2026-07-08T2009Z-intel

Verification & coverage notes

Catch-up intel run — gap ~62 h to the previous fire (2026-07-06T06:09Z-intel; both 2026-07-06 runs were quiet, zero entries). window_hours=64 (gap+2, catch-up class), developing_window_hours=86. Coverage window: catch-up of 62 h (previous run 2026-07-06T0609Z-intel). Dedup (PD-8) ran against the full 14-day prior_coverage.json (140 records — every brief in the window loaded into context) plus the store-wide CVE index (484 ids). Prompt version v3.11. Outcome: 11 entries (10 new + 1 update), one deep-dive (GhostLock, linux-lpe), no critical. Composition: 7 vulnerability (incl. the ColdFusion update + the GhostLock deep-dive), 3 threat, 1 incident — a diverse landscape, not a per-vendor patch feed.

No critical this run — by construction. The two actively-exploited KEV items (ColdFusion CVE-2026-48282, Langflow CVE-2026-55255) are high, not critical: both have patches available and neither is mass-exploitation-imminent for this constituency (ColdFusion ~800 internet-exposed instances globally; Langflow a single observed operator). No candidate cleared the extreme critical bar (newly weaponised + active-ITW/mass-exploitation-imminent + hour/day-critical defender action).

Deep-dive: GhostLock (CVE-2026-43499), category linux-lpe — selection criterion 3 (substantive new technical analysis with a public, actionable exploit). No linux-lpe deep-dive in the prior 30 days (rotation clear); deep_dives_today=0. Public 97%-reliable root + container-escape exploit against a 15-year-exposure kernel UAF present on the default CONFIG_FUTEX_PI justifies the long-form treatment.

Borderline drops (recoverable audit trail)

• borderline-drop: Compass Security (Swiss lab) CRA compliance methodology (IP-camera IEC 62443-4-2 SL2 assessment) (S2) — single-source first-party methodology/compliance-assessment piece; genuinely Swiss and well-executed, but it is procurement/compliance guidance, not operational threat/detection intel. Fails PD-11 actionability (changes no patch/hunt/block/detect decision for a Tier 2/3 responder). No ATT&CK/detection surface.
• borderline-drop: Krebs on Security — IRIS C2 exploit-acquisition startup run by convicted fraudsters (S3) — vendor/procurement-risk investigative journalism; no technical vulnerability, TTP or detection content. Interesting for public-sector procurement/vendor-risk teams but not actionable for a SOC responder (PD-11 actionability gate).
• borderline-drop: Swiss Post 2026 e-voting bug bounty (6–24 July, outer network-security layer removed for a test cohort, up to EUR 230k) (S2) — direct Swiss-federal-e-gov nexus and a real "don't mis-triage authorised adversarial traffic" angle, but fundamentally a program-announcement / awareness news item (PD-11 "drop without ceremony"); single-source (Swiss Post's own post 301-redirected during the run; only SwissCybersecurity.net was fetched) and no clean operational entry-kind fit. Logged here for recoverability — if anomalous traffic against Swiss federal e-voting segments is observed in-window, this is the authorised-testing context.

Out-of-window drops (S3 flagged these as strong near-misses for a catch-up window; all fail recency PD-7 — primary source before the 86 h developing cutoff of 2026-07-05T06:09Z)

• Check Point "Browser-Only Ransomware" LLM-hallucination-to-attack technique (primary 2026-07-01).
• "Bad Epoll" CVE-2026-46242 Linux epoll UAF LPE, ~99% reliable exploit (primary/THN 2026-07-03) — the in-window Linux-LPE-with-public-exploit beat is already carried by GhostLock, so no blind spot.
• ChocoPoC trojanised-PoC campaign (Sekoia/YesWeHack 2026-07-01); PolinRider DPRK supply-chain (Socket 2026-07-04); ClickFix 3,000-payload analysis (kqlquery.com 2026-07-01, THN 07-07 is a rewrite); Dragos 2026 OT Year-in-Review (orig 2026-02-17); Kaspersky ICS CERT Q1 2026 (report dated 2026-06-09, listing mis-dated 07-07).

