2026-07-03T1809Z-intel

Verification & coverage notes

• Coverage window: standard window of 16 h (gap 14 h since previous run 2026-07-03-04ba8283 started 04:09:42Z). Rolling 24 h now holds 7 operational entries (4 earlier today + 3 this run) — within the v2 daily band, under the soft ceiling of 14; 0 critical; deep-dive budget for the UTC day untouched (see below).
• No deep dive this run. None of the three qualifying candidates has in-the-wild exploitation or sufficient public technical depth for a full deep dive — WatchGuard and CWP are fresh PSIRT/CERT advisories with no PoC, and the Pegasus item is a forensic confirmation of a historical (2022–2023) targeting rather than new-technique analysis. Composing a deep dive would have padded (PD-1). Deep-dive day budget remains available.
• Single-source / carve-out: CVE-2026-57517 (Control Web Panel) — primary technical detail is CCB Belgium's own advisory (national-CERT carve-out, single-source-national-cert); the CVE is NVD-verified and the fix version/date is corroborated by the vendor changelog, but no independent second analysis of the flaw was available in-window.
• borderline-drop: Rancher SAML authentication-replay CVE-2026-44946 (+ PRTB permission-retention CVE-2026-44947) — NCSC-NL relay (NCSC-2026-0220, 2026-07-03) of a Rancher/SUSE GHSA (2026-06-29/30, CVSS 7.4). No confirmed in-the-wild exploitation; exploitation requires an attacker able to intercept a valid SAML response plus its state cookie (MITM / prior foothold). Below the vulnerability inclusion gate (not KEV, not exploited, CVSS < 9.0, not pre-auth-RCE) — both S1 and the home-region research pass independently judged it below-bar. Flagged here for identity-federation/K8s-management visibility; patch to 2.14.3 / 2.13.7 / 2.12.11 / 2.11.15 on the normal cycle.
• borderline-drop: GitHub Enterprise Server CVE-2026-9132 (+ CVE-2026-9106, CVE-2026-10585) — NCSC-NL relay (NCSC-2026-0219, fresh 2026-07-03). The most significant, CVE-2026-9132, is a missing-authorization flaw letting an authenticated user read private-repo source via the Copilot PR diff-summary endpoint; the companions are an OAuth-consent-scope misrepresentation and a Discussion stored XSS. All CVSS MEDIUM (5.4–6.5) and all require an authenticated account; no in-the-wild exploitation. Below the vulnerability inclusion gate. Self-hosted GHES operators should upgrade to ≥ 3.17.17 / 3.18.11 / 3.19.8 / 3.20.4 / 3.21.2 / 3.22 on the normal cycle and review OAuth grants carrying manage_runners:org.
• Sub-agent self-identification: all four research sub-agents reported CLAUDE_FRIENDLY_NAME/CLAUDE_MODEL_ID unset and self-identified as Sonnet 5 (claude-sonnet-5) from harness context — recorded verbatim. The main agent's env vars were likewise unset; model recorded from runtime configuration (claude-opus-4-8[1m]).
• Watchlist: not configured (org profile defines no product/supplier watchlist) — sweep line omitted; the S1 product sweep and S4 supplier sweep were no-ops as designed, general coverage rules applied unchanged.
• Essential-coverage: cisa-advisories / cisa-directives returned HTTP 403 via bridge + direct WebFetch (known-403 host; no working recipe this run). CISA KEV (separate essential source, api subcommand) fetched successfully — no in-window additions since 2026-07-01. All other essential sources were attempted successfully.
• Coverage gaps: cisa-advisories, cisa-directives, cisa-news (bridge/webfetch 403); industrialcyber-co (Cloudflare managed-challenge — recipe drift, flagged for fix); anssi-fr / cert-fr (avis+actu feeds stale to 2026-06-25, actu feed stalled at 2025-12-04); cert-eu (feed stale to 2026-06-10); cert-pl (newest 2026-06-12); cert-at (newest 2026-06-01, ~monthly cadence); enisa (newest item an administrative NIS360 survey announcement); ncsc-ch-focus / ncsc-ch-incidents (newest items 2026-06-30 / 2026-07-01, out of the 16 h window); ncsc-uk (listing fetched, no in-window article dates); safeonweb-be, oneconsult-ch, scip-ch, truesec, withsecure-labs, infoguard-ch, jpcert, prodaft, govcert-at (standard-tier, not fetched this run — time-budget prioritization; no evidence collected either way).
• Source health (probe run this fire): UNSOLVED = cisa-advisories, cisa-directives, cisa-news, github-advisory — all HTTP 403 (browser-UA refused). Per the source-lifecycle rule, 403/429/5xx is transport blocking, not content death, so none demoted; github-advisory is flagged for a dedicated bridge recipe on a future run (no verified working recipe available to add safely this run). No source lifecycle transitions this fire (sources_changed: []); contributing sources' last_successful_fetch bumped to today.
• Tooling change this run: added ccb.belgium.be and safeonweb.be to check_run.py's national-CERT carve-out host list (CCB Belgium / CERT.be is Belgium's national cyber authority) — resolves the Phase 5.7 F11 advisory on the CVE-2026-57517 single-source-national-cert classification.
• Near-miss leads for a future run (freshest source outside window_hours=16): ChocoPoC (Sekoia/YesWeHack, trojanized GitHub PoC repos targeting vulnerability researchers, 2026-07-01); VEIL#DROP/PureLogs (Securonix Blogger-hosted PowerShell loader, 2026-07-01); PamStealer (Jamf Threat Labs macOS PAM-validating infostealer, 2026-07-02). NCSC-CH posted same-day restatements of already-covered CVEs (Kemp LoadMaster, Citrix NetScaler, Argo CD) with no material new delta — not resurfaced.