2026-06-26-6bbe4619

Items dropped:

• Ubiquiti UniFi OS CVE-2026-34908 / -34909 / -34910 (S1) — dropped as a PD-8 duplicate: this exact triple-flaw chain was the deep dive on 2026-06-24. It is also out-of-window (patched 2026-05-21 in UniFi OS Server 5.0.8) and S1's reported product/fixed-version detail ("UniFi OS 4.1.13") was inaccurate against the vendor record. The only fresh hook was today's CISA KEV federal remediation deadline, which is not operational signal for a CH/EU audience (PD-13).
• GitLab 19.1.1 / 19.0.3 / 18.11.6 (S1, S2) — dropped from §2. Verified against GitLab's release notes (published 2026-06-24): the headline issues are stored XSS CVE-2026-10086 (CVSS 8.7) and CVE-2026-10712 (CVSS 8.0), with lower-severity authorization/SSRF issues (the SSRF, CVE-2026-12635, is only CVSS 3.1). No in-the-wild exploitation, not RCE, below the CVSS-9 threshold — clears no §2 inclusion gate. Self-hosted public-sector instances should still apply on their normal patch cycle. (A sub-agent over-stated this as "code injection / SSRF highest-impact"; corrected.)
• PixelSmash / CVE-2026-8461 FFmpeg MagicYUV heap OOB (S3) — out-of-window: JFrog disclosure 2026-06-22, outside the 36 h window with no fresh in-window development. Noted for catch-up given Nextcloud/Jellyfin server-side-preview relevance to CH/EU public sector if it develops.
• Microsoft DART parallel dual-actor SharePoint case study (S3) — out-of-window (2026-06-22) and single-source.
• Tata Electronics / World Leaks 630 GB leak (S4) — out-of-window (2026-06-22/23).
• River Financial Corp 8-K (Item 1.05) (S4) — US community bank, no CH/EU nexus; SINGLE-SOURCE (SEC filing recovered via search). Watch for an 8-K/A around 1–2 July.
• DraftKings credential-stuffing sentencing (S4) — US law-enforcement follow-up; limited CH/EU public-sector relevance.
• Black Kite Europe ransomware report (S2) — periodic statistics report; declined under the no-vanity-metrics rule. Its one operational nugget (the Miljödata HR-SaaS supply-chain breach cascading to ~200 Swedish municipalities) references a 2025 incident, not in-window.

Corrections resolved during verification (sub-agent conflicts cross-checked against primaries):

• Cisco SD-WAN CVE-2026-20245 — three sub-agents returned three different fixed-version lists and two different Cisco advisory IDs; resolved against the Mandiant primary and Cisco PSIRT to 20.9.9.2 / 20.12.7.2 / 20.15.4.5 / 20.15.5.3 / 20.18.3.1 / 26.1.1.2 and advisory cisco-sa-sdwan-privesc-4uxFrdzx. Mandiant asserts no actor attribution, so sub-agent "nation-state/espionage" framing was dropped. Primary publication date is 2026-06-24 (one sub-agent reported 06-25).
• macOS.Gaslight — two sub-agents conflicted on C2 (HTTPS vs Telegram), XProtect signature (BONZAI.D/E vs MACOS_BONZAI_COBUCH) and persistence path; resolved against the SentinelLABS primary (Telegram Bot-API C2; XProtect MACOS_BONZAI_COBUCH; LaunchAgent com.apple.system.services.activity). The fabricated SentinelLABS URL returned by one sub-agent was discarded in favour of the verified one.
• Gamaredon — ESET and Sekoia both published 2025 Gamaredon research on 2026-06-25; the ESET annual paper was fetched and verified. Sub-agent claims of "EU secondary targeting" were not supported by the report (exclusively Ukrainian targeting) and were dropped.

Single-source / reduced confidence: Ukrposhta data-exfiltration claim is a pro-Russian-hacktivist self-report, unverified by Recorded Future News; the service disruption itself is multi-source.

Stalled sub-agents: none — all four returned within the window.

Coverage gaps: databreaches-net (per-article 403 on the bridge; items recovered via corroborating publishers); cert-fr-avis, cert-fr-actu (feeds stale / nothing in window); ncsc-ch-focus (Week 26 review not yet published — HTTP 404 at run time); mandiant-gtig (Feedburner IncompleteRead — recovered via direct article fetch); bleepingcomputer (403 — recovered via alternates).

Source-health probe: the end-of-run source_health.py snapshot flagged five sources needs-demote — cisa-advisories, cisa-directives, cisa-news, sophos-xops, trellix. No demotion applied this run: the three CISA entries are documented routine-UA transport-blocking (exempt from demotion per the source-lifecycle rules; the cisa-kev bridge recipe itself returned 200 this run), and sophos-xops / trellix are single-probe failures below the 5×404 demotion threshold. Monitoring; will revisit if the failures persist across runs.

Unmatched action items (migrated)

• Patch Cisco Catalyst SD-WAN Manager now to a fixed train (20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, or 26.1.1.2) — pre-disclosure root exploitation is confirmed and there is no workaround. On any controller potentially exposed before patching, baseline /etc/passwd//etc/shadow for non-root UID-0 accounts, review tenant-upload audit logs, and rotate admin credentials including default vmanage-admin. See §4 and §5.
• Hunt the vishing → Entra kill chain. Alert on new MFA-method registration events in Entra audit logs correlated with anomalous sign-in geo/user-agent and post-enrollment impossible-travel risk events; move privileged and helpdesk-reachable identities to phishing-resistant FIDO2/passkey MFA and require a compliant device for MFA enrollment via Conditional Access. See §1.
• Add detection for trusted-service abuse in exfil/C2. Flag tunnel-service egress (trycloudflare.com / workers.dev / devtunnels.ms) from Office or scripting processes, and rclone/S3-API PUT/POST from hosts with no backup role — the Gamaredon model that any espionage operator can copy. See §3.
• Treat LLM triage verdicts as provisional on submitted macOS samples. Until human review, do not trust an automated "benign" verdict on a macOS binary, and hunt LaunchAgents under com.apple.system.services.* signed by non-Apple identities. See §3.

Migrated from briefs/2026-06-26.md (v2).