2026-07-02-6551f8c2

• Single-source items: OpenClaw AI-agent skills (§ 3) — Kaspersky Securelist is the sole publisher; [SINGLE-SOURCE] (research lab, not a national-CERT carve-out). CVE-2026-14439 Altium (§ 2) — the GitHub Security Advisory is the sole cited primary (also present as ENISA EUVD-2026-41210, not fetched this run); treated as effectively single-source but from a HIGH-reliability advisory database. MedusaLocker / Canton Zürich (§ 1) — Ransomware.live only, a leak-site tracker; [SINGLE-SOURCE], LOW confidence, framed as an unconfirmed claim.
• National-CERT carve-out: the CVE-2026-45659 in-window signal (§§ 0, 2) rests on the CISA KEV catalog addition dated 2026-07-01, verified directly against CISA's KEV JSON feed this run (catalog v2026.07.01). No independent press had reported the KEV addition at research time; accepted as a valid single-source national-authority disclosure (CISA acting as the disclosing party for a catalog it owns). The underlying CVE facts — CVSS 8.8, CWE-502, the Site-Member auth requirement and the 21 May 2026 patch — are sourced to Microsoft's MSRC advisory; Help Net Security independently corroborates the CVE and notes it was initially omitted from the May Security Updates before publication.
• Contradiction (noted, not resolved): Microsoft's advisory rates CVE-2026-45659 "Exploitation Less Likely" and "Exploited: No," while CISA's KEV addition asserts active exploitation. The brief sides with the exploitation evidence (KEV listing) and flags the vendor's contrary rating so readers can weigh it.
• Actor-claim vs. confirmed fact: MedusaLocker's "772 emails extracted from bd.zh.ch" (§ 1) is an unverified leak-site self-report; the brief attributes the claim, not any confirmed exfiltration. No Canton of Zürich statement or NCSC.ch advisory was found this run.
• Exploitation qualifiers: Kemp LoadMaster CVE-2026-8037 (§ 4) — eSentire observed exploitation attempts from 2026-06-29 that were unsuccessful with no post-compromise activity. Adobe ColdFusion/Campaign (§ 2) and Argo CD (§ 5) have no reported in-the-wild exploitation; Argo CD additionally has no CVE and no vendor patch (mitigation is network isolation only).
• Items dropped: Kubota North America HR-data breach (confirmed victim disclosure, but no CH/EU nexus, no root cause, no initial-access vector, no TTP — below the operational-signal bar for this audience); Recorded Future Insikt TAG-182 / MarkiRAT Iran-nexus surveillance wave (single-source, targeting Farsi-speaking diaspora/civil society — low relevance to a Swiss/EU public-sector SOC, no defender-actionable takeaway); S1-dropped as stale/routine: Chrome stable-channel CVEs (no ITW flag), Splunk CVE-2026-20253 (disclosed/exploited mid-June, out of window), a GreyNoise TVT-DVR scanning surge (dated April 2025); S2-dropped: the NCSC-NL ColdFusion advisory NCSC-2026-0217 (generic vendor-patch shape — folded into the § 2 Adobe item instead), the Kanton Zug cybersecurity-competence-centre budget debate (governance/funding story, no incident or ATT&CK-mappable content — better suited to a weekly policy note).
• Verification loop (2 iterations, model rotation): iteration 1 (Opus) flagged three citation defects (a misattributed Argo CD GHSA that was actually a different patched CVE — removed; a Help Net Security over-attribution on the SharePoint patch date/CVSS — re-attributed to MSRC; an unverifiable NCSC-NL advisory redirect shell — removed) and one CWE mislabel. Iteration 2 (Sonnet) verified those remediations correct but caught that iteration 1's CWE "correction" for CVE-2026-48282 was itself wrong: Adobe's own APSB26-68 vulnerability table (fetched by the verifier) assigns it CWE-22 path-traversal (the split is 2× CWE-434, 3× CWE-20, 1× CWE-22), matching the original S1 research. The brief now reflects CWE-22; published on early-exit after applying this fix (truth=1, no broken-URL/hallucination finding) to avoid a verifier flip-flop on a point now settled by the fetched primary table.
• Sub-agent returns: all four research sub-agents (S1–S4) returned within the window; S2 surfaced zero qualifying items (all curated CH/EU/gov sources returned stale or already-covered content). No stalled sub-agents this run.
• Source-list health (acted on this run): S2 reported 19 S2-slice sources carry rss_url: null in sources/sources.json (cert-at, cert-pl, cnil-fr, edpb, google-tag, govcert-at, intrinsec, jpcert, kudelski-security, le-monde-info, ncc-research, ncsc-ie, oneconsult-ch, safeonweb-be, scip-ch, sekoia, synacktiv, us-treasury-ofac, ccb-belgium), forcing feed-URL guessing that mostly 404'd/DNS-failed, and three feeds (infoguard-ch/infoguard-labs, ncc-research, withsecure-labs) return malformed XML the bridge's stdlib parser rejects. Logged for a follow-up bridge/sources.json pass (lenient RSS pre-parse + rss_url backfill); not fixed this run to keep the change scoped.
• Coverage gaps: cisa-advisories (news/alerts pages HTTP 403 anti-bot on every attempt — KEV JSON feed remained reachable); cisa-news (same 403); cert-eu (no advisory newer than 2026-06-10); anssi-fr (nothing newer than 2026-06-22); bsi-de (only routine [UPDATE] batch re-publications in window); infoguard-ch, infoguard-labs, ncc-research, withsecure-labs (feeds return malformed XML — parse error); synacktiv, scip-ch, cert-at, ncsc-ie, safeonweb-be, ccb-belgium, google-tag, jpcert (no rss_url configured — guessed feed URLs 404'd/DNS-failed); mandiant-gtig (feedburner IncompleteRead, not retried); dragos, claroty-team82, nozomi-networks, akamai-sirt, push-security, morphisec (no working feed / no in-window item); sec-disclosures-edgar (no 8-K Item 1.05 filings in window); ico-uk (no enforcement action newer than 2026-06-23); cnil-fr (only guidance/consultation items, no breach notifications); troyhunt, databreaches-net (no fresh in-window incident items — databreaches /feed/ returns 200 but per-article drilldown 403s); cert-pl, kudelski-security, oneconsult-ch, sekoia, edpb, le-monde-info, intrinsec, us-treasury-ofac, govcert-at — not fetched this run (time allocation), no rss_url for several.

