2026-05-14-e05c6e6e

Recency window. window_hours = 36 (gap 24 h since briefs/2026-05-13.md + 12 h safety overlap); developing_window_hours = 72. Items whose primary source is older than 36 h are dropped from main sections unless they carry a fresh in-window development (UPDATE rule) or appear as deep-dive Background.

Items dropped — already covered last 7 days (PD-8): S2's findings on Mini Shai-Hulud / TanStack npm worm (last_covered 2026-05-13 deep dive — campaign:mini-shai-hulud); SEPPmail CVE-2026-44128 cluster (incident covered 2026-05-09 deep dive + § 2); Fortinet FortiAuthenticator / FortiSandbox (CVE-2026-44277 / CVE-2026-26083 in yesterday's § 2); SAP May 2026 Patch Day (CVE-2026-34260 / CVE-2026-34263 in yesterday's § 2); Microsoft May 2026 Patch Tuesday (CVE-2026-41089 / CVE-2026-41096 / CVE-2026-41103 / CVE-2026-42898 in yesterday's § 2); Europol IOCTA 2026 (annual-report covered 2026-05-10). Each lacks an in-window material delta sufficient to open § 4 UPDATE.

Items dropped — out-of-window (PD-7). S3 returned a structured "developing-window" set whose primary sources are all older than 36 h. Drop list with primary-source dates: QLNX / Quasar Linux RAT (Trend Micro 2026-05-05, BleepingComputer 2026-05-05); TCLBANKER / REF3076 (Elastic Security Labs 2026-05-07); UAT-8302 (Cisco Talos 2026-05-05); Cline CVE-2026-44211 (Oasis Security 2026-05-07); AiTM "code of conduct" phishing campaign (Microsoft Security Blog 2026-05-04); Progress MOVEit Automation CVE-2026-4670 / CVE-2026-5174 (Progress / Airbus SecLab 2026-04-30 / The Hacker News 2026-05-04). Reason in every case: out-of-window: primary source <date>, window_hours=36. None carry a fresh in-window development that would qualify under PD-7 carve-outs (a/b/c).

Items dropped — § 2 inclusion gate not cleared. HPE ArubaOS May 2026 multi-CVE batch (HPE Aruba HPESBNW05048 / HPESBNW05049, CERT-FR CERTFR-2026-AVI-0573, 2026-05-13) — highest issue CVE-2026-23819 is CVSS 8.8 stored-XSS post-auth, with several CVSS 7.2 authenticated command-injection findings and CVSS 7.5 unauthenticated DoS on the PAPI port. No ITW exploitation, no public PoC, no pre-auth RCE on widely-deployed internet-exposed software — neither CISA-KEV nor ENISA-EUVD critical band nor § 2 catch-all gate (a–e) is cleared. Notable for CH / EU public-sector wireless infrastructure (cantonal government, education, healthcare) but operationally a routine patch cycle. Coverage gap consequence: zero.

Items dropped — single-source dark-web only. Anubis ransomware listing for A.R.Ge.Co (France) (Malware.news, 2026-05-13) — leak-site claim only, no victim confirmation, no HIGH-reliability journalism corroboration, per PD-6 fake-news guard on leak-site claims.

Single-source items (PD-5 carve-out applied). One § 4 item: the PAN-OS CVE-2026-0300 UPDATE on the wave-2 patch delay relies on Palo Alto-affiliated primaries only (Palo Alto Networks PSIRT advisory + Unit 42 research blog) after Phase 5.7 iteration 1 flagged a false-corroboration SecurityWeek citation that did not in fact mention Palo Alto. Independent corroboration for the wave-2 build list (ETA 2026-05-28) was not located in HIGH-reliability third-party coverage within the 36-h window; item is flagged [SINGLE-SOURCE] in its heading and the wave-2 build list should be re-verified against the live PSIRT entry. Active-exploitation status itself remains multi-source (Unit 42 + CISA KEV listing + prior briefs' coverage).