Verification / sourcing notes

• Single-source (research-lab primary, reported as the lab's own original analysis): CrySome (LevelBlue SpiderLabs), UAT-7810 (Cisco Talos), Factory-v3 (Palo Alto Unit 42) — each verification: single-source with a sourcing_note; same-day outlet rewrites are not independent corroboration.
• Single-source-national-cert: Hydro-Québec OCPP (CISA ICSA-26-188-01) — national-authority carve-out; the CSAF JSON is the same authority's structured record.
• Accenture (incident): the incident is confirmed multi-source (Accenture's own statement + four outlets), but the claimed SCOPE (35 GB, credential classes, specific repo) is the actor's unverified advertisement — "888" has a documented scope-inflation history (a June 2024 Accenture claim of 32,826 employee records proved to contain only three genuine ones). Framed as an actor claim throughout; confidence: medium, classification: B3.
• ColdFusion update discipline (PD-8): CVE-2026-48282 shipped as update_of: 2026-07-02/cve-2026-48276-48277-48281-48282-48283-48316-adobe-coldfusio — delta only (exploitation-status change: patched-no-exploitation → actively-exploited + KEV within a week); the original entry (which correctly stated "no exploitation reported yet") is untouched.
• Ubiquiti dedup: SAB-066 (CVE-2026-50746 et al.) is a distinct, larger disclosure from the 2026-06-24 UniFi OS chain (CVE-2026-34908/-34909/-34910) — different CVEs, broader product scope — so a new entry, not an update.
• Contradictions: none.

Completeness sweep (PD-11)

Re-read all four findings sets including every borderline/near-miss candidate. Everything genuinely relevant and in-window is published: the two actively-exploited KEV clusters, the home-authority (NCSC-CH) BeyondTrust advisory, the NCSC-NL Ubiquiti bulletin, the public-exploit kernel LPE, the OT/EV-charging transferable weakness, three substantive research-lab TTP analyses, and the one in-scope supply-chain incident (Accenture). The three borderline drops are awareness/compliance/procurement items that fail the actionability gate, not blind spots; the out-of-window set is genuinely stale (all primaries before the 86 h developing cutoff), and where a theme could have left a gap (Linux LPE) an in-window item (GhostLock) already covers it. No relevant item was thinned to control volume — volume here reflects a genuinely eventful 62 h catch-up (a same-day CISA KEV batch of exploited CVEs plus two national-CERT advisories), not padding.

Coverage gaps

• industrialcyber-co (recurring UA-403 on WebFetch + bridge + jina — recorded in fetch_failures; WebSearch substitute found nothing in-window). Standard-tier, not essential.
• Slow-cadence / quiet sources (fetched clean, no in-window content — not failures): cert-eu (newest 2026-06-10), cert-at (2026-06-01), cert-pl (2026-06-12), enisa (2026-07-01 NIS360), trendmicro-research (2026-06-29), snyk-research (2026-06-29), mozilla-mfsa (2026-07-05 moderate iOS spoofing, below bar), sekoia (2026-07-01 ChocoPoC, out of window), truesec (2026-07-03 repackage of Sysdig JADEPUFFER, already covered), socprime (2026-06-19), withsecure-labs (month-granularity, newest May 2026), shadowserver (2026-06-25).
• Recipe-quality gaps (host healthy, extraction weak): ncsc-uk (reports-advisories index returned page chrome only this pass), prodaft (Next.js SPA shell, no dated /blog list), trellix (JS-only blog listing never surfaces post links even via jina — recommend a sitemap.xml probe recipe), oracle-cpu (security-alerts index nav-only; next quarterly CPU due mid-July, not yet published).
• Recipe note (fixed-forward): sans-newsbites — the jina/url bridge failed (connection reset / 422) but plain WebFetch succeeded on the canonical issue URL; recommend the recipe prefer WebFetch over jina for this host.
• Standard-tier not attempted this run (time budget prioritised essentials + strong KEV/NCSC pivots): shadowserver (S1), socprime (S1), trustwave-spiderlabs (S1 — note S3 reached it as LevelBlue), sonatype, flatt-security, jpcert, exodus-intelligence. Recommended for priority pickup next rotation.
• Essential-coverage: no miss — every essential-tier source was attempted and resolved (CERT/KEV/regulator set incl. bridged CISA hosts and NCSC-CH/NCSC-NL).
• Watchlist: not reported — config/org-profile.yaml configures no product or supplier watchlists; the S1 product-sweep and S4 supplier-sweep were documented no-ops.
• Source-health (standing repair order): python3 tools/source_health.py ran to completion (the first attempt hit a 320 s wrapper timeout and was re-run with a longer budget; state/source_health.json was untouched by the killed attempt and regenerated cleanly by the retry). Result: 95 ok · 58 bridge-ok · 1 jina-ok · 154× action none — zero UNSOLVED / needs-bridge / needs-demote. Nothing to repair this run; even industrialcyber-co (the run's one live fetch_failure at 403) probes as handled, and the previously-flagged ccn-cert-es transport-block fix is holding. No demotions (rule A1).