2026-05-12-cd1ab844

Items dropped or held back

• Ivanti EPMM May 2026 chain (CVE-2026-6973 et al.) — § 4 UPDATE candidate, dropped after verifier check. S2 surfaced CERTFR-2026-ACT-021, 2026-05-11 framed around named Dutch public-sector victims (Autoriteit Persoonsgegevens, Raad voor de Rechtspraak) as the in-window delta justifying re-coverage. The Phase 5.7 verifier's re-fetch of CERT-FR ACT-021 (and NCSC-NL — Casus kwetsbaarheden Ivanti EPMM-systemen) confirms neither source names those organisations; CERT-FR's affected-systems table reads "Non spécifié par l'éditeur". Without the named-victims claim, the bulletin's only operational delta is a recommendation to rotate EPMM admin credentials as carry-over from the January 2026 chain — already covered in the 2026-05-09 daily. Per PD-8 + PD-13, no fresh material delta in window; dropped. The hallucinated named-victims claim is an example of research-sub-agent drift that the cold-reader verification caught at iteration 1.
• CVE-2024-1708 / CVE-2024-1709 — ConnectWise ScreenConnect path-traversal + auth-bypass chain (KEV deadline 2026-05-12). S1 surfaced again with Kimsuky (DPRK) / Storm-1175 (China-linked) / Medusa attribution. Both the underlying KEV addition (2026-04-28) and the actor-attribution article (The Hacker News, 2026-04-28) sit outside the 36 h recency window and were already considered and dropped in yesterday's brief on the same basis. Per PD-13, a KEV deadline arriving today is not in itself material new development. No fresh in-window ITW evidence, no fresh in-window research delta. Dropped.
• CVE-2026-0073 — Android adbd wireless-ADB authentication-bypass (PoC public ~2026-05-11; vendor patch 2026-05-01). S1 surfaced with Penligent/Barghest research (in-window PoC disclosure) and the Android Security Bulletin May 2026. Strict § 2 gate not cleared: vector is AV:A adjacent-network (over wireless ADB on TCP/5555), not internet-exposed; CVSS 8.8 below the ENISA EUVD CVSS-9 threshold; no ITW; not on the KEV catalogue at time of run. Dropped from § 2; logged here for the next brief if exploitation evidence emerges. The mitigation guidance is straightforward and not novel — MDM policies should disable wireless ADB globally on enrolled devices regardless of this CVE.
• GLPI cluster (CVE-2026-32312 / 40108 / 42317 / 42318 / 42320 / 42321 / 5385). Already fully treated as § 2 entries in the 2026-05-10 daily; the CERT-FR ACT-021 weekly recap on 2026-05-11 does not add a material delta — instance counts, sectoral framing, and patch paths are unchanged. No re-coverage.
• SEPPmail Secure Email Gateway cluster (CVE-2026-44128 / 44125 / 44126 / 44127 / 44129 / 7864). Already the 2026-05-09 deep dive; S2 acknowledged the NCSC-CH security-hub post 12551 is ~44 h old and outside the strict 36 h window. No re-coverage.
• CB Financial Services (CBFV) SEC Form 8-K Item 1.05 (filing 2026-05-11 per S4 SEC EDGAR search). S4 could not retrieve the filing body (URL guess fell to 404); no corroborating press coverage was located. Community bank in Carmichaels, PA — limited systemic EU / Swiss relevance, and the filing-detail gap means we cannot quote the disclosure. Held back for tomorrow's brief once the filing body is reachable.
• Akamai SIRT "Shadow AI" LLM-malware post. Surfaced by S3 via search but the article's publication date is undetermined; www.akamai.com is not on the bridge allow-list and WebFetch returned 403. Cannot establish in-window status; dropped.

Single-source / reduced-confidence items

• West Pharmaceutical Services SEC 8-K is [SINGLE-SOURCE-OTHER] for press corroboration: the SEC filing itself is HIGH-reliability primary, but no tier-1 security press coverage was retrieved before the brief was composed (S4 found only FrenchBreaches.com, an aggregator). Confidence on the disclosure itself: HIGH. Confidence on attribution class (ransomware vs. other actor): MEDIUM — the SEC filing's wording strongly implies double-extortion ransomware but the company does not use the word. Included on the strength of the primary regulator filing.
• Škoda Auto online shop breach is corroborated by SecurityWeek + Škoda's own vendor statement; no independent security-research source (Heise, Inside-IT, Le Monde, BKA / BfDI / Czech UOOU enforcement notice) was found before composition. Confidence on the disclosure itself: HIGH. Confidence on the data-exfiltration scope: MEDIUM by Škoda's own admission (logging gap).
• ConnectWise ScreenConnect note (above) also relies on cybernews.com and the vendor PSIRT URL, both of which failed to fetch in this run; we are not including the item, but we note that the trust-cert issue on the ConnectWise PSIRT URL is a transport-side recurring problem that we have not yet logged for the bridge fetcher allow-list expansion.