Phase 5.7 verifier remediations applied (four iterations, model-rotated). Iteration 1 (Opus): NEEDS_FIXES truth=6 editorial=2 advisory=3 — § 4 Gentlemen UPDATE attributed four claims to Check Point Research the article does not support (ZeroPulse-via-Ethereum-smart-contracts-via-1rpc.io for C2 resolution; 4VPS as hosting provider; "32% of victims were European in Q1"; Moscow business-hours timestamp clustering) — all four removed and detection guidance rewritten. § 4 PAN-OS UPDATE's SecurityWeek 2026-05-13 corroboration was false (the article covers only Fortinet + Ivanti) — citation removed, item flagged [SINGLE-SOURCE]. § 5 deep dive's specific "Bcm/year" figures and Italy/Greece/Bulgaria recipient list replaced with Bitdefender's actual framing ("13 European countries, including new deliveries to Germany and Austria"). Advisories (F11): GemStuffer's "219 of 224 versions" detail rewritten to match Socket; ATT&CK mapping tagged as analyst-derived; Salt Typhoon attribution routed to THN explicitly.

Iteration 2 (Sonnet): NEEDS_FIXES truth=3 — leftover instances of iter-1 issues that hadn't been remediated in non-TL;DR locations. § 6 Gentlemen action item still carried the 1rpc.io detection sentence (removed); § 6 misattributed Bedrock-Safeguard/gentlemen-decryptor to Check Point Research instead of BankInfoSecurity (re-attributed); "Nova ransomware" attribution to NMDL breach removed from § 0 + § 1.

Iteration 3 (Opus): NEEDS_FIXES truth=7 — iter-2's "Neither IGJ nor Computable attributes the breach to a named ransomware operator" was itself an unsupported assertion (Computable does name Nova) — Nova attribution restored citing Computable. FamousSparrow wave attribution inverted in deep dive — Bitdefender's actual wave map is W1 = Deed RAT via Hamachi sideloading with Init/ComMain export override + StartServiceCtrlDispatcherW patch, W2 = TernDoor via separate sideloading host, W3 = Modified Deed RAT + updated C2; brief had Hamachi as W3. § 0 TL;DR, § 5 heading, § 5 background paragraph, § 5 exploitation-chain bullets, and § 5 detection paragraph all rewritten. "Runtime export call graph inspection" framing overstated the technique — tightened to "two specific exported functions overridden". Gentlemen 1,570 figure was attributed to "an affiliate's exposed C2 server" but Check Point in fact attributes it to a SystemBC C&C server; 332 = first five months of 2026 (CP's full comparison cites 412 cumulative DLS listings) — § 0 TL;DR + § 4 paragraph rewritten. GemStuffer "2026-05-12 signup suspension" date not in cited primaries — removed; version-rotation / hash-IOC paragraph not in Socket — removed.

Iteration 4 (Sonnet): NEEDS_FIXES truth=1 editorial=0 advisory=0 — single F3 finding: § 5 Wave 2 sideloading host was described as USOShared (implying a legitimate Microsoft-signed binary). Bitdefender actually names the host as deskband_injector64.exe renamed to USOShared.exe and placed in C:\ProgramData\USOShared\; the malicious loader is winmm.dll in the same directory. The directory name reuses "USOShared" for camouflage; no legitimate Microsoft USOShared signed binary is involved. § 5 exploitation-chain bullet + detection paragraph rewritten to specify deskband_injector64.exe and the C:\ProgramData\USOShared\ path. Early-exit on low-defect convergence (v2.50): with truth + editorial = 1 and no F1 / F4 findings, iteration 4 qualifies as the early-exit point per prompt § Phase 5.7 — remediation applied, residual logged, brief published without spawning iteration 5. verification_residual_count = 1.

Model rotation across the verification loop: iter 1 / iter 3 = Claude Opus 4.7 (cti-verification), iter 2 / iter 4 = Claude Sonnet 4.6 (cti-verification-alt). Both verifier definitions carry the identical operational system prompt; the rotation surfaces model-specific blind spots — Sonnet caught the Nova-attribution false disclaimer in iter 2 that Opus had introduced in iter 1's remediation; Opus caught the wave-attribution inversion in iter 3 that Sonnet's iter 2 had not flagged.

Sub-agent stalls. None. All four sub-agents returned within the 30-min wall-clock cap: S1 (443 s, Claude Sonnet 4.6), S2 (414 s, Claude Sonnet 4.6), S3 (797 s, Claude Sonnet 4.6), S4 (979 s, Claude Sonnet 4.6).

