2026-05-21-77cdc4cd

• Out-of-window drops (primary source older than 36h window): Exim CVE-2026-45185 "Dead.Letter" — XBOW disclosure 2026-05-12, NCSC-NL advisory 2026-05-15; S2 surfaced an exploitation-confirmation quote from NCSC-NL but its publication date is ambiguous, so the item is held to the next run with the underlying advisory carried forward; Fortinet CVE-2026-44277 (FortiAuthenticator) / CVE-2026-26083 (FortiSandbox) — Fortinet PSIRT FG-IR-26-128 dated 2026-05-12, NCSC-CH advisory 2026-05-13, both outside the 36 h window; SAP May 2026 Security Patch Day (CVE-2026-34260, CVE-2026-34263) — SAP Security Notes dated 2026-05-12, outside window; CrowdStrike 2026 Financial Services Threat Landscape Report — both cited URLs carry publication date 2026-05-14 (not 2026-05-20 as the sub-agent return initially asserted), which puts the report 6 days outside the 36 h window. Item dropped from § 3 by iteration-1 verification (consistent with the SAP / Fortinet treatment in this same list); finance-sector audience may pick up the synthesis directly from the CrowdStrike press release or CrowdStrike blog.
• Already-covered drops: Microsoft Fox Tempest malware-signing-as-a-service disruption — covered in 2026-05-20 active-threats; S3 re-surfaced the Microsoft Threat Intelligence and Microsoft On the Issues posts with no material new development beyond yesterday's coverage. Huawei VRP zero-day → Luxembourg POST 2025 nationwide outage — covered in 2026-05-20 active-threats with the same The Record + Security Affairs sources S4 re-surfaced; no new technical specificity or CVE assignment in this run.
• Long-running-campaign rule application: Microsoft Exchange CVE-2026-42897 — re-surfaced by S2 with the same Microsoft MSRC + Microsoft Exchange Team + NCSC-CH + Help Net Security sources cited in the 2026-05-16 deep dive and the 2026-05-18 UPDATE. No new exploitation attribution, no new patch, no new victim class — per the long-running-campaign rule (≤1 consolidated UPDATE per week unless something critical changes) the item is not re-issued. Per PD-13 the imminent CISA KEV remediation deadline (2026-05-29, US-FCEB-only) is not a valid driver for a § 4 UPDATE.
• Reduced-confidence / framing: B1ack's Stash 4.6M card dump included as a dark-web claim with explicit "not confirmed by issuing institutions" framing; SOCRadar and Security Affairs both analyse the actual dump, but per-issuer attribution is unverified. Huawei VRP / Luxembourg (not in this brief, but referenced in the dropped-list) — confidence remains MEDIUM in the sub-agent finding due to absence of any Huawei PSIRT advisory after ~10 months, no CVE assigned and no technical advisory specificity.
• Contradiction: Grafana TanStack timeline — Grafana's own post-mortem (Grafana Labs, 2026-05-19) cites detection of the TanStack compromise on 2026-05-11; BleepingComputer's reporting (BleepingComputer, 2026-05-20) cites 2026-05-01 for the malicious-package consumption event. The brief reports Grafana's date on the basis that Grafana is the primary disclosing party for its own incident; the 10-day discrepancy may reflect the difference between the malicious-package's pull-time on the CI/CD runner and the detection event on Grafana's security team's timeline.
• Single-source items: none in this brief — every published item carries ≥2 independent reputable sources or qualifies under the PD-5 national-CERT carve-out with the CERT acting as primary disclosing party.
• CVEs that did not clear § 2 inclusion gates (PD-2 § 2 gates: CISA KEV, ENISA EUVD exploited=true or CVSS≥9.0, vendor/researcher report of ITW exploitation, or pre-auth RCE on widely-deployed internet-exposed software with public PoC): none dropped from in-window candidates in this run; out-of-window CVEs listed above were not evaluated against gates.
• Sub-agent self-identification: all four cti-research sub-agents (S1, S2, S3, S4) returned with **Model:** and **Timestamps:** lines; the AI-content notice and Generated by: line collapse to the single distinct model Claude Sonnet 4.6 since all four research roles reported that model.
• Verification disposition (Phase 5.7): five iterations ran with model rotation per v2.47 (iter-1 Opus, iter-2 Sonnet alt, iter-3 Opus cold, iter-4 Sonnet alt, iter-5 Opus cold); cumulative findings across iterations remediated in-line. Iter-5 returned NEEDS_FIXES with truth=1 (the unsupported "approximately 20 % the previous year" prior-year DBIR baseline in § 5 Headline shift paragraph) and one advisory (Grafana scope wording precision drift) — both remediated post-verdict before commit. The brief publishes at the v2.46 5-cap safety valve with verification_residual_count=1 recording the final-iteration verdict as the cap-breach signal for the Ops dashboard. The notable verification finding-cluster of this run was iter-3's surfacing of multiple sub-agent attribution-discipline regressions in the § 4 TeamPCP UPDATE (five FIRESCALE / 417k / SSM specifics misattributed to Wiz), all remediated by aligning the body to Wiz's actual published technical detail.
• Coverage gaps: databreaches-net (Cloudflare 403, Wayback empty — now 5 consecutive run failures); inside-it-ch (403 persistent — 4-run failure); sophos-xops (HTTP 503 persistent — 4-run failure); trendmicro-research (HTTP 500 persistent, no Wayback snapshot); cyberscoop (TLS certificate not-yet-valid error); darkreading (HTTP 403, no Wayback); cert-fr-actu (feed stale since October 2025); us-treasury-ofac (503); cert-eu (200 empty-body — 2-run failure); edpb, cnil-fr, ico-uk, agid-csirt-it — quiet in window (no in-window enforcement items); ncsc-ch-security-hub bridge subcommand and chrome-releases and jpcert not fetched in this run.

