2026-05-28-3e33200a

• Items dropped — vulnerabilities that did not clear § 2 inclusion gates.
  • CVE-2026-9256 / CVE-2026-42945 — NGINX double rewrite-module heap buffer overflow. S1 surfaced these as actively-exploited per NCSC-NL CSAF (NGINX meldt bekend te zijn met (pogingen tot) misbruik), but the freshest sources are dated 2026-05-22 (NGINX vendor advisory and oss-security mailing list) and 2026-05-18 (NCSC-NL) — both outside the 40-h recency window with no in-window corroborator surfaced. Dropped to § 7 rather than included as a stale exploitation note. Patch is still relevant — 1.31.1+ or 1.30.2+ — defenders running unpatched NGINX should not wait for a future brief to act.
  • CVE-2026-45659 — Microsoft SharePoint Server CWE-502 deserialization RCE (CVSS 8.8). S1 + S2 both surfaced; NCSC.ch flagged on 2026-05-26 in CSH 12594 (Microsoft MSRC; NCSC-CH post 12594; Help Net Security, 2026-05-26). Did not clear § 2 inclusion gates: post-auth (Site Member, PR:L), no CISA KEV, no ENISA EUVD exploited=true, no in-the-wild exploitation confirmed, CVSS 8.8 below the 9.0 EUVD-critical floor, and no public PoC reported. Defenders running on-prem SharePoint should still apply the May 2026 CU (SE 16.0.19725.20280 / SP2019 16.0.10417.20128 / SP2016 16.0.5552.1002) — the prior history of rapid weaponisation of SharePoint deserialization gadget chains supports priority patching even without current exploitation evidence.
  • CVE-2026-27771 — Gitea container-registry access-control failure (~30,000+ deployments). S1 + S3 both surfaced (NoScope, 2026-05-25; The Hacker News, 2026-05-27). Patched in Gitea v1.26.2 (released 2026-05-20). Did not clear § 2 gates — unauthenticated image-pull (data-exposure), not RCE; no KEV / EUVD-critical / confirmed in-the-wild exploitation. Forgejo (the fork used by Codeberg and many EU academic instances) confirmed affected. The four-year window of exposure means retrospective log review for unauthenticated /v2/<namespace>/<repo>/{manifests,blobs} GETs is warranted on any self-hosted Gitea / Forgejo instance running below 1.26.2; rotate any secrets embedded in container images that were stored as private.
  • Grandoreiro + BTMOB Android RAT (WatchGuard / ESET, 2026-05-26). Surfaced by S3. Banking-only sector (Portugal / Spain / Brazil / Europe consumer-banking customers); did not clear the daily-relevance bar for a Swiss/EU public-sector SOC audience. Mentioned here so the next run does not re-surface it as new.
  • Catalin Dragomir / Oregon OEM sentencing (TheRecord, 2026-05-27). Surfaced by S4. 2021 access-broker sentencing is procedurally significant but the underlying breach is years old and the operational signal — emergency-management network as access-broker target class — is generic; below the daily inclusion bar. Logged here for next-run dedup.

• [SINGLE-SOURCE] items. § 3 SANS Internet Storm Center Akira kill-chain reconstruction — single primary publisher, but a high-reliability technical forensic primer; included per PD-5 carve-out (HIGH-reliability primary research source). No defender action flows from the item that needs a second confirmation.

• Reduced confidence — only aggregator sources. § 1 FBI FLASH CSA 260526 (Silent Ransom Group physical-USB tactic) — the FBI IC3 primary PDF (https://www.ic3.gov/CSA/2026/260526.pdf) returned HTTP 403 to the routine UA and to the bridge fetcher; the three cited sources (CyberScoop, The Record, Help Net Security) are all news aggregators paraphrasing the same FBI advisory. The advisory itself is the substantive primary; operators should fetch the IC3 PDF directly from a desktop browser session to confirm the verbatim text before acting.

• MuddyWater / Symantec primary-source date resolution. S1 reported the Symantec primary as 2026-05-22; S3 reported it as 2026-05-26. Phase 5.7 iteration 1 independently extracted the actual Symantec publication date as 2026-05-12 (and Industrial Cyber as 2026-05-13). § 3 has been re-dated to those values; The Hacker News (2026-05-26) is the in-window publication that pulled the story back to surface and is the reason the item appears in this brief at all. Under PD-7's "freshest source in window" reading the item remains in scope; readers should note the underlying Symantec research is two weeks old.

• Contradictions across linked sources. Germany Cybersicherheitsstärkungsgesetz staffing figure — onvista (dpa) reports "more than 350 new positions" across BKA / BSI / Bundespolizei plus ~€50 million per year; t-online reports a notably smaller initial figure (37 additional employees). The brief carries the dpa-sourced ~350 framing because the onvista/dpa wire is more likely to reflect the cabinet's published bill text; the t-online figure may refer to one specific agency or a phased intake. Operators tracking the bill's progression should follow the Bundestag-stage publication for the authoritative position count.

• Stalled or non-returning sub-agents. None — all four cti-research sub-agents returned within the 30-min hard cap (S1: 527 s; S2: 496 s; S3: 542 s; S4: 560 s).

