2026-05-29-c7f56b00

• Items dropped (already-covered, duplicate of in-window prior coverage):
  • Tycoon 2FA AiTM detection-engineering analysis (Elastic Security Labs, 2026-05-26) — surfaced by S3 as a candidate, but the same Elastic Security Labs piece and the same eSentire OAuth-Device-Code corroboration were already the substance of the deep dive in 2026-05-27 and of the original Tycoon 2FA deep dive in 2026-05-18. No material new development in window. Drop per PD-8.
• Single-source items kept: none kept as [SINGLE-SOURCE] in published items this run — both Apereo CAS (Apereo + CERT-FR) and the FortiClient / EKZ campaign (Arctic Wolf + Fortinet PSIRT + The Hacker News + NVD) cleared two-source verification.
• Items dropped (low signal-to-noise for this audience):
  • BTMOB Android RAT (ESET, 2026-05-26) — surfaced by S1 as SINGLE-SOURCE; folded into the § 3 Grandoreiro item as a corroborating Iberian-banking parallel rather than promoted to its own H3. ESET + WatchGuard via § 3 supply the two-source view.
• Reduced confidence: Apereo CAS patch version 7.3.7.1 carries MEDIUM confidence on technical impact because Apereo withheld full detail pending the security grace window. Tracked for follow-up.
• CVEs that did not clear § 2 inclusion gates (no exploitation, no PoC, no KEV, no pre-auth RCE on internet-exposed software): the lower-severity GitLab batch CVEs (CVE-2026-1402, CVE-2026-2601, CVE-2026-5296, CVE-2026-8716) are documented inside the parent GitLab item but did not warrant their own H3.
• Contradictions surfaced:
  • Gogs zero-day CVE id: S1 documented no CVE assigned at publication, while S3 referenced CVE-2026-26194. Rapid7's blog post is unambiguous that the maintainer has not responded and no patch exists; the CVE-id claim from S3 could not be re-verified against an authoritative NVD entry in this run. The brief is written conservatively without the CVE id; verification of CVE-2026-26194 is deferred to the next run.
  • GitLab patch-release CVE count: the § 2 GitLab item summarises six CVEs (CVE-2026-4868, -6713, -1402, -2601, -5296, -8716) — the GitLab patch-release page enumerates seven (an additional CVE-2026-2710 is listed inline). Brief should be read as covering the six highest-severity / most defender-relevant items in the bundle; CVE-2026-2710 details are left to the vendor page until next-run re-pivot.
  • Carnival breach date: the Maine AG filing records the breach as occurring 2026-04-10 with discovery on 2026-04-14, while Carnival's PR Newswire substitute notice describes 2026-04-14 as the day the security team identified unauthorized activity. The brief reports both dates with the breach-vs-discovery distinction surfaced in body text rather than picking one.
• Sub-agents: all four returned within budget. S1 Sonnet 4.6 (684 s, 22 webfetch / 9 websearch / 14 bridge), S2 Sonnet 4.6 (348 s, 18 / 12 / 10), S3 Sonnet 4.6 (771 s, 12 / 4 / 18), S4 Sonnet 4.6 (753 s, 17 / 22 / 6). No stalled agents.
• Verification (Phase 5.7): four iterations (Opus → Sonnet → Opus → Sonnet). Iter 1 NEEDS_FIXES (truth=6, editorial=4, advisory=2) → iter 2 NEEDS_FIXES (1, 2, 0) → iter 3 NEEDS_FIXES (3, 1, 2) → iter 4 NEEDS_FIXES (1, 0, 0). Iter 4 was published via the v2.50 early-exit rule (truth+editorial ≤ 2 AND no F1/F4); the iter 4 finding ("Check Point count: brief said more than 332, source says approximately 332") was applied as a best-effort remediation in-place but the iteration's NEEDS_FIXES verdict stands. verification_residual_count = 1.
• Coverage gaps: databreaches-net (transport 403, no Wayback snapshot — Carnival breach covered via PR Newswire + The Record + The Register); sophos-xops (HTTP 503 on feed); inside-it-ch (HTTP 403 even via bridge); dragos, shadowserver, sekoia, volexity, greynoise (feeds returned 404 — likely upstream feed-URL drift, candidate for source-list review next run); cert-at, csirt-acn-it (not enumerated in this run); SEC EDGAR Item 1.05 (0 hits in window — Carnival filed substitute notice via PR Newswire and state AGs, not 8-K); CNIL-FR, EDPB, ICO-UK (no in-window enforcement actions); cisa-directives, tenable-research, cisco-psirt, greynoise (quiet in window). Inside-IT.ch's persistent 403 pattern is now the 4th run in 7 — candidate for the next source-list review.