Fetch failures (consolidated across sub-agents). databreaches-net 403 (Cloudflare Managed Challenge — bridge + WebSearch fallback documented per source spec); sec-disclosures-edgar 403 on EDGAR full-text search (S4) — no fresh 8-K Item 1.05 disclosures recovered for the May 12-14 window; ico-uk SPA-empty body even via bridge; inside-it-ch Cloudflare-blocked across all attempts (no in-window stories surfaced via WebSearch fallback); bleepingcomputer SPA-rendering on article level (recovered via THN/SecurityWeek corroboration); trendmicro-research 403 on direct WebFetch (recovered via BleepingComputer / The Hacker News paraphrase — Trend Micro is HIGH-reliability primary attribution); cert-eu SPA-empty on listing, recovered via per-advisory URL; helpnetsecurity 429 (recovered via THN); community.progress.com (SPA empty body); bsi-de per-advisory SPA (RSS feed cross-checked); forums.ivanti.com Salesforce SPA (recovered via Ivanti vendor blog).

Contradictions / reduced-confidence flags. None this run. Two distinct sub-agents (S1 + S2) independently arrived at the CVE-2026-0300 second-patch-wave delta from different discovery paths (CISA KEV listing notes vs. NCSC-CH Patch Tuesday compilation); both led to the same primary Palo Alto PSIRT advisory.

Coverage gaps: databreaches-net (Cloudflare Managed Challenge, no UA bypass — WebSearch fallback only); sec-disclosures-edgar (EDGAR full-text feed 403 on routine UA — no fresh 8-K Item 1.05 disclosures recovered in window); ico-uk (SPA + sitemap discovery insufficient to surface in-window enforcement actions); inside-it-ch (Cloudflare Managed Challenge); trendmicro-research (403 — recommend bridge allow-list addition for desktop-Chrome UA, would have unlocked direct fetch on two QLNX / InstallFix items even if those were out-of-window today).

Self-evolution candidate (source list). No new candidate added this run; the active list is already at 94 sources and recent rotation-priority gaps are transport-blocking rather than coverage-gap caused. Recommend tracking trendmicro-research as a bridge allow-list addition in a future tooling commit (separate from this brief commit).

Unmatched action items (migrated)

• Continue PAN-OS Captive Portal interim mitigation on the eight "ETA 05/28" build streams until 28 May. Disable User-ID Authentication Portal on untrusted-zone interfaces or restrict it to trusted zones only; for Threat Prevention subscribers, ensure Threat ID 510019 is enabled (PAN-OS 11.1+). CL-STA-1132 in-the-wild exploitation is ongoing; the FCEB KEV deadline has no jurisdictional weight in CH / EU but the active exploitation does. See § 4.
• For active Gentlemen ransomware incidents — attempt decryption before negotiation. BankInfoSecurity's 2026-05-11 reporting identifies the Bedrock-Safeguard/gentlemen-decryptor GitHub release as the recovery path; Check Point Research's 2026-05-13 backend-leak analysis additionally maps the EDR-suppression toolchain (EDRStartupHinder, gfreeze, glinker — custom binaries, not commodity) and the CertiHound AD CS abuse utility. Hunt those tool names on hosts in scope; monitor for AD Certificate Services reconnaissance (certutil enumeration of CA servers / templates) consistent with CertiHound. See § 4.
• Verify Exchange ProxyNotShell remediation completeness with HealthChecker.ps1, not CU-level alone. FamousSparrow re-exploited the same CVE-2022-41040 / CVE-2022-41082 chain across three intrusion waves at one victim despite remediation attempts — patch-rollback or surviving persistence is the structural cause. Run Microsoft's HealthChecker.ps1 on every on-premise Exchange server; audit FrontEnd\HttpProxy\owa\auth\ and FrontEnd\HttpProxy\ecp\auth\ for files modified post-patch. See § 5.
• Hunt outbound gem push (and npm publish / pip upload) from build agents and dev workstations that lack a publisher role. GemStuffer's structural innovation is exploiting the inbound-monitoring-only blind spot of most CI/CD security tooling. Flag new RubyGems publisher accounts with >10 versions/day on freshly created packages; inspect outbound POSTs to rubygems.org from non-publisher contexts. The same monitoring asymmetry exists across npm and PyPI. See § 3.
• For Swiss healthcare entities — schedule the EPDG-equivalent NEN 7510 audit; do not wait for the regulator. The IGJ ruling on Clinical Diagnostics / NMDL specifically cites absence of third-party security audit and absence of periodic risk assessment as the structural failures behind a 941,000-record breach. Swiss cantonal supervisors track the same hygiene baselines via the EPDG profile; equivalent compliance gaps in Swiss healthcare carry equivalent regulatory exposure under FINMA and cantonal data-protection authorities. See § 1.

Migrated from briefs/2026-05-14.md (v2).