2026-05-13-c148b9a5

• Dropped items / coverage gaps:
  • CVE-2026-41901 — Thymeleaf SSTI sandbox bypass. Initially surfaced by S2 (research returning ENISA EUVD-2026-29872 hit and CSO Online corroborating link) and composed into § 2. Phase 5.7 verifier flagged the source dates: the GitHub Security Advisory GHSA-c9ph-gxww-7744 is dated 2026-04-29 (not 2026-05-12), placing the disclosure 14 days outside the 36-hour recency window; the CSO Online article cited as corroborating is dated 2026-04-17 and concerns a different Thymeleaf CVE (CVE-2026-40478). Per PD-7 the item is dropped from § 2; the ENISA EUVD claim could not be independently re-verified in this iteration (EUVD direct fetch is SPA-only and the bridge fetcher hit an SSL cert-validity error during the verification pass). Operators with Spring Boot Java applications should patch Thymeleaf to 3.1.5.RELEASE in line with the April GHSA. — Source: GitHub Security Advisory GHSA-c9ph-gxww-7744, 2026-04-29 · Tags: vulnerabilities, rce, patch-available · Region: global · CVE: CVE-2026-41901 · CVSS: 9.0 · Vector: user-interaction · Auth: pre-auth · Status: patch-available
  • Odido (Netherlands) compensation refusal, Dutch DPA / criminal investigation, CUIC class action (NL Times, 2026-05-12). Surfaced by S4 but the primary URL https://nltimes.nl/2026/05/12/odido-rules-compensation-massive-cyberattack-affecting-62-million-accounts is behind Cloudflare's Managed Challenge and could not be fetched in-run by either the routine UA or the bridge fetcher (nltimes.nl is not in the bridge allow-list). Search-engine snippets confirmed the publication date, headline and key facts (CEO Søren Abildgaard, ShinyHunters vishing of Salesforce, 6.2M accounts, 350k registered for CUIC class action, Dutch Public Prosecution Service criminal investigation, AP / ILT investigations), but PD-2 requires that every cited URL be one the agent actually fetched. Dropped from § 1 rather than carry an unverifiable primary; will re-attempt next run via WebSearch fallback content or alternative outlet — Source: Techzine, 2026-02-16 · The Register, 2026-02-27 · Tags: data-breach, identity · Region: europe · Sector: telco
  • Kaspersky State of Ransomware 2026 (Securelist, 2026-05-12). PD-9 annual report. Surfaced by S3 with novel headline (PE32 ransomware using ML-KEM/Kyber1024 post-quantum KEM; encryptionless extortion now dominant; Qilin displaces RansomHub; RDWeb portal targeting overtakes phishing). Not promoted to § 3 / § 5 in this brief — yesterday's brief (2026-05-12) already absorbed the annual-report deep-dive slot (GTIG AI Threat Tracker) and PD-3 demotes the same category one rank when in the last-7-day window. Will pick up the PE32 / post-quantum element as a § 3 research item in a later brief if it gains corroborating independent analysis — Source: Securelist (Kaspersky), 2026-05-12 · Tags: ransomware, supply-chain · Region: global · Sector: public-sector
  • CVEs from Microsoft May Patch Tuesday not surfaced in § 2. ~30 Critical CVEs landed in this cycle; § 2 cherry-picked the four most operationally significant (Netlogon, DNS Client, SSO Plugin, Dynamics 365) plus the four Word Preview Pane RCEs. The remaining MDASH-discovered network-stack CVEs are referenced indirectly in § 3 (MDASH article). Operators should review the full Tenable / ZDI breakdowns for their environment.
• Single-source items:
  • NCSC-UK "10 questions to ask when using AI models to find vulnerabilities" — flagged [SINGLE-SOURCE] in § 3; national-CERT carve-out applies (NCSC-UK is primary disclosing party for its own guidance).
