2026-06-07-0885f123

• Items dropped — already covered (PD-8 dedup):
  • Luna Moth / Silent Ransom Group (UNC3753) law-firm campaign — surfaced by S3 and S4 (Mandiant, 2026-06-05) but was the full deep dive on 2026-06-06; no new in-window development beyond what that deep dive already consolidated.
  • HTTP/2 Bomb (CVE-2026-49975) — surfaced by S2 (NCSC-CH advisory 12610, 2026-06-04); was the deep dive on 2026-06-04 and was already explicitly excluded on 2026-06-06 as national-CERT pickup, not a material new development.
  • CVE-2022-0492 Linux cgroup v1 container escape — surfaced by S1 (CISA KEV addition, 2026-06-02); was the deep dive on 2026-06-03. KEV-deadline status is not a fresh threat fact (PD-13).
  • BigBlueButton CVE-2026-46351 / CVE-2026-46353 — surfaced by S2 (BSI WID-SEC-2026-1804, 2026-06-04); these CVEs were first seen 2026-05-19 and the patch has been available since January 2026. The BSI advisory is national-CERT pickup with no material delta.
• Items dropped — out of window / insufficient signal:
  • CVE-2026-41096 Windows DNS Client heap overflow (S1) — freshest source NCSC-NL advisory 2026-06-02 (outside the 36 h window); Microsoft rates exploitation "Unlikely", no public PoC, no in-the-wild activity — does not clear a § 2 inclusion gate.
  • FIFA World Cup 2026 fraud ecosystem (S4, FortiGuard 2026-06-04) — the Ghost Stadium phishing operation was covered on 2026-05-30 and a Unit 42 FIFA forecast was already dropped on 2026-05-31 as overlapping; the new FortiGuard report adds Android-trojan detail (Massiv/Perseus) but leans on loss-estimate metrics (PD-4) and overlaps prior coverage.
  • Ultrahuman wellness-data breach (S4, TechCrunch 2026-06-03) — freshest source outside the 36 h window; no Swiss/EU public-sector nexus. The 68-day GDPR notification-delay angle was noted but did not clear the relevance bar.
• Single-source items: SANS ISC steganographic JPEG loader (§ 3) — SANS ISC diary is the only source; included as a HIGH-reliability research handler diary describing a technique chain (not an actor attribution).
• Recency latitude: on a quiet 24 h cycle the standard 36 h window yielded few items; Keycloak (2026-06-04), the Magecart/Stripe skimmer (2026-06-04), the polyfill[.]io reactivation (2026-06-05) and the SANS ISC chain (2026-06-05) have freshest sources 40–64 h old — inside the 72 h developing-story window and all genuine first-coverage, not re-reports.
• Corrections applied during verification (iteration 1): the Chrome 149 CVSS 9.6 sandbox escape was initially research-reported with an incorrect identifier and a "USB use-after-free" component; a direct re-fetch of the SecurityWeek and Chrome Releases sources confirmed the correct identifier is CVE-2026-10881, an out-of-bounds read/write in the ANGLE graphics engine — corrected throughout the brief. The Keycloak deep dive's research-supplied GitHub Security Advisory reference resolved to an unrelated 2022 advisory, and the cited CERT-FR avis covered an earlier Keycloak branch (≤ 26.5.5), not 26.6.3; both were removed, and the deep dive is now sourced to Keycloak's own 26.6.3 release notes (the authoritative primary disclosing party, re-fetched to confirm the CVE list and the "silent subject_token removal" wording). An unverified SAML-denial-of-service identifier attributed to the prior 26.6.2 release was dropped. The Magecart Stripe-skimmer record-creation date was corrected from 2024-12-24 to 2025-12-24 per the Sansec source.
• Contradictions: none identified this run.
• Stalled sub-agents: none — all four research sub-agents (S1–S4) returned within budget.
• Candidate source: depthfirst (depthfirst.com) surfaced by S1 and S3 as the primary for the FFmpeg AI zero-day research; recorded as a candidate in sources/sources.json for promotion after three contributing runs.
• Coverage gaps: inside-it-ch (Cloudflare Managed Challenge, transport-403, 5-run gap); sophos-xops (HTTP 503, 5-run gap); databreaches-net (Cloudflare challenge, transport-403, 5-run gap); sec-disclosures-edgar (EDGAR full-text-search returned 0 8-K Item 1.05 filings in window); zdi (blog RSS 404, no in-window post); shadowserver (no in-window advisory); dragos (no in-window OT/ICS research); sans-ics (no in-window ICS-specific item); kaspersky-securelist (Argamal RAT article outside window); cert-eu (no advisory newer than 2026-05-06); enisa (no in-window news/EUVD items beyond already-covered); ncsc-ch-weekly (week-23 wochenrückblick 404, not yet published); csirt-acn-it (no in-window Italy items); cert-fr-actu-recent (actualité feed stale); edpb, cnil-fr, ico-uk (no in-window cyber-incident disclosures).

Unmatched action items (migrated)

• Hunt token-exchange abuse in Keycloak event logs — alert on token_exchange events that issue a token while subject_token is absent, and on exchanges crossing a privilege boundary (see § 5 detection concepts).
• Inventory bundled FFmpeg (libavcodec/libavformat) via SBOM or runtime scan and prioritise patching hosts that parse externally-sourced media or accept RTP/RTSP streams (§ 3); isolate media-processing services from internal networks.
• Grep all web properties for residual polyfill[.]io references and replace with legitimate mirrors or self-hosted polyfills; enforce Subresource Integrity on third-party scripts (§ 1). Web-proxy 401 responses from polyfill[.]io pinpoint pages still loading the script.
• For Magento/Adobe Commerce + Stripe merchants: audit Google Tag Manager container contents against an approved list and alert on Stripe customer-creation events that do not map to real orders (§ 1) — browser-side CSP will not catch the api.stripe.com skimmer.

Migrated from briefs/2026-06-07.md (v2).