2026-05-27-0b6f12dd

• Items dropped:
  • MuddyWater / Seedworm DLL side-loading campaign (Symantec / Broadcom Threat Hunter Team) — surfaced by two sub-agents, but the primary Symantec analysis is dated 2026-05-12 (one agent) / 2026-05-22 (the other); the only in-window source is a 2026-05-26 The Hacker News restatement with no fresh exploitation, victim or patch development. Out of window per PD-7 (primary older than the 36 h window, no fresh in-window delta, not a previously-covered item eligible for an UPDATE). High-relevance Iran-aligned espionage campaign (signed-binary DLL side-loading via fmapp.exe / sentinelmemoryscanner.exe, ChromElevator) noted for the record; will reconsider if a fresh national-CERT or victim development lands.
  • Five-year database-ransom census (ransomnews.com) — single-source from a small, independently unverified research organisation; corroboration was a Security Affairs restatement, not independent reproduction. Headline figures (46.3% of 65,907 exposed databases, 215+ billion records, BTC-wallet economics) are vanity-metric-style aggregates that PD-4 excludes; dropped as [SINGLE-SOURCE] / reduced-confidence. Underlying defender lesson (never expose MongoDB/MySQL/Elasticsearch to the internet unauthenticated) is already standard hardening.
  • The Oncology Institute SEC 8-K Item 1.05 (third-party vendor breach) — the SEC EDGAR filing URL returned HTTP 403 to the sub-agent, so the primary filing text could not be verified in-run; the only verifiable source was a single SecurityWeek article, and the TriZetto/Cognizant vendor attribution is SecurityWeek's timeline-based inference, not stated in the filing. Dropped as reduced-confidence / single verifiable source; US-only healthcare with indirect CH/EU relevance.
  • Mini Shai-Hulud (TeamPCP) § 4 UPDATE — dropped at the verification cap. The UPDATE's sole citation was CERT-FR's weekly bulletin CERTFR-2026-ACT-023, and across this run's verification loop three independent verifier reads of that exact URL contradicted each other: one read it as the campaign bulletin with no named victim, one quoted a French sentence stating ANSSI is aware of several French victims, and the iteration-5 (cap) verifier fetched it and reported it as a week-21 vulnerability roundup (Drupal/F5/Microsoft/Cisco/Linux-kernel) with no mention of TeamPCP, Mini Shai-Hulud, the named packages, the source-code leak, or French victims. Because the claimed delta (widened package scope, source-code leak, French-victim awareness) could not be reliably tied to the cited source and no alternate source was fetched for it, the entire UPDATE — its TL;DR bullet and § 6 action item included — was dropped rather than published on an unverifiable attribution (PD-1). The Mini Shai-Hulud / TeamPCP campaign itself remains real and was last covered 2026-05-26; only today's CERT-FR-sourced delta is withheld pending a verifiable source.
• CVEs that did not clear a § 2 inclusion gate:
  • CVE-2026-45659 — Microsoft SharePoint Server 2016/2019/SE deserialization RCE (CVSS 8.8) — fails all § 2 gates: post-auth (minimum Site Member, PR:L), CVSS below 9.0, MSRC "Exploitation Less Likely", not CISA-KEV, no public PoC. Surfaced by three sub-agents and carries NCSC-CH (advisory 12594) and BSI (WID-SEC-2026-1652) same-day advisories on the out-of-band CVE addition. Operational note for Swiss/EU public-sector SOCs: the CVE was added to Microsoft's set out-of-band on 2026-05-26 after shipping in the May 2026 Patch Tuesday — ensure vulnerability-management tooling ingests the late CVE so already-patched farms are scored correctly.
  • CVE-2026-44895 — yoda-digital mcp-gitlab-server < 0.6.0 (no-auth SSE RPC endpoint, CVSS 4.0 = 9.2) — clears the EUVD CVSS 9.0–10.0 gate but is a niche npm MCP-server package with marginal deployment in the target audience; not promoted to § 2. Relevant only to teams running this specific MCP GitLab bridge bound to 0.0.0.0 with wildcard CORS — patch to 0.6.0 if in use.
• Single-source items included: CVE-2026-9642 (Delta DIAView, Tenable Research TRA-2026-44 only) — marked [SINGLE-SOURCE] in § 2; included on Tenable's HIGH-reliability researcher standing.