Unmatched action items (migrated)

• Patch Drupal core on PostgreSQL backends immediately — upgrade to 10.4.10 / 10.5.10 / 10.6.9 / 11.1.10 / 11.2.12 / 11.3.10. The Drupal Security Team warned that exploits "might be developed within hours or days" of the SA-CORE-2026-004 advisory (see § 4 UPDATE). If patch deployment is gated by change-control, temporarily front the site with Drupal Steward or an equivalent WAF rule covering SQL-injection vectors at the DB-API layer.
• Complete the six-step SonicWall LDAP reconfiguration on every Gen6 SSL-VPN appliance per SonicWall KB kA1VN0000000RBd0AM — firmware-update status alone is insufficient and Akira-linked actors are actively exploiting the UPN/SAM split (see § 1). Given Gen6 EoL on 2026-04-16, schedule migration to Gen7/Gen8.
• Hunt for Webworm Discord and Microsoft Graph API C2 — alert on outbound HTTPS to discord.com/api/* or graph.microsoft.com from process trees whose parent is not the expected first-party application; correlate Graph API non-interactive sign-ins for app registrations without enterprise approval, and flag cmd.exe spawned by long-running services with no interactive user context (see § 1). Apply Conditional Access on Microsoft Graph restricting non-managed device sign-ins on workstations that have no Graph integration need.
• Audit VS Code extension installation policies on every developer endpoint — enforce a managed allowlist via Group Policy / MDM, set extensions.autoUpdate: false, and rotate every secret accessible to extensions whenever a supply-chain compromise is confirmed (see § 4 UPDATE TeamPCP / GitHub breach). Hunt Sysmon EID 1 for code --install-extension invocations on dev endpoints; search CI/CD pipeline logs for durabletask package imports in versions 1.4.1–1.4.3 and treat any host that imported a malicious version as fully compromised.

Migrated from briefs/2026-05-21.md (v2).