2026-06-25-da7fbd23

• Items dropped:
  • DifyTap (Dify cross-tenant flaws, CVE-2026-41947 / -41948 / -41949 / -41950) — already evaluated and dropped to § 7 on 2026-06-23; the grounds still hold (all paths require an authenticated editor/tenant account, no in-the-wild exploitation), so it does not clear the § 2 inclusion bar despite a stronger primary (Zafran) now being available.
  • OXLoader (Elastic Security Labs) — single-substantive-source and surfaced by two sub-agents with conflicting publication dates (19 vs 23 June) and conflicting technical descriptions (.reloc-section shellcode staging + anti-VM checks vs. process-hollowing + clipper); dropped pending a single reconcilable account.
  • Mini-Shai-Hulud / Miasma / Hades PyPI worm wave (Socket Security) — the substantive primary is dated 8 June, outside the 36 h window (one sub-agent's 24 June date appears to be the date of a Schneier commentary follow-up, not the primary); the Shai-Hulud family has prior coverage, so this is held for a cleaner in-window development.
  • DoJ seizure of Huione Group laundering infrastructure ($31B) — significant law-enforcement action but no patch/hunt/block/detect decision for a public-sector SOC; out of scope under less-is-more.
  • GhostSender / Ghost-Sender (Exchange Online sender spoofing, InfoGuard / Abnormal) — strong CH relevance, but the substantive InfoGuard research is dated 9 June (outside the 36 h window) and the two sub-agents returned materially different mechanism descriptions (direct-to-EOP submission bypassing the external MX gateway vs. cross-tenant outbound-relay abuse); dropped rather than publish an unreconciled mechanism. The in-window CH email-threat signal is carried by the NCSC-CH Week 25 item in § 1.
  • Cacti 1.2.31 (CVE-2026-39893 and the wider 1.2.31 cluster) — the only citable substantive source (Cacti GHSA-69gg-mjfm-jjpc) is dated 2026-06-19, outside the 36 h window, and covers only CVE-2026-39893; the additional CVEs and the 24-June ENISA EUVD indexing that would anchor it in-window are on a blocked-URL search page that cannot be cited inline. Dropped to avoid both an out-of-window item and over-attribution to a single advisory. Still worth patching: pre-auth SQLi (CVSS 9.8) reachable via default guest graph-viewing.
  • Arista EOS tunnel-decapsulation flaw (CVE-2026-7473) — initially drafted as a § 4 UPDATE on the back of an apparently-fresh Eclypsium analysis, but verification established the Eclypsium article is dated 2026-06-16 and the SecurityWeek piece 2026-06-10 — both outside even the 72 h developing window, with no in-window delta. The CVE was already covered on 2026-06-10 (KEV-listed, Arista SA-0137 mitigation); there is no new development this run, so it is dropped rather than recycled. Operators on EOS 4.x should still treat SA-0137 mitigation as permanent (no code fix planned).
• Single-source (national-CERT carve-out): NCSC-CH Week 25 voicemail-phishing item (§ 1) rests on the NCSC-CH Wochenrückblick as primary disclosing authority for Switzerland (PD-5 carve-out).
• Recency edge: the MISP 2.5.42 item (§ 2, released 2026-06-22) sits just beyond the 36 h standard window but inside the 72 h developing window; retained for its direct relevance to the threat-intel platform CH/EU public-sector SOCs run.
• Contradiction: Operation Endgame scale figures differed across sub-agents — one reported 296 servers / 66 domains / 25.6M credentials; the brief uses 326 servers / 142 domains / ~27M credentials / EUR 41M, the figure independently corroborated by Microsoft, ESET and BleepingComputer (the latter quoted verbatim).
• Verification: iteration 1 (cti-verification, Opus) returned NEEDS_FIXES (truth 6 / editorial 1 / advisory 1) — corrected a "no CVE published" error + dedup miss on the Arista flaw (CVE-2026-7473), narrowed MISP CVSS to the single GHSA-sourced score, dropped the over-attributed Cacti item, softened the Mistic capability framing, fixed the Operation Endgame directory-traversal attribution (researchers documented it; law enforcement used it), and rebound the Edgecution CloudFront quote. Iteration 2 (cti-verification-alt, Sonnet, with prior-iteration deltas) returned NEEDS_FIXES (truth 1 / editorial 1 / advisory 1) — removed a residual "in-memory BOF execution" phrase from the Mistic heading, and on finding the Arista sources are dated 06-16 / 06-10 (out of window) dropped the Arista item entirely rather than republish stale coverage. Iteration 3 (cti-verification, Opus, cold read) returned CLEAN (truth 0 / editorial 0; two non-blocking F11 advisories on quote-source labelling left as residual).
• Tooling: tools/source_health.py did not finish within its time budget this run (full-source network probe); the committed state/source_health.json is the prior snapshot. No impact on the brief.
• Coverage gaps: databreaches-net (HTTP 403 on the bridge for a third consecutive run — persistent transport block, not a dead source); cert-eu, cert-fr-avis, ncsc-ch-security-hub, ncsc-nl, cisa-kev, msrc (bridge-reachable but no net-new in-window items); mandiant-gtig, sophos-xops (feed fetch failures, exit code 1); inside-it-ch (Cloudflare-gated); ico-uk, cnil-fr (no in-window enforcement actions); broadcom-symantec, zscaler-threatlabz (SPA bodies unreadable from the bridge — content confirmed via corroborating publishers).

Unmatched action items (migrated)

• Audit GitHub Actions workflows for the Cordyceps pattern — flag every pull_request_target trigger that consumes ${{ github.event.pull_request.* }} content; adopt actions/checkout v7 or pin a safe configuration; scope GITHUB_TOKEN to contents: read; rotate secrets in affected repos. (See § 3.)
• Hunt for signed-Defender DLL sideloading (Mistic) — alert on EndpointDlp.dll loaded from a user-writable path or with a non-Microsoft signature (Sysmon EID 7), and on PowerShell spawned by Teams/Office clients. (See § 1.)
• Hunt for Native-Messaging bridging (Edgecution) — msedge.exe → native-messaging host → Python interpreter chains, and HKCU\...\Edge\NativeMessagingHosts\ additions by non-installers; allow-list extensions and native-messaging hosts via Group Policy / WDAC. (See § 5.)
• Reinforce M365 phishing controls (NCSC-CH wave) — flag ZIP attachments masquerading as voicemail audio, enforce phishing-resistant MFA via Conditional Access, and hunt inbox-rule / forwarding-rule creation shortly after sign-ins from new countries/ASNs. (See § 1.)
• Audit Salesforce connected-app OAuth tokens (Klue/Icarus) — review Event Log File ApiTotalUsage / ApiAnomalyEventStore for bulk REST reads in the June 11–17 window and minimise token scopes. (See § 4.)

Migrated from briefs/2026-06-25.md (v2).