2026-05-23-852c21c8

• Items dropped (off-audience / less-is-more): Oncology Institute Inc. SEC Item 1.05 8-K (US-only oncology practice, no Swiss/EU nexus, single-source MEDIUM via Globe and Mail relay since the EDGAR filing index returned HTTP 403 to the bridge fetcher — relevance bar not met); Cloud Atlas / Kaspersky Securelist 2026 PowerCloud + ReverseSocks coverage (substantive but indirect EU nexus — Cloud Atlas targets Russian and Belarusian government primarily; EU diplomatic exposure is collateral). Both available for re-surfacing if a CH/EU victim or operationally relevant detail emerges.
• Items dropped (out of window): Germany Cyber-Dome / Cyber-Security Strengthening Act announcement (Interior Minister Dobrindt, 2026-05-12) — outside the 36 h recency window with no in-window legislative delta (cabinet vote outcome, final text). Carry forward; surface in next brief if a cabinet decision or NIS2 cross-impact lands in-window.
• CVEs dropped from § 2 with reason: CVE-2026-46333 — does not clear any § 2 inclusion gate (local LPE not pre-auth RCE; four working Qualys exploits detailed in the public advisory but no in-the-wild exploitation reported by Qualys or downstream researchers as of this run). Covered instead as § 5 Deep Dive given operational depth.
• Items included with reduced confidence: Rhysida ransomware claim against Landeshauptstadt Stuttgart — [MEDIUM] confidence; corroboration is press coverage of the leak-site listing and a DeXpose write-up, not a victim statement (city denies confirmed incident). Treat as hunt-trigger not confirmed-victim. FBI PSA260521 details on Kali365 — the IC3 advisory itself (ic3.gov/PSA/2026/PSA260521) returned HTTP 403 to the bridge fetcher; primary advisory text was reconstructed from four independent corroborating outlets (The Register, Help Net Security, The Record, CyberScoop) all quoting the FBI text verbatim. Confidence HIGH on the technical content; primary URL not directly fetched in this run. SEC EDGAR direct-filing access also returned 403 (TOI 8-K), but TOI was dropped on relevance grounds rather than carried with degraded sourcing. Check Point Research March-April 2026 AI Threat Landscape Digest is [SINGLE-SOURCE] — only the CPR blog post was directly fetched in this run; the Gambit Security primary report URL referenced in earlier drafts returned a 404 and was dropped per the verifier iter-1 F1 finding.
• Kimwolf primary-source upgrade applied in iteration 1: following the verifier's F6 finding, the DOJ press release on the indictment (justice.gov/usao-ak/pr/canadian-man-arrested-international-authorities-charged-administrating-kimwolf-ddos) was promoted to the first Source link in the § 1 Kimwolf footer, with KrebsOnSecurity demoted to second Source and The Hacker News + The Record kept as Additional sources. Confidence on the factual outline (defendant, charges, peak throughput, takedown sequence) is HIGH due to corroboration density anchored on the DOJ primary.
• Contradictions: Drupal SA-CORE-2026-004 carries vendor severity 23/25 ("Highly Critical") while NIST's published CVSS v3.1 is 6.5 — the gap reflects Drupal's CMS-wide-impact risk framing versus NVD's strict base-score calculation. Brief reports both; the operational truth is "actively exploited pre-auth SQL injection on PostgreSQL backends" regardless of which score scheme is referenced.
• Sub-agents that didn't return on time: none — S1 / S2 / S3 / S4 all returned within the 30 min wall-clock cap. S2 (Sonnet 4.6): 4 items, 322 s; S3 (Sonnet 4.6): 5 items, 330 s + later updates; S1 (Sonnet 4.6): 6 items, 557 s; S4 (Sonnet 4.6): 3 items, 574 s. Sub-agent self-reported telemetry: webfetch 8/7/11/22, websearch 16/5/14/12, bridge fetches 10/14/9/8 for S2/S3/S1/S4 respectively.
• Verification loop (Phase 5.7): four iterations, model-rotated per v2.47 — iter 1 (Opus) NEEDS_FIXES truth=9 editorial=4 advisory=2, iter 2 (Sonnet) NEEDS_FIXES truth=3 editorial=1 advisory=1, iter 3 (Opus, cold) NEEDS_FIXES truth=5 editorial=2 advisory=3, iter 4 (Sonnet + iter-3 deltas) CLEAN truth=0 editorial=0 advisory=3. Brief published under iteration 4's CLEAN verdict. Three iter-4 F11 advisory items applied as cheap edits before publish: SafeDep citation label corrected to 2026-05-21; DOJ citation label corrected to 2026-05-21 to match the body's Thursday-2026-05-21 unsealing-date reading; Danish-authorities NoName057(16) claim softened to "per De Volkskrant reporting carried by BleepingComputer, Danish authorities have alleged that WorkTitans infrastructure supported NoName057(16) DDoS campaigns".
• Candidate-source overflow: S3 surfaced two new candidate sources (searchlight-cyber — high-quality same-day technical analysis of CVE-2026-9082; gambit-security — primary research on the Mexico AI-orchestrated nine-agency breach). Per the one-candidate-per-run cap, searchlight-cyber was added as status: candidate in sources/sources.json; gambit-security is carried forward for next run.
• Coverage gaps: databreaches-net (transport-403, Cloudflare challenge — fifth consecutive failing run, content cross-checked via BleepingComputer/TheRecord/SecurityAffairs); inside-it-ch (Cloudflare challenge + stale Wayback — fifth consecutive failing run, no Swiss-specific in-window items recovered via WebSearch fallback); sophos-xops (HTTP 503 on canonical RSS — fifth consecutive failing run); dragos-ot (HTTP 404 on resource library RSS — feed appears stale); trendmicro-research (rotation-priority but not retried this run); cisa.gov direct fetches consistently 403 (mitigation: python3 tools/fetch_source.py bridge — used for CISA KEV catalog ingest); ic3.gov direct fetches 403 (Kali365 PSA reconstructed from four corroborators); sec.gov EDGAR direct 403; heise.de Security articles TollBit-gated (HTTP 307 → tollbit.heise.de — feed summaries only); cert-eu (3 of 7 recent runs returned no new advisory — quiet, no advisory dated within this 36 h window — most recent is 2026-006 from 2026-05-06 on PAN-OS); anssi-fr (in-window CERTFR-2026-AVI-0611 on Azure surfaced but not operationally significant for this brief; AVI-0635 SPIP fetched and included); jpcert (no in-window lead surfaced; bridge not used in this run); prodaft (not attempted — no in-window publication surfaced via WebSearch); euronews (Cloudflare challenge on direct + Wayback miss — Germany Cyber-Dome AFP wire content recovered via The Star republication, but item ultimately dropped as out-of-window). edpb, cnil-fr returned 200 / no in-window enforcement actions — that is a quiet day, not a coverage gap.