Unmatched action items (migrated)

• Patch internet-facing ColdFusion this week — six CVSS 10.0 unauthenticated RCE paths (APSB26-68); update to ColdFusion 2025 Update 10 / 2023 Update 21 and review cf_scripts/CFIDE/admin upload paths for newly written .jsp/.cfm/.cfc files. On-prem Campaign Classic: update to build 9397 (CVE-2026-48286). See § 2.
• Hunt Microsoft 365 device-code / PRT abuse — alert on OAuth device-code grants with anomalous broker clientMode, WAM broker-issued PRT refresh/renew outside device-registration windows, and programmatically-created inbox rules combining forwarding with auto-delete; restrict the device-code flow via Conditional Access and enforce token-protection for finance/AP roles. See § 3.
• Block RMM/DLL-sideloading abuse from user downloads — flag ScreenConnect service creation where the deploying process is a freshly-downloaded installer, alert on Defender exclusions covering full drive roots or C:\Users\Public added via PowerShell, and treat long-lived RegAsm.exe with network connections as a process-hollowing tell. See § 3.
• If you operate *.zh.ch infrastructure, quietly confirm Baudirektion / shared-cantonal-services status against the MedusaLocker leak-site claim — monitor for an official cantonal or NCSC.ch statement; no further action on an unverified claim. See § 1.

Migrated from briefs/2026-07-02.md (v2).