2026-07-09T0409Z-intel

Verification & coverage notes

Window. Intraday fire, gap 8 h from the previous run (2026-07-08T2009Z-intel). Window held at the 24 h floor (developing window 72 h). Dedup ran against the full 14-day prior_coverage.json (140 records, incl. the 2026-07-08 run and the W27 weekly) plus the store-wide CVE index. No in-window intel/ drops, no S5 spawned. No watchlists configured, no Watchlist: line, product/supplier sweeps are no-ops (S1 products checked=0, S4 suppliers checked=0).

Volume note. 10 entries on an 8 h intraday fire is larger than a typical intraday window, and it reflects genuinely-new, never-before-published signal, not cadence inflation (dedup confirmed every entry is new). Three items are developing-window first-coverage the prior 64 h-window run did not surface: Januscape (source 2026-07-07, ~30 h), the Mandiant ADFS Golden SAML write-up (2026-07-07, ~38 h), and Cavern Manticore (2026-07-06, ~40 h). All three are outside the strict 24 h window but inside the 72 h developing window and were never covered by any prior run; they are published as first-coverage of significant developing stories with event_date set to the true source date, per PD-7. The remaining seven are fresh 2026-07-08 items.

GhostApproval de-duplication. Both S1 and S3 independently surfaced Wiz's GhostApproval. Merged into one entry using S1's richer multi-source corroboration (Wiz + AWS GHSA-6v3r-4p5c-mrp5 + Cursor GHSA-3v8f-48vw-3mjx). Reported faithfully incl. Anthropic Claude Code's "outside our threat model" response and its v2.1.32 symlink warning, no sanitisation of a finding that names the producing vendor's own product.

Deep dive. mandiant-adfs-machine-dpapi-golden-saml-key-recovery (identity-infra), selection criterion 3 (substantive new technical analysis with actionable public detail). Category rotation-fresh: the last identity-infra deep dive was Keycloak (2026-06-28, >7 days). window24h.deep_dives_today was 0 at run start. One deep dive this fire. Background paragraph (PD-10) cites the 2017 CyberArk Golden SAML disclosure and Mandiant's earlier UNC2452 ADFS work.

Single-source / carve-outs.

• UNC1151/Ghostwriter Gmail 2FA phishing, single-source-national-cert (CERT Polska / NASK, Admiralty A, for its own jurisdiction).
• Sygnia AI-orchestrated AWS intrusion, single-source (Sygnia, Admiralty B); the AI-orchestration read is Sygnia's assessment from tempo/artefacts, framed as assessed not proven (credibility: 3).
• Cavern Manticore, single-source (Check Point Research, Admiralty B); Israel-targeted, included on transferable technique class (PD-11 d) + same-actor-class relevance (Iran MOIS also targets EU public sector) (credibility: 3).
• Nayax; victim's own SEC Form 6-K is the fact base (victim-disclosure carve-out) + DataBreaches.net/Calcalistech corroboration → multi-source; "The Syndicate"'s 1B-record/100TB/~1yr figures reported as an unverified attributed leak-site claim per PD-6, with the internal contradiction against the "immediately contained" filing surfaced explicitly (credibility: 3).

borderline-drop: CVE-2026-11405 (Tenda router httpd hidden backdoor): CVSS 9.8, CERT/CC VU#213560, but Tenda is a consumer/SMB router brand with no Swiss/EU public-sector or critical-infrastructure nexus; generic hardcoded-backdoor lesson, not a product the constituency runs, no novel transferable TTP. Out of scope per the PD-11 scope gate (doubt about relevance-to-constituency resolves to drop). Recoverable if it turns up in a constituency estate.

borderline-drop: PDAG (Psychiatrische Dienste Aargau) cantonal-healthcare mailbox-takeover / phishing-relay: a real Swiss home-region public-sector/healthcare incident (S2 lead; main-agent spot-check confirmed the inside-it.ch RSS lead but the article URL 403'd on direct, jina and bridge transports, and no PDAG statement URL or second source surfaced). Dropped on two grounds: single-source (inside-it.ch, Admiralty C news) with no independently-fetchable victim/CERT primary to satisfy two-source or a carve-out, and modest technical depth, generic BEC mailbox-takeover → spam/phishing relay with no root cause, TTP, or new action beyond the already-covered M365 mailbox-takeover pattern. Recoverable if a fuller disclosure (PDAG statement / NCSC-CH pickup) lands.

out-of-window drops (S-agent level). S3: CrowdStrike prompt-injection post and Seqrite Operation DragonReturn, listing-page dates misaligned with true Published-Time metadata (2026-05-20 and 2026-06-26 respectively); excluded once confirmed out of window. S2: a "Swiss federal administration DDoS" WebSearch lead was recycled Jan-2025 news (radiolac.ch), discarded as a recency trap. S1: Exodus msi.dll LPE write-up covers CVE-2025-27727 (patched April 2025), retrospective, low current urgency, dropped.

Coverage gaps: cisa-advisories, cisa-directives, cisa-news (JS-shell listing pages; no structured bridge endpoint, KEV API covered exploitation ground-truth, a non-KEV in-window advisory may have been missed); cert-eu (feed stale to 2026-06-10, 200 OK not a transport failure); industrialcyber-co (standing 403/Cloudflare block, jina reader also blocked, no demotion); zimperium-zlabs, aikido-security (SPA nav-chrome only via jina, need a structured listing/sitemap recipe); jpcert (not fetched, time budget, no evidence of a missed in-window item); calif-codex, vulncheck, socket-dev-blog RSS empty via jina (HTML fallback showed nothing newer in-window / cross-domain items left to S3/S4).

Essential-coverage: missed=cisa-advisories, cisa-directives (JS-shell listing pages unreadable via current bridge recipes; KEV API (the exploitation ground-truth for both) fetched successfully, so no new exploited-flaw signal was missed).

Verification loop: 4 iterations (1 Opus, 2 alt-slot, 3 Opus, 4 alt-slot) → CLEAN on iteration 4. Iteration 1 found 4 (2 truth incl. 2 F4, 1 editorial F17, 1 advisory); iteration 2 found 2 (1 F12 editorial, 1 F4 truth); iteration 3 found 4 (3 truth: F4 Januscape version list, F3 Plesk CVSS attribution, F4 Mandiant quote-splice; 1 advisory); iteration 4 CLEAN. All remediations traced to sources re-fetched during the fix cycle. No entries dropped by verification.

AI-content transparency; verifier model rotation did NOT take effect this run. The prompt rotates verifiers Opus (odd) / Sonnet (even, cti-verification-alt). All four verifier spawns (including iterations 2 and 4, the alt-slot Sonnet-pin) reported **Model:** Claude Opus 4.8 (claude-opus-4-8) from the authoritative CLAUDE_FRIENDLY_NAME/CLAUDE_MODEL_ID env vars. The iteration 4 verifier explicitly flagged the discrepancy. In this cloud container the env vars appear to pin every spawn to Opus 4.8 regardless of the agent definition's model: frontmatter, so model diversity across iterations was not achieved (iteration 2 was recorded verbatim as Opus 4.8, corrected from an initial mis-assumption of Sonnet). Operator follow-up: confirm whether the routine container is meant to honour per-agent model frontmatter or whether the Opus pin is intentional; the rotation's blind-spot-catching benefit is currently a no-op.

Self-evolution follow-up (noted, not actioned this run): CERT-FR (anssi-fr) fetch_source.py feed returns items oldest-first; a default N=20 surfaces stale entries instead of the latest bulletin. Note appended to the source record; a bridge-tooling fix (reverse/most-recent-first ordering for CERT-FR feeds) is a candidate for a future run.