Unmatched action items (migrated)

• Patch SPIP to 4.4.15 across every Francophone public-administration deployment — ANSSI CERTFR-2026-AVI-0635 is the operational driver; the underlying issue is an open-redirect on the cookie action (per the SPIP project blog), commonly chained into account-impersonation. SPIP is the predominant CMS in Romandie cantonal / communal portals, French ministries and Belgian Francophone government sites. No CVE attached, so the patch is easy to overlook on CVE-driven tooling.
• Block user-interactive OAuth device-code flow via Entra ID Conditional Access to defeat Kali365 PhaaS; enforce FIDO2 phishing-resistant MFA for privileged accounts and audit existing OAuth app consents. After a suspected device-code compromise the only persistent-token clearing path is Revoke-MgUserSignInSession — refresh tokens survive password resets.
• Audit .github/workflows/*.yml across every internal fork and rotate CI cloud credentials issued during the Megalodon window on 2026-05-18. SafeDep and OX Security published the SysDiag and Optimize-Build payload markers and committer-identity tells; look for the forged build-bot / auto-ci / ci-bot / pipeline-bot author strings on commits dated to that day. Move CI to OIDC-based trusted publishing where long-lived cloud credentials still exist.
• Hunt for Entra ID Add device events and roadtx user-agent strings following the Unit 42 ROADtools write-up; restrict device registration to compliant / hybrid-joined devices and enforce Conditional Access token-protection on admin sessions. Midnight Blizzard / APT29 has a documented EU diplomatic-tenant targeting pattern — Swiss federal and EU institution Entra estates are direct.
• Re-baseline DDoS scrubbing capacity against a 10–30 Tbps reference and re-check AS-level ingress blocklists. AS44477 (legacy Stark) and AS209847 (THE.Hosting / WorkTitans) are the relevant ASNs per Recorded Future's 2025 Insikt Group analysis — verify the current routing-table state via your IRR / RPKI tooling before pushing a blocklist update, since the post-FIOD seizure could have reshuffled BGP advertisements. The Kimwolf and Stark / WorkTitans takedowns reduce immediate supply but DDoS-for-hire reorganises within weeks; treat the moment as a capacity exercise window, not a closed risk.

Migrated from briefs/2026-05-23.md (v2).