• Verification loop. Phase 5.7 ran four iterations (Opus → Sonnet → Opus → Sonnet, per the v2.47 model-rotation contract). Iteration 4 returned NEEDS_FIXES with one F3 (citation-does-not-support-claim) finding — the AFC Ajax TL;DR bullet retained the iter-3-flagged "granted himself access" framing after the § 1 body had been re-paraphrased. That TL;DR-vs-body inconsistency was remediated post-iter-4 (TL;DR rewritten to match the § 1 body's neutral phrasing). Per v2.50 early-exit (truth + editorial ≤ 2 AND no F1/F4), the brief publishes with verification_residual_count = 1 (the iter-4 F3 finding, since fixed in place — same disposition as a cap-breach reached at iter 4 rather than at iter 5). Two F11 advisories (Slican "hardcoded" / "widely deployed in Polish public sector" framing exceeds CERT-PL's direct language; ILIAS vendor blog list-page render date 2026-05-26 vs NCSC-CH 12599 publish stamp 2026-05-27) were deferred as defensible and non-load-bearing.

• Coverage gaps: databreaches-net (HTTP 403, sixth consecutive run — covered via BleepingComputer / TheRecord / SecurityWeek; not a real gap this run); inside-it-ch (HTTP 403, fifth consecutive run — no exclusive in-window CH-tech story surfaced via alternates); sophos-xops (HTTP 503, fifth consecutive run — no Sophos research story surfaced elsewhere in window); anssi-fr (avis-recent newest item 2026-05-20 — outside window; actu-recent stale at October 2025); ncsc-uk (RSS items 2022–2025 only, no in-window content); cisa-news (no fresh in-window emergency directive); apple-security, oracle-cpu, chrome-releases (no in-window vendor publication); dfirreport, sekoia (RSS empty for window).

• New candidate source surfaced — gambit-security. Israeli threat-intelligence firm with primary MOIS / Iran-linked research; the Ababil-of-Minab attribution report (2026-05-26) on the LACMTA breach is the discovery event. Surfaced by S4. Added to sources/sources.json as status: "candidate" per the one-candidate-per-run rule; promote after 3 successful contributing fetches.

• NoScope, the discoverer of CVE-2026-27771 (Gitea private container exposure), also surfaced as a candidate source by S3 but is deferred per the one-candidate-per-run rule. Carried as a coverage-gap note for next-run consideration.

• Hardcoded sinkhole IP avoided. CrowdStrike's post-takedown GlassWorm sinkhole at 164.92.88[.]210 is the operationally useful artefact for retrospective detection, but the brief avoids IPs per PD-3 (no IOCs). Operators acting on the GlassWorm § 1 item should obtain the sinkhole address directly from the CrowdStrike post and apply it in their network telemetry.

Unmatched action items (migrated)

• Inventory and patch ILIAS deployments to 9.20 / 10.8 / 11.1 today. Two critical access-control bugs (TileImageUploadHandler unauth file-write CVSS 9.8; MyStaff post-auth SQLi CVSS 9.3) plus seven further high-severity issues — see § 1. Interim mitigation per NCSC.ch: disable the SOAP interface (/webservice/soap/) on any deployment that does not require it for enterprise HR / SIS integration. Reference: ILIAS Security Blog, NCSC-CH 12599.
• Inventory VS Code / Cursor / Windsurf extensions across the developer estate against an approved-extensions allowlist; pin Nx Console to ≥ 18.100.0 and rotate every CI/CD secret accessible from a host that ran Nx Console v18.95.0 between 2026-05-18 12:30 and 13:09 UTC. See § 5 for the full chain — TanStack → Nx Console → GitHub / Grafana. CISA KEV adds 2026-05-27 confirm active in-the-wild exploitation. Reference: Nx postmortem.
• DAEMON Tools Lite — replace versions 12.5.0.2421–12.5.0.2434 with ≥ 12.6.0 on every host they were installed on. Trojanised builds signed by the legitimate vendor certificate during the 2026-04-08 → 2026-05-05 window — see § 5. Reference: Disc Soft Limited security notice.
• Hunt for GlassWorm-class developer infections in the network — focus on the dev estate. Even after the C2 takedown the endpoints remain infected; rotate every credential and CI/CD secret accessible from a developer host that installed extensions from VS Code Marketplace or Open VSX between early 2025 and 2026-05-26. Detection concepts in § 1. Reference: CrowdStrike.
• Reconcile local SSLVPN account directories against AD source-of-truth; enforce MFA on every SSLVPN account regardless of directory. SANS ISC's Akira walkthrough (see § 3) confirms deprovisioned-in-AD-but-retained-in-firewall accounts as the primary initial-access pathway for this class. Alert on >50 failed SSLVPN authentications from a single source per hour; set Windows Security log size ≥ 1 GB on every host so EID 4688 discovery-phase evidence does not roll off before incident response arrives.
• Defenders running large hypervisor estates — separate the recovery plane from the production identity boundary. The MOIS / Ababil-of-Minab LACMTA pattern (see § 1) explicitly targets backup and VM-lifecycle APIs for destruction in parallel with exfiltration. Treat backup-orchestration admin access as a separate identity boundary with MFA on backup-job execution and a tested air-gapped restore path that does not depend on the same identity provider as production.

Migrated from briefs/2026-05-28.md (v2).