• Contradictions:
  • CVE-2026-26083 (FortiSandbox) CVSS — NCSC-CH cites 9.1 per Fortinet's own PSIRT, NVD's initial assignment is 9.8. Both indicate Critical; brief lists both ("9.1 (NCSC-CH per the vendor advisory) and 9.8 (NVD's initial assignment)"). Operators should treat as critical pending convergence; per-CVE breakdown carried in § 2 footer.
  • Microsoft May Patch Tuesday CVE count — Tenable reports 118, BleepingComputer reports 120, ZDI / The Register reports up to 138 depending on whether developer-tools and Azure-only items are included. Brief uses "120+" as a conservative summary.
  • Canvas affected-institution count — The Register cites ~8,800 colleges, universities and K-12 schools; The Record cites ~9,000. Brief uses 8,800 (per The Register, the primary cited) with The Record's figure surfaced inline.
• Reduced-confidence items: None this run beyond the dropped Odido entry above.
• Verification iteration 1 disposition (Opus): Eight F3/F4 truth findings applied as remediations — corrected NCSC-UK date (2026-05-12 → 2026-05-11), corrected Canvas narrative (Garbarino letter 2026-05-11 ahead of 2026-05-12 deadline), corrected Foxconn site-count phrasing, removed unsourced Nitrogen initial-access TTP chain, removed unverifiable ENISA EUVD claims on Exim and Thymeleaf, dropped Thymeleaf as out-of-window. Two F11 advisory findings (Foxconn TTP-chain advisory paired with the F4 fix; Canvas-institution-count) addressed.
• Verification iteration 2 disposition (Sonnet rotation): Five findings (1 truth, 3 editorial, 1 advisory) — (a) F1 broken-URL flag on https://fortiguard.fortinet.com/psirt/FG-IR-26-128: fresh re-fetch in this iteration returned 200 with the full advisory body (CVE-2026-44277, CVSS 9.1 per vendor, fixed in 6.5.7 / 6.6.9 / 8.0.3+, internal-audit discovery) — the verifier's 403 was a transient UA-filter on the host; no source-list change required. (b) F3 Centreon wording corrected: "command injection (effectively RCE in Centreon MBI)" instead of "RCE"; "XSS (Centreon Map, CVSS 6.8)" instead of "reflected / stored XSS". (c) F5 BWH Switzerland claim removed (sources do not call out Swiss properties specifically). (d) F10 Centreon 24.04.x branch added to affected versions (MBI only per the vendor bulletin). (e) F11 advisory ATT&CK mapping in § 5 step 8 corrected from T1647 Plist File Modification to T1553.002 Subvert Trust Controls: Code Signing, with an explicit note that no current sub-technique precisely maps to SLSA-L3 provenance forgery via OIDC abuse.
• Verification iteration 3 disposition (Opus rotation): Four findings (1 truth, 1 editorial, 2 advisory) at truth + editorial = 2 and no F1/F4 — early-exit threshold reached per v2.50. Remediations applied before publish: (a) F3 CVE-2026-44277 / CVE-2026-26083 CVSS converged on vendor PSIRT canonical value 9.1 throughout § 0 / § 2 / § 6 (iter-2 had left 9.8 in the body even after § 7 noted the discrepancy); CVSS table footnote re-worded; (b) F11a Exim § 6 Action Item Tags / Status enisa-critical flag removed (iter-1 F4 fix propagated to § 6); (c) F5 BWH country list (Germany, France, Italy) replaced with "multiple EEA jurisdictions" — neither cited source enumerates per-country exposure; (d) F11b advisory: Canvas UPDATE removed the "via support-ticket access" specifier — neither re-fetched source confirms that detail. Final iteration verdict: NEEDS_FIXES (truth=1 + editorial=1 = 2 ≤ early-exit threshold). Three iterations, model-rotated (Opus / Sonnet / Opus). Brief publishes with the four iter-3 remediations applied; no residual findings carried beyond what § 7 already documents.
• Sub-agents: S1, S2, S3, S4 all returned within budget. No stalled sub-agents.
