detection tool: one unauthenticated request to the Email Security Gateway's login handler reaches the backup-restore function, a secret that is hard-coded in the product lets an attacker build a valid archive, and the restored timezone value reaches the root command injection, so exploitation needs no account; Barracuda changed its own advisory the same day to say authentication is not required for CVE-2026-116606. No source reports attacks.
watchTowr Labs published the full chain on 2026-11-05 after comparing firmware 9.4.0.027 with 9.4.0.029 (watchTowr Labs, 2026-11-05). In the login handler a failed password-change attempt returns the login-screen role instead of ending the request, so one unauthenticated POST to /cgi-mod/index.cgi that submits mismatching new and retyped passwords with a backup upload reaches the backup-restore function (watchTowr Labs, 2026-11-05). The restore accepts a backup whose checksum matches, and the checksum is built from the file bytes and a secret that is hard-coded in the product, so an attacker can build a valid archive (watchTowr Labs, 2026-11-05). A restored system_timezone value then reaches an unescaped shell call that runs as root (watchTowr Labs, 2026-11-05). watchTowr shares a Detection Artefact Generator so that owners can test their own appliances, and its post does not claim exploitation in the wild (watchTowr Labs, 2026-11-05). Its README describes a tool that takes a target URL and a command, builds a backup, uploads it to the target and attempts to check whether the target is vulnerable (watchTowr Labs README, 2026-11-03).
Barracuda changed its advisory the same day, 2026-11-05 at 2:30pm EST: the Authentication Required field for CVE-2026-116606 now reads No (Administrative UI Access Required), and the advisory says authentication is not required to exploit it but the administrative user interface must be accessible to the attacker (Barracuda, 2026-11-05). The advisory's entry for CVE-2026-111560 still reads Yes (Administrative Access) (Barracuda, 2026-11-05).
In every Entra tenant you run or manage for others, list the app registrations that hold client secrets, starting with multitenant, delegated-admin (GDAP) and Partner Center apps, security-tool integration apps and Azure DevOps service connections, and search the service-principal and non-interactive sign-in logs for the invalid-secret or expired-secret errors AADSTS7000215 and AADSTS7000222 followed by a success for the same app; on any hit remove all client secrets, certificates and federated credentials on that app, including ones you did not add, disable its service principal if needed and rotate everything stored in any Key Vault it could read, because issued tokens stay valid until they expire.
Restrict the administrative interface of every Barracuda Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway to trusted internal networks now, update every Email Security Gateway to firmware 9.4.0.029 or later, the build Barracuda names (the CVE record lists builds before 9.4.0.030 as affected), and apply Barracuda's patch to each of the other products (BNADC-16586 for the Load Balancer ADC and the Web Application Firewall, BNMA-32468, BNWF-60060, BNYF-24789), confirming that automatic patching is on.
On every Email Security Gateway whose interface was reachable before the patch, check its configuration for a restore nobody made and its timezone setting for anything other than a timezone name, because watchTowr's single unauthenticated request can reach both.
Upgrade every FreeSWITCH to 1.11.3, or until then set enable-chat=false on every SIP profile that does not need inbound SIP chat and remove directory users that have no password; on an instance that SIP peers could reach, rotate the SIP trunk and directory credentials stored in its configuration, because the advisory lists disclosure of configuration and credentials as an impact and says exploitation has been observed.
On every musl-based Linux host that runs sshd (Alpine, OpenWrt, Buildroot, Yocto), install OpenSSH 10.6p2 or the distribution's fixed openssh package and restart sshd, because updating the package does not replace the running server, and rebuild container and cloud images from a fixed base; until then set PasswordAuthentication no in sshd_config and restart sshd.
2026-11-06T0255Z-intel· Sonnet 5.5 · window 26 h · 6 entries published
Verification & coverage notes
Coverage window: standard, 26 h (previous intel run 2026-11-05T0255Z-intel, gap 24.0 h); no outage backfill. Source rotation ranked on the cursor; the previous two fires' attempts excluded 108 standard records in total (24 for S1, 25 for S2, 40 for S3, 19 for S4). The exclusion was relaxed for S4 because 19 of the 21 breach-domain sources had been attempted by those fires (10 of its 12 slice records came from the excluded set), and sygnia, the oldest cursor in S3's pool and a failed fetch on 2026-11-04, was added to S3's slice explicitly.
The 14-day coverage index (90 records: the first 18 in full, the rest as id, title, summary and last development per record, because the full file overflows one Read) and the state digest were read; the entity registry was grepped by key and alias, not read whole. S5 intake: no closed-source drops (intel/ holds only its README).