Unmatched action items (migrated)

• Upgrade Fortinet FortiClient EMS 7.4.5 / 7.4.6 → 7.4.7 immediately and assume managed-endpoint compromise where the patch lagged. Active ITW exploitation delivers EKZ Infostealer through the trusted EMS update channel. Apply Fortinet PSIRT FG-IR-26-099 per § 5 above; have the fronting reverse proxy strip / overwrite X-SSL-CLIENT-VERIFY before forwarding to EMS as a defence-in-depth control. Rotate cached browser credentials and treat managed-endpoint session cookies as compromised wherever EMS ran 7.4.5/7.4.6 unpatched.
• Patch Samba to 4.22.10 / 4.23.8 / 4.24.3 on every Linux file / member server; AD DCs are unaffected. Compensating mitigation if the upgrade slips: remove %u from any check password script, wrap %J in single quotes inside print command, and set rpc start on demand helpers = yes (default). Two CVSS 10.0 unauthenticated RCEs make this an immediate change-window candidate.
• Patch Portainer CE to 2.33.8 / 2.39.2 / 2.41.0 and revoke Docker / Swarm endpoint access for non-admin users in the interim. CCB Belgium's Patch Immediately warning targets exactly the deployment shape — non-admin users with endpoint access can reach the unguarded plugin endpoints and Swarm-service API and escalate to host code execution.
• Upgrade SUSE Rancher to 2.10.12 / 2.11.14 / 2.12.10 / 2.13.6 / 2.14.2 and audit GitHub-App authentication / project-owner RBAC. Three concurrent paths to host code execution or cluster-admin escalation; the GitHub-App over-inclusive team membership in particular can be quietly abused.
• Patch IBM HTTP Server / WebSphere via APAR PH71265; disable mod_ibm_upload and mod_mem_cache where unused. Pre-auth RCE at CVSS 9.8 on a middleware widely deployed in Swiss banking, insurance and federal IT — NCSC.ch flagged the advisory specifically for CH consumers.
• Mitigate the unpatched Gogs RCE on every self-hosted instance. Set DISABLE_REGISTRATION = true in app.ini, disable Rebase before merging under instance settings, and consider migration to Gitea / Forgejo. Hunt for git invocations with --exec whose parent is the Gogs binary (Sysmon EID 1 / auditd EXECVE).
• Hunt for The Gentlemen kill-chain artefacts across the AD estate. Look for wevtutil cl Security|System|Application chained with sc stop WinDefend or msconfig; svchost32.exe spawned outside %SystemRoot%\System32; CcmExec.exe launching non-SCCM payloads; GPO modifications (Event ID 5136) and the hidden SMB share mount (Event ID 5140). Enable the Block process creations originating from PsExec and WMI commands ASR rule per Microsoft's ASR rules reference and run EDR in block mode where possible.
• Upgrade Apereo CAS to the fixed version 7.3.7.1 on any deployment configured as an OIDC IdP, even with technical detail withheld. CH-discovered (Coop Switzerland reporter) and CERT-FR-flagged; until detail is public, monitor OIDC token issuance logs for tokens to unregistered clients and anomalous sub claim values.
• Patch GitLab to 19.0.1 / 18.11.4 / 18.10.7 and Veeam B&R / Agent to 13.0.2.29 within the next change window. Highest-severity GitLab issue is the Duo AI identity-impersonation flaw; Veeam's Linux-appliance arbitrary file write is constrained to Backup Administrator role but a viable stepping stone to RCE. Review Veeam backup-administrator least-privilege at the same time.
• Refresh residential-proxy detection logic post-Asocks takedown. Asocks joins a recent sequence of disrupted networks (SocksEscort, Aisuru/Kimwolf, FirstVPN, IPIDEA, RapperBot per Risky Bulletin); retune CGNAT / consumer-ISP-RDNS correlation rules on M365 / Entra ID sign-in logs and on VPN concentrator authentication.

Migrated from briefs/2026-05-29.md (v2).