• Fetch failures / bridges used: tools/fetch_source.py bridge used by S1, S2, S3, S4 for ncsc-csh recent / post (NCSC-CH SPA), cisa-kev, enisa-euvd recent, bsi-rss, and url for CERT-FR / BleepingComputer / Centreon. databreaches-net, inside-it-ch and parts of bleepingcomputer returned 403 (Cloudflare Managed Challenge) on every UA per the documented host behaviour — WebSearch fallback used. advisories-ncsc-nl returned 404 on the speculative ID (NCSC-NL CSAF advisory ID guessing not viable without a fresh index); coverage gap for that source this run. ico-uk sitemap fetched but no in-window enforcement actions found; freshest enforcement (South Staffordshire) already covered 2026-05-12. ENISA EUVD direct fetch hit SSL cert-validity error in the verification iteration — bridge worked for the sub-agents but not at verifier time.
• Coverage gaps: databreaches-net (Cloudflare-blocked, WebSearch fallback only); inside-it-ch (Cloudflare-blocked, WebSearch fallback only); advisories-ncsc-nl (CSAF advisory-ID enumeration failed, no in-window items surfaced); ico-uk (no in-window enforcement); nltimes.nl (Cloudflare-blocked, dropped Odido item logged above).

Unmatched action items (migrated)

• Patch Fortinet FortiAuthenticator and FortiSandbox now. Pre-auth RCEs in two appliance classes that anchor public-sector identity and SOC pipelines. Update FortiAuthenticator to 6.5.7 / 6.6.9 / 8.0.3; update FortiSandbox to 4.4.9 / 5.0.2 / Cloud 5.0.6. Cloud 23 and 24 require migration, not in-place patching. Even after patching, restrict the management interface to admin / SOC source IPs at the perimeter — Fortinet's PSIRT explicitly notes this as the residual hardening. See § 2
• Audit npm / pnpm lockfiles for Mini Shai-Hulud impact. Search every CI/CD pipeline and developer workstation for malicious versions across @tanstack/*, @uipath/*, @mistralai/*, @opensearch-project/opensearch, @squawk/*, @draftlab/*, @tallyui/* per the StepSecurity / Wiz manifests. UiPath impact is the highest-priority public-sector signal. Before revoking any GitHub PAT or npm token, sanitise the developer machine first — the worm's gh-token-monitor triggers rm -rf ~/ on revocation. Pin all pull_request_target workflows to SHA-locked action versions; gate fork-reachable workflows away from actions/cache writes. See § 4 / § 5
• Patch Exim on every Debian / Ubuntu mail relay. Run exim -bV | grep GnuTLS on each MTA — if present, upgrade to Exim 4.99.3. Interim workaround if patching is delayed: set CHUNKING_ADVERTISE_HOSTS = (empty) in exim4.conf to suppress BDAT. Expect public exploit-tooling within days; XBOW's disclosure includes full chain traces. See § 2
• Upgrade SPIP to 4.4.14 and apply the Centreon April 2026 monthly bulletin. SPIP RCE affects French and francophone Swiss-canton CMS deployments — gate ecrire/ to a known admin source set at the reverse proxy. Centreon update queue: any NOC running 24.10.x / 25.10.x Infra Monitoring with Anomaly Detection / Auto Discovery / AWIE / BAM / DSM / License Manager / MAP / MBI / Open Tickets. See § 2
• Hunt for Foxconn-Nitrogen-style precursor patterns on Windows servers and ESXi. Detection concepts in § 1: unsigned installers spawning cmd.exe / powershell.exe -enc from %TEMP% / %APPDATA% on Windows servers; vmkfstools / esxcli invocations from non-administrator sessions on ESXi /var/log/shell.log. Treat the Nitrogen ESXi decryptor bug as a strategic backup-integrity test — hypervisor-layer recovery from Nitrogen is mathematically impossible regardless of ransom posture. See § 1

Migrated from briefs/2026-05-13.md (v2).