Contradictions / ambiguities

• Instructure Canvas "data destruction" claim from ShinyHunters. Instructure's own communication frames receipt of "shred logs" as digital confirmation of deletion; security-research community framing in The Register and Infosecurity Magazine is that ransomware-actor "shred log" artefacts are unverifiable. We follow the security-research framing in the brief because (a) it matches established practice for breach-notification scope decisions under GDPR / Swiss DSG, and (b) the second intrusion on 2026-05-07 and the per-institution deadline reset for today demonstrate that the actor's word is not a forensic primitive.

Sub-agents

• S1 (Claude Sonnet 4.6, 479 s): returned 3 items + CVE summary table. 1 item kept as Immediate Action callout (PAN-OS UPDATE); 2 items dropped (ScreenConnect out-of-window per yesterday's decision; Android adbd § 2 gate). Telemetry: webfetch=15, websearch=16, bridge=9. URL-liveness cache populated.
• S2 (Claude Sonnet 4.6, 572 s): returned 3 items. 1 item kept as § 4 UPDATE (Ivanti EPMM CERT-FR ACT-021 + named EU public-sector victims); 2 items already-covered (GLPI 2026-05-10; SEPPmail 2026-05-09 deep dive). Bridge-mandatory hosts NCSC-CH security-hub (12548 + 12551) and ENISA EUVD fetched cleanly via the bridge subcommands. Telemetry: webfetch=14, websearch=18, bridge=8.
• S3 (Claude Sonnet 4.6, 642 s): returned 5 items. 2 items kept (GTIG AI Threat Tracker as § 5 Deep Dive per PD-9 annual-report rule; TeamPCP Checkmarx Jenkins as § 4 UPDATE). 2 items duplicated with S4 (Canvas/Instructure ransom-paid; Škoda online-shop breach — merged with S4 framing). 1 item duplicated with S1 (Trellix source-code coverage — already covered 2026-05-10). Telemetry: webfetch=18, websearch=18, bridge=4.
• S4 (Claude Sonnet 4.6, 556 s): returned 4 items. 3 items kept (ICO South Staffordshire fine; West Pharma SEC 8-K; Škoda online shop). 1 item duplicated with S3 (Canvas/Instructure UPDATE — merged). Telemetry: webfetch=22, websearch=21, bridge=3.

Tool / source issues observed

• hub.ivanti.com, downloads.seppmail.com, ccb.belgium.be are not on the tools/fetch_source.py bridge allow-list — bridge attempts on these hosts return refused: host '...' is not in the allow-list. Direct WebFetch returns 403 on hub.ivanti.com. Coverage is recovered via NCSC-CH security-hub, CERT-FR, and CIRCL vulnerability.circl.lu, but adding these three hosts to the bridge allow-list would remove a recurring single-point coverage risk on Ivanti, SEPPmail, and Belgian-CCB advisories.
• bleepingcomputer article-level URLs continue to 403 on direct WebFetch; bridge url returns 200 with SPA-empty body. Listing-level URLs work. No change since 2026-05-11.
• advisories-ncsc-nl CSAF bridge — S2 recorded 404 on several recent advisory IDs (NCSC-2026-0384, 0399, 0400, 0401); NCSC-2026-0135 (Ivanti EPMM) fetched cleanly. The NameError that broke yesterday's bridge call is gone; the new mode is upstream 404 on advisory IDs that are presumably embargoed or never published. Worth tracking.
• research.nccgroup.com is not on the bridge allow-list (S3 attempted via bridge url; refused).
• darkreading article-level URLs continue to 403 on direct WebFetch (S3, S4 both hit this).
• databreaches-net Cloudflare Managed Challenge confirmed again; WebSearch fallback used per allow-list, no in-window items surfaced.

Recency window

• gap_hours = 24 (prior brief briefs/2026-05-11.md).
• window_hours = 36; developing_window_hours = 72.

Coverage gaps

Coverage gaps: cisa-kev (bridge OK; no new KEV additions in window 2026-05-11 / 2026-05-12); enisa-euvd (bridge OK; recent lastvulnerabilities returned only low-severity XSS, criticals and exploited only items already covered); ncsc-ch-security-hub (bridge OK; latest posts 12548 + 12551 are 2026-05-08 and already absorbed into S2 returns; no new posts in window); bsi-de (RSS OK; in-window items routine — Linux kernel, libxml2, NGINX, IBM); cert-pl, cert-at, csirt-acn-it (not fetched in this run — rotation candidates for tomorrow); cert-eu (no advisory 2026-007 yet — 2026-006 was the last published); ccn-cert-es (demoted source, not fetched); cnil-fr, edpb, aepd, garante (no in-window enforcement / breach decisions found); ico-uk (sitemap bridge fetched; the South Staffordshire action was the only new enforcement in window); inside-it-ch (Cloudflare-blocked — WebSearch fallback used, no S2 items surfaced); databreaches-net (Cloudflare-blocked — WebSearch fallback, no items); sec-edgar (CB Financial CBFV 8-K Item 1.05 filed 2026-05-11 but filing body not retrievable from EDGAR URL guess — see drops above); hub.ivanti.com, downloads.seppmail.com, ccb.belgium.be, research.nccgroup.com, akamai-sirt — bridge allow-list expansion candidates.

Migrated from briefs/2026-05-12.md (v2).