2026-05-24-f1fd8070

• Items dropped (with reason):
  • NGINX CVE-2026-9256 — medium-severity heap buffer overflow in ngx_http_rewrite_module; no in-the-wild exploitation or public PoC, vendor-rated medium, and a sibling rewrite-module bug (CVE-2026-42945) was already covered 2026-05-18. Held below the § 2 inclusion gate.
  • Stormshield SNS CVE-2025-9086 (CERTFR-2026-AVI-0631, 2026-05-22) — remote denial-of-service only, single-source CERT-FR relaying Stormshield bulletin 2026-010. DoS-only with no code-execution path described; below the § 2 operational threshold despite the ANSSI-certified-firewall public-sector relevance.
  • The Oncology Institute (NASDAQ: TOI) SEC 8-K Item 1.05 (2026-05-22) — US/indirect nexus; the primary SEC EDGAR filing URL returns HTTP 403 to automated fetch and only an aggregator summary (Minichart) was reachable. Held out on source-quality and less-is-more grounds; the two-stage disclosure pattern (Nov-2025 Item 7.01 → confirmed patient-data access six months later) is noted for GDPR Art. 33 materiality-benchmarking interest.
• Reduced confidence: the BYOVD-without-hardware research (§ 3) rests on an Atos TRC write-up dated 2026-04-17 (~5 weeks before window), surfaced by in-window reporting (The Hacker News, 2026-05-22, both referencing NDSS Symposium 2026 paper 2026-s1491); included as MEDIUM confidence. Specific demonstrated-driver names were not retained because the primary's detailed body could not be re-verified in this run; the NDSS PDF was not machine-parseable and is not cited.
• Attribution — Unimed breach left open: all cited sources report the Unimed-breach perpetrator as unknown (heise: "It is not yet known who is responsible"; The Record: no actor publicly claimed responsibility). The Kairos / Hannover-Police attribution carried by heise applies to the separate ARWINI Lower-Saxony statutory-billing breach (covered 2026-05-19), not Unimed. The brief therefore leaves Unimed attribution open and presents the ARWINI resemblance explicitly as an analyst pattern observation rather than a sourced attribution.
• Scope (Unimed breach): the brief names the six university hospitals that issued individual disclosures (Cologne, Freiburg, Heidelberg, Tübingen, Ulm, Mannheim); heise and The Record indicate the affected set is larger (on the order of nine institutions), with further notifications likely given Unimed's broad hospital footprint.
• Source divergence (deep dive): Socket enumerates the Laravel-Lang stealer as ~17 collector classes with XOR obfuscation; Aikido describes 15 modules with AES-256 encryption. The brief follows the Aikido figures (cited inline); the divergence does not change the defender takeaway.
• No-IOC handling: the Laravel-Lang dropper's runtime-assembled C2 hostname was omitted per no-IOC policy; the deobfuscation behaviour is described instead. The /tmp/.sshd masquerade is retained as a host-based hunt concept (local path, not an attacker-controlled domain/URL).
• Single-source items: none admitted to §§ 1–5 (all multi-source); the dropped Stormshield item was the only single-source candidate.
• Candidate sources: 2 surfaced, 1 admitted per the one-per-run cap. Added ccb-belgium (Centre for Cybersecurity Belgium — Belgian national CERT; contributed the corroborating Unbound advisory this run). Held as overflow for a future run: vulnerability-circl-lu (CIRCL Luxembourg CVE lookup / EU-centric advisory cross-reference).
• Stalled sub-agents: none — S1–S4 all returned within the 30-minute budget.
• Coverage gaps: sophos-xops (HTTP 503, 6th consecutive run); trendmicro-research (HTTP 500, 3rd run); databreaches-net (HTTP 403, no usable Wayback snapshot); inside-it-ch (Cloudflare managed challenge on bridge); cert-eu (no new advisory in window beyond 2026-006); cert-fr-actualite (ACT feed stale since CERTFR-2025-ACT-049, 2025-11); darkreading (per-article 403, no Wayback); cnil-fr (no new in-window decision); edpb (120th plenary scheduled 2026-05-28); ico-uk (no new in-window enforcement beyond already-covered POCA action); sec-disclosures-edgar (direct filing pages 403, bridge used).

Unmatched action items (migrated)

• Audit Composer dependencies for the Packagist wave — check composer.lock for laravel-lang/{lang,http-statuses,attributes,actions} at 2026-05-22/23 tags and for the eight named Strand-2 packages; on any affected host treat all PHP-worker-reachable secrets (cloud keys, SSH, .env, Git tokens) as compromised and rotate (§ 5) (Socket, 2026-05-23).
• Patch recursive/authoritative DNS — upgrade to Unbound 1.25.1 and ISC BIND 9.18.49 / 9.20.23; monitor unbound/named for crash telemetry in the interim (§ 2) (NLnet Labs, 2026-05-20).
• Revise GCP incident-response runbooks — treat API-key deletion as a ~30-minute containment action, not an immediate one; monitor Cloud Audit Logs for post-deletion key use and prefer service-account keys where viable (§ 3) (Aikido, 2026-05-21).
• Inventory outsourced-billing data exposure (healthcare) — identify which third-party processors hold GDPR Art. 9 data, confirm Art. 32 measures, and hunt for large outbound transfers from billing/ERP systems with no inbound job trigger (§ 1) (The Record, 2026-05-22).
• Harden the npm side of CI — enable staged publishing on org-owned packages and set --allow-remote none / --allow-directory none in production pipelines (§ 4) (GitHub Changelog, 2026-05-22).
• Re-test the Windows Vulnerable Driver Blocklist against the Atos TRC hardware-gate-bypass techniques; enforce WDAC + HVCI and hunt Control\Class filter-key writes from non-SYSTEM processes (§ 3) (The Hacker News, 2026-05-22).

Migrated from briefs/2026-05-24.md (v2).