• Recency: standard 36 h window (24 h gap to 2026-05-26). The Nimbus Manticore § 4 UPDATE cites Check Point Research dated 2026-05-22; included as an UPDATE on previously-covered UNC1549 (2026-05-23) carrying material new technical detail and broad in-window (2026-05-26) amplification.
• Contradictions / unresolved: sub-agents reported the Symantec Seedworm primary as 2026-05-12 (S3) vs 2026-05-22 (S1); unresolved, but the item was dropped on recency grounds regardless. Charter disputes ShinyHunters' 42M-record claim and asserts no sensitive PI/CPNI was taken — the brief reports both the actor claim and the victim's dispute rather than adjudicating. On 7-Eleven, the two cited sources differ on the exposed field set — BleepingComputer lists names, DOBs and contact/address data (no SSN / driver's licence), while CyberInsider additionally reports SSNs and driver's licence numbers; the brief reports both with attribution rather than asserting the high-sensitivity fields as settled.
• Verification: the brief ran the full 5-iteration verification loop without reaching a CLEAN verdict (cap-breach safety valve), rotating Opus (iterations 1, 3, 5) and Sonnet (2, 4). Net effect across iterations: a wrong Security Affairs URL on the Nimbus Manticore item was removed and the cert claim re-anchored to Check Point; the missing @tanstack/@squawk packages were added (then the whole Mini Shai-Hulud item was later dropped, see below); an unsourced "first" superlative was removed from the Tycoon 2FA deep dive; the 7-Eleven field-set attribution was split between BleepingComputer and CyberInsider; and the CVE-2026-9312 citation was moved onto the static-HTML GHSA advisory. The iteration-5 (cap) verifier found the § 4 Mini Shai-Hulud UPDATE's sole CERT-FR citation unverifiable (three iterations read that URL three different ways), so that UPDATE was dropped. verification_residual_count = 2 records the iteration-5 truth findings, both resolved by dropping the affected item rather than left in the published brief.
• Sub-agents: all four (S1–S4) returned within the wall-clock cap; no stalls.
• New source candidate (this run): cyberinsider (cyberinsider.com — breach journalism, server-rendered, no 403) added as candidate; it contributed corroborating primaries to the Charter and 7-Eleven confirmations. Overflow candidates not added (one-per-run cap): security.com (Symantec/Broadcom Threat Hunter Team's current domain; the old symantec-enterprise-blogs.security.com URL 404s — worth a future source-URL update).
• Coverage gaps: databreaches-net (bridge 403 for 7th consecutive run); inside-it-ch (bridge 403×5); sophos-xops (503); trendmicro-research (500); greynoise (no structured RSS feed); volexity (malformed RSS, no 2026 items surfaced); securityweek (feed 403, covered via article fetches); sec-edgar (archive 403 on individual filing pages — full-text search bridge works, filing htm does not); cnil-fr, edpb, ncsc-ie, safeonweb-be, ncsc-uk, cert-pl, jpcert — no in-window qualifying items found this run.

Unmatched action items (migrated)

• Harden government register / cadastral API access — for CH/EU public-sector register operators: enforce MFA on institutional service accounts, anchor institutional access to known ASNs/IP ranges, apply per-institution query-rate limits, and alert on bulk-query bursts outside business hours. Drawn from the Lithuania Centre of Registers breach in § 1.
• Close the Salesforce-Aura path — audit Experience Cloud guest-user object permissions, enable Secure Guest User Record Access, restrict SSN/government-ID fields to named users, and enforce phishing-resistant MFA (FIDO2/passkeys) on SaaS admin accounts. Drawn from the ShinyHunters update in § 4.
• Deploy AiTM/device-code detection and policy — stand up the Microsoft Graph reconnaissance-burst hunt and cross-tier (two-ASN, same c_sid) correlation, enable Conditional Access Token Protection, and block the OAuth Device Code flow for users who do not need it. Do not treat Entra Identity Protection as sufficient coverage on its own. See § 5.

Migrated from briefs/2026-05-27.md (v2).