2026-06-19-c306b105

• Items dropped (relevance / less-is-more): Kaspersky — malicious Steam Workshop "application wallpapers" distributing DarkComet/Lumma/Vidar (S3): consumer/gaming exposure, no public-sector nexus, single-source — below the daily bar. Nintendo employee data via the TinyPulse/WebMD breach (S4): single-source (BleepingComputer), technology/entertainment sector; the third-party-HR-SaaS lesson is already carried more richly by the Icarus/Klue item. "Popa"/Vo1d residential-proxy botnet on Android TV boxes (S3, Krebs): only the Krebs primary was actually fetched this run; the Synthient corroboration URL was listed but not verified in the URL-liveness ledger, leaving the item effectively single-source, and its relevance to a public-sector SOC is marginal — dropped rather than cite an unfetched URL.
• Items dropped (out of recency window, window_hours=36): EvilTokens device-code phishing-as-a-service (S3): although Switzerland is explicitly listed in the victim geography, the freshest fetched source is the ESET write-up of 2026-06-15 and the substantive primary (Sekoia) is from March 2026 — both outside the 36 h window with no fresh in-window development. Will resurface as an UPDATE if a fresh delta appears.
• Items dropped (already covered, no material delta): DragonForce Backdoor.Turn Microsoft Teams TURN-relay C2 + five-driver BYOVD (S3): this was the 2026-06-17 deep dive; the Symantec analysis re-surfaced via aggregators on 2026-06-18 but carries no new development.
• Broken-link remediation (verification iterations 1–2): seven cited URLs were 404 wrong-slug or redirect-to-homepage at compose time and were replaced with re-fetched live equivalents, or dropped: Politie and Proofpoint (Operation Endgame), ReliaQuest and BleepingComputer (Icarus/Klue — BleepingComputer dropped as its replacement could not be content-confirmed), The Record (ICO — replaced with the ICO's own regulator-primary statement, fetched via the bridge after the routine UA 403'd), Help Net Security (GentleKiller — corrected slug), and CCB Belgium (pgAdmin — the original advisory path 301-redirects to the CCB homepage, and the same-titled advisory at the new canonical path is in fact a stale 2025 CCB advisory for older pgAdmin CVEs, so the CCB citation was dropped entirely). The underlying facts were independently corroborated in every case.
• pgAdmin sourcing note: the pgAdmin 4 § 2 item's primary is the project's own v9.16 coordinated-disclosure release notes (authoritative for the CVEs, prerequisites and fixed versions); the CCB Belgium corroborator was dropped after it resolved to a stale 2025 advisory, and because the release notes publish no CVSS, the CVSS v4 9.5/9.4/9.3 figures are sourced from and cited to ENISA EUVD (EUVD-2026-37966 / -37965 / -37968) as the additional source.
• Single-source items (included, flagged inline): Sophos X-Ops — AI adoption in the underground (§ 3) rests solely on Sophos Counter Threat Unit's own forum monitoring (HIGH-reliability vendor research); the named open-source tooling is publicly verifiable but the specific forum-actor claims cannot be independently corroborated.
• Contradiction (resolved): S1 read CVE-2026-20190 as CVSS 7.5 (improper authorization / unauthenticated data read) while S2 reported 9.1 for the same CVE. Cisco groups both ISE CVEs under one advisory (cisco-sa-ise-multi-G5WP8vv); the brief uses the per-CVE breakdown CVE-2026-20181 = 9.1 (authenticated root command execution) and CVE-2026-20190 = 7.5 (unauthenticated read), which matches the more granular sub-agent read and Cisco's separation of the two flaws. Verify against the linked Cisco advisory before acting if the exact score is operationally load-bearing.
• § 2 inclusion note (Drupal): the lead CVE-2026-55803 requires authenticated JSON:API write permission plus a non-default serialized field type, and no in-the-wild exploitation or public PoC is reported — so it does not clear the § 2 active-exploitation/PoC gates on exploitation maturity. It is included on the basis of BSI's kritisch aggregate rating and Drupal's heavy Swiss/EU government-CMS footprint, framed as a patch-prioritisation item rather than an imminent-exploitation one.
• No Immediate Action callout: all four critical advisories this run (Cisco ISE, pgAdmin, NGINX, Drupal) lack confirmed in-the-wild exploitation or a public working PoC against internet-exposed deployments, and the Defender LPE (CVE-2026-50656) is a local-access elevation, not a "stop-everything" internet-facing pre-auth RCE. None meets the callout bar.
• Coverage gaps: inside-it-ch (Cloudflare Managed Challenge 403, no usable Wayback snapshot — gap in 7+ consecutive runs, rotation-priority); databreaches-net (transport-403, no Wayback snapshot); csirt-acn-it (SPA, no structured advisory endpoint reachable); edpb (TLS/connection timeout); cnil-fr (no in-window items); sec-disclosures-edgar (zero Item 1.05 8-K filings in the window — genuinely empty); cert-pl (SPA, no RSS); anssi-fr (most recent CERT-FR avis 2026-06-12, out of window); vulncheck (RSS endpoint 404); dragos, dfirreport (no new in-window OT/DFIR content); chrome-releases (RSS 302 redirect).

Unmatched action items (migrated)

• Upgrade pgAdmin 4 to v9.16 and restrict server-mode exposure (§ 2). Until patched, keep the server-mode interface off untrusted networks, disable the AI Assistant, and rotate the Flask SECRET_KEY; review server logs for unauthenticated requests to /sqleditor/close/ and the update_connection endpoint.
• Hunt for SocGholish stage-1 and harden any WordPress estate you run (§ 1). Alert on wscript.exe/mshta.exe spawned from a browser process and on browser-initiated .zip downloads from WordPress hosts; audit wp-admin credentials and theme-file integrity. The takedown removes infrastructure, not the technique.
• Audit Salesforce Connected-App OAuth grants and stream Event Monitoring to your SIEM (§ 1, Icarus/Klue). Revoke dormant/prototype third-party integrations, enforce short token TTLs and IP-range restrictions, and alert on SObject enumeration and bulk SOQL from integration users.
• Enable HVCI / Microsoft Vulnerable Driver Blocklist and WDAC driver allowlisting (§ 3, GentleKiller). Hunt for service creation loading unexpected kernel drivers, DeviceIoControl from non-security processes, and process-termination loops against security tooling.
• Block the removable-media worm vector (§ 1, CryptoBandits). Enforce NoAutorun/NoDriveTypeAutorun, block LNK execution from removable media via ASR, restrict wscript.exe/cscript.exe to signed scripts, and block Tor egress (localhost:9050 SOCKS5 from non-Tor processes).

Migrated from briefs/2026-06-19.md (v2).