Backlog: ARX Group SA stays held (S4 re-checked: ransomware.live still shows the Aurora claim with no press link, German, French and English searches and the Swiss feeds carry nothing; expiry 2026-11-07 unchanged, so the next fire strikes the row unless a confirmation appears). ChimeraZ stays held (no commune, canton, zone or Swiss press confirmation; the FrenchBreaches alert is unchanged; expiry 2026-11-17 unchanged). Neither row changed state, so nothing is appended to them.
KEV sweep (work/2026-11-06T0255Z-intel/kev-window.txt): no addition in the window. S1 confirmed the feed is live (catalog 2026.11.04, newest dateAdded 2026-11-04, CVE-2024-27834, already covered) and the CISA alerts listing shows no 2026-11-05 alert, and found no ransomware-flag flip for a covered CVE.
Scheduled releases: none of Microsoft, Fortinet, SAP, Adobe or Oracle landed in the window (next cycle 2026-11-10). S1 also checked Chrome 157, the Cisco trio of 2026-11-04, the MSRC revised-CVE list and Firefox 159.0.1: nothing exploited or at CVSS 9.0 and above. Revised advisories checked without a record: Xerox XRX26-016 (still revision 5 of 2026-11-03, fixes due 2026-11-06), Cisco ESA revision 1.2, Ivanti, Zyxel, SonicWall SMA1000, Citrix XenServer, WatchGuard, Trend Micro KA-0024802 and Ubuntu's tracker for CVE-2026-98432.
Published: six new entries (OpenSSH CVE-2026-123158; FreeSWITCH CVE-2026-116779; Kaspersky's Storm-2603 fileless SharePoint intrusion; the Entra application-credential campaign from Microsoft and Todyl; Microsoft's Q3 email report; Seqrite's Qilin October build) and two changelog records (Barracuda ESG, priority notable to high after watchTowr's public unauthenticated chain; the refrigeration incident, first Swiss cases and the joint CISA, FBI, HHS, USDA and DOT fact sheet).
Single-source: FreeSWITCH CVE-2026-116779 rests on the vendor advisory alone for the exploitation claim, the score and the affected range (BSI relays it); the GHSA page dates itself 2026-10-28 and BSI relayed it on 2026-11-05 (BSI's CSAF dates its release 2026-11-04T23:00Z, 1 h 55 min before this window opens, while the portal carried it on 2026-11-05); the store had never covered it, so it ships on the in-window relay with event_date 2026-10-28. The Kaspersky Storm-2603 entry, the Qilin entry and the Microsoft Q3 report are single-source by nature (their publishers alone).
Merged item: Todyl's campaign (S4-2, dated 2026-11-03, about 26 hours before the window opens) and S3-1's Microsoft report on ARTEX secret hunting (2026-11-05) were published as one new entry anchored on Microsoft's in-window post, with Todyl as corroboration and references to the ARTEX and ConnectWise entries; Todyl treats its operator as separate and unattributed, so an update on the ARTEX entry would have mis-stated the link. The S1, S2 and S4 refrigeration items were folded into one update record.
Contradiction: Microsoft and Todyl differ on where the stolen application secrets came from (GitHub search against Todyl's seed secrets that point to a file store or live backend); the entry carries both with attribution. The Barracuda record's earlier "administrative interface" framing is superseded by watchTowr's reproduction (no account needed); Barracuda itself changed CVE-2026-116606's authentication field to not required on 2026-11-05, and CVE-2026-111560 stays admin-required.
Included with a stated gate: the Microsoft Q3 email report clears PD-11(a) on the override audit (precedent: the Q2 entry); the Qilin entry clears PD-11(d) on vCenter and Safe Mode hunt hooks, with a rotational-lookback sighting (Seqrite, 2026-11-03, seqrite-labs slice) rather than an in-window one.
