2026-06-27-40e791d4

• Items dropped:
  • Check Point Quantum/Spark IKEv1 auth bypass (CVE-2026-50751) — out-of-window: primary vendor blog 2026-06-08, NCSC-NL advisory 2026-06-16, no fresh development inside window_hours=36; already consolidated in the 2026-W25 weekly. Remains a real patch-now item for any IKEv1-enabled Check Point gateway (hotfixes sk185033/sk185035) but carries no in-window delta to report today.
  • PowerDNS coordinated security release (14 CVEs across Authoritative/Recursor/DNSdist, 2026-06-25) — dropped from § 2: no in-the-wild exploitation, not KEV/EUVD-exploited, patches available; did not clear a § 2 inclusion gate. Relevant to EU DNS/ISP operators as routine patching (BSI WID-SEC-2026-2091).
  • GitLab CE/EE 13-CVE release incl. unauthenticated Web IDE XSS CVE-2026-10712 (CVSS 8.0), 2026-06-25 — dropped from § 2: no exploitation evidence and XSS rather than RCE; did not clear a gate. Self-managed EU/Swiss public-sector instances should still update to 19.1.1/19.0.3/18.11.6 in the next change window (NCSC-NL NCSC-2026-0211).
  • CL-STA-1062 / TinyRCT (Unit 42, 2026-06-26) — Chinese-suspected APT using AppDomainManager injection against Southeast-Asian energy/government; dropped for low CH/EU nexus and single-source. Detection angle (.exe.config with appDomainManagerType) noted for hunters.
  • Tata Electronics / World Leaks (630 GB), KDDI (14.22 M email credentials), River Financial 8-K ransomware, Polymarket ($2.94 M frontend-injection theft) — substantive confirmed breaches but without CH/EU public-sector nexus or a novel transferable TTP; not promoted to keep signal high.
• § 2 inclusion note: DirtyClone and pedit COW are included on the basis of public working exploits and universal Linux exposure, although they are local LPEs rather than the literal pre-auth-RCE wording of § 2 gate 5; no in-the-wild exploitation has been observed yet (PoC-public only).
• Single-source items: § 1 TonRAT/"Photo ZIP" (Microsoft Threat Intelligence sole primary — HIGH-reliability vendor TI, corroborated by THN restatement); § 3 SANS ISC prctl masquerading diary (single reputable primary, technique writeup); § 4 The Gentlemen — the Swiss-second-most-targeted claim is single-source (inside-it.ch, Swiss press citing Check Point Research; the article body returned 403 to direct fetch, so the claim was read via the publisher's RSS summary). The group's 478-victims/--spread profile is separately sourced to The Hacker News (2026-06-11). All other items meet the two-source rule or are national-CERT/HIGH-reliability primary disclosures.
• Contradictions: the GTIG STOCKSTAY primary post is dated 2026-06-25; corroborating coverage (The Record, The Hacker News) is dated 2026-06-26. The brief cites the GTIG primary as 2026-06-25. On the Canvas breach, sources disagree on whether Instructure paid: Computer Weekly reports a ransom was paid; Infosecurity Magazine leaves it unclear; Instructure's own incident statement describes only "reaching an agreement" and receiving deletion logs, without confirming a monetary payment — the brief hedges to "reportedly paid" and surfaces Instructure's framing.
• Sub-agents: S1–S4 all returned; no stalls. (Note: S1's findings YAML recorded an internally inconsistent ended_at; the run log uses the harness-reported timestamps.)
• tools/source_health.py ran and refreshed state/source_health.json (2026-06-27 snapshot, 149 sources). It flagged 5 sources needs-demote, none actioned this run: cisa-advisories/cisa-directives/cisa-news returned bridge HTTP 403 on their listing pages (transport-blocked — the lifecycle hard rule is that sustained transport blocking never demotes, and CISA intelligence still reaches the brief via the working cisa-kev bridge), and sophos-xops/trellix hit single read-timeouts (transient, not persistent failures). All five are "recheck if persistent" advisories, not demotion-qualifying events.
• Coverage gaps: chrome-releases (RSS 302 redirect — Chrome security advisory unavailable via bridge); ptc-psirt (CS473270 returned 403; KEV + ENISA EUVD used instead); databreaches-net (403, third consecutive run — transport block, not demoted); cert-eu (no in-window advisory, latest 2026-06-10); cert-fr (feed returned 2025 bulletins only, empty in window); ncsc-ch-security-hub (no new post in window; only the 2026-06-25 Cisco SD-WAN edit to post 12579); mandiant-gtig (Feedburner IncompleteRead — direct article fetch used).

Unmatched action items (migrated)

• Regenerate Signal Backup Recovery Keys for high-risk personnel (diplomatic, federal, parliamentary, journalists) and issue guidance that any unsolicited "Signal support" message is hostile; disable Signal backups via MDM where operational security demands it (§ 1).
• Deploy the /proc/<pid>/comm vs /proc/<pid>/cmdline masquerade hunt across Linux fleets — a kernel-worker-style comm with a non-empty cmdline is a free, high-fidelity detection (§ 3).
• Audit npm/CI for the binding.gyp install-time-execution pattern — alert on node-gyp evaluating JavaScript from binding.gyp and rotate all CI/cloud credentials exposed to the affected LeoPlatform/RStreams packages since 2026-06-20 (§ 4).
• Audit Salesforce Connected Apps and revoke dormant OAuth integration tokens with export scopes; alert on anomalous bulk ReportExport/API activity from integration service accounts (§ 4).
• Hunt Cisco Catalyst SD-WAN Manager for unexpected /etc/passwd additions (troot), evil_tenant.csv artefacts and request tenant-upload CLI execution; enforce SMB signing and the Microsoft vulnerable-driver blocklist against The Gentlemen's worm/BYOVD behaviour (§ 4).

Migrated from briefs/2026-06-27.md (v2).