borderline-drop: S1-3/S3-9 APT CVE-2026-109518: needs an on-path attacker or a malicious mirror, no exploitation, normal patch cycle
borderline-drop: S1-4 Apache OFBiz 24.09.08 (46 CVEs, three unauthenticated RCEs): no scores, no exploitation, no Swiss public-sector exposure shown; a flagged lead for the audit
borderline-drop: S1-5 zlib 1.4 memory-safety fixes: library awareness, no exploitation
borderline-drop: S1-8 WordPress core exploit-attempt volume (Wordfence): volume only, no material delta on the covered entry
borderline-drop: S1-9 Android Security Bulletin November 2026 (CVE-2026-58868): monthly cycle, NCSC-NL says no exploitation known
borderline-drop: S2-2 EFK audit of the BACS reporting platform: oversight report, no change to reporting obligations or to what defenders do
borderline-drop: S2-4 DHS FASCSA order on Acronis: US procurement measure, no vulnerability, compromise or Swiss obligation, dated 2026-10-30
borderline-drop: S2-5 Federal Supreme Court ruling on prosecutor-ordered DNS blocking: legal-procedure item, no defender decision
borderline-drop: S3-2 trojanised ARTEX Docker image (Badbyte, The Hacker News repeats it): single-source, an offensive-tool image, marginal to this constituency
borderline-drop: S3-5 CrowdStrike PoC-to-exploitation timeline: vendor statistics and a rehash of the covered CrowdStrike hunting-report entry
borderline-drop: S3-6 Microsoft on-premises security initiative: a roadmap with future-dated plans, no vulnerability or campaign
borderline-drop: S3-7 Symantec Anubis and Backdoor.Lindnor: US victim, no vector, no constituency nexus (the hunt hooks do not outweigh the incident floor)
borderline-drop: S3-10 Imperva PSK Agent on StyleSmuggler: third operator on a covered flaw, improvement-level, no new defender decision
borderline-drop: S3-11 residential proxy exits on government networks (Layer3 Intel, Krebs): awareness item with a weak ATT&CK mapping
borderline-drop: S3-12 CERT-AGID MCP-triggered LoRA backdoor: laboratory proof of concept, not observed in the wild, dated 2026-11-04
borderline-drop: S4-4 DigiCert archived validation-data access: no certificate operations affected, no Swiss public-sector nexus
borderline-drop: S4 and S2 incident leads (Holcim, Solnet, Eye-Able, Iperius, DreamHost, NSW Health, German municipal cases, CNIL items, Swiss Ransomware.live claims Labatec, HighTec, Erowa): each dropped on the incident floor or for no constituency nexus; reasons are in findings.S2.yaml and findings.S4.yaml
Coverage gaps: ico-uk (blocked on every transport; two WebSearch queries found no in-window ICO notice); connectwise-trust-center (403, status page read, nothing relevant); previdian (feed 403); sygnia (blocked, reader chain failed); proofpoint (feed's newest item 2026-10-14 and the listing unreadable, possibly stale); hackernews (the 2026-10-30 to 10-31 lookback edge was not swept); BSI portal and OX Security pages cited from the CSAF JSON and the full-text feed because the pages themselves were not fetched in-container.
Audit leads (outside the window, not shipped): IBM MQ CVE-2026-10747 (unauthenticated heap overflow, CVSS 10, bulletin 2026-09-14) is in no store entry; the Next.js unauthenticated RCEs GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr (patched 15.5.28 and 16.4.1, 2026-10-22) are in no store entry; Drupal contrib SA-CONTRIB-2026-293 to -298 (BSI WID-SEC-2026-4352, 23 CVEs) was not drilled to per-CVE severity and Drupal is common in Swiss public web estates; the ESET APT Activity Report Q2 to Q3 2026 (2026-10-28) has no dedicated entry (the 2026-10-29 MDaemon and ClamAV entry cites it for one finding); the Cisco ESA entry and the PHP2Shell vendor notices need no action.
Source lifecycle: enisa-cnw and specterops promoted to active (promotion_due); oss-security and cert-agid added as candidates; recipe notes appended for ox-security, theregister-security-feed, msft-ti, malware-news, inside-it-ch, srf-news, swissinfo-ger, cisa-advisories, chrome-releases and bsi-de. Candidate leads not registered (one post each, unproven): Badbyte, Layer3 Intel.
Gate: the one WARN left (source-urls) is the OX Security blog page answering 403 to the check's transport; the page was read through its full-text feed, as the entry's sourcing note says. The harness's stop hook fired several times mid-run asking for a commit; the run held the single atomic commit after the gate and the verifier loop, as the prompt requires. The first slice build excluded recent attempts so strictly that S4 would have had two sources; it was regenerated with the relaxation above before any spawn.
Verifier loop: six iterations of one cold-reader definition. Iterations 1 to 4 returned NEEDS_FIXES (truth 9, 7, 2, 1; every finding remediated or recorded as a declined advisory); iteration 5 returned CLEAN and the independent cold confirmation pass, iteration 6, returned CLEAN over all 159 claims, so the publish gate is a confirmed CLEAN. The headline catches: Barracuda changed its own advisory on 2026-11-05 (authentication not required for CVE-2026-116606), which the update now carries; a Restart Manager claim in the Qilin entry that Seqrite's detail section contradicted; and a 9.4.0.030 build no page names, replaced by Barracuda Campus's 9.4.0.029.
Advisories left unchanged (optional, non-blocking): the long Danfoss title and summary; the Q3 email body points and a sourcing-note sentence about omitted totals; the Storm-2603 note's team wording; the ConnectWise incident key on the Entra entry; Alpine's own advisory as an additional OpenSSH source (OX Security carries the same table).