2026-07-09T2009Z-intel

Verification & coverage notes

This 20:09Z fire was overrun in real time by a later scheduled fire, 2026-07-10T0409Z-intel, which completed and published to main while this run was mid-pipeline. Before composing final output this run re-pulled main, merged it, and deduplicated its seven triaged candidates against the six entries the 0409Z run had already published. Three of the seven were dropped as in-window duplicates of 0409Z coverage; the four published here are signal the 0409Z run did not surface (confirmed absent from its findings and triage).

• Coverage window: intraday fire; gap 8 h derived from the previous run (2026-07-09T1211Z-intel) at fire time. Window floored to 24 h.
• Overrun dedup — dropped as duplicates of the later 2026-07-10T0409Z-intel run already on main:
  • dedup-drop: LVM/Olpha Latvia ransomware — fully covered by entries/2026-07-10/cert-lv-lvm-olpha-ransomware-eu-nato-shared-threat (same incident, same CERT.LV sourcing, same EU/NATO shared-threat framing).
  • dedup-drop: Nextcloud GmbH hosting Elasticsearch leak — fully covered by entries/2026-07-10/nextcloud-gmbh-elasticsearch-exposure-msb-nrw (same 367K-record exposure, same MSB NRW client, same hardcoded-credential setup scripts).
  • dedup-drop: "Helix" device-code-phishing / SharePoint extortion group (ReliaQuest) — the 0409Z run already published two entries in this identity-attack cluster the same window: m365-conditional-access-gaps-railway-lshiy-campaigns (device-code-phishing-beats-Conditional-Access, with the disable-device-code action) and odido-shinyhunters-vishing-dutch-police-attribution (the ShinyHunters vishing-into-portal playbook). Helix shares the actor:shinyhunters lineage and the same disable-device-code / managed-device-Conditional-Access actions; a third same-theme entry would triplicate in-window coverage. Its one net-new element (the automated wildcard SharePoint content-class enumeration fingerprint) did not justify a standalone entry re-delivering already-published actions.
• Single-source items (with carve-outs / notes):
  • OpenPLC CVE-2026-14480 — single-source-national-cert: CISA ICS advisory ICSA-26-190-01 is the disclosing authority; CVE.org carries the same record but is not an independent report. No vendor advisory / fixed version exists yet.
  • Talos wolfSSL/GeoVision/VTK-DICOM batch — single-source: Cisco Talos is the sole coordinating discloser across all 41 CVEs (blog + per-CVE TALOS advisory pages are one publisher); corroboration is the vendor patches Talos states have shipped.
  • UNK_MassTraction (Roundcube) — single-source: Proofpoint only at time of writing; carried within the 72 h developing-story window (published 2026-07-07, campaign ongoing since May 2026).
• Borderline drops (this run's own triage, before the overrun dedup):
  • borderline-drop: compromised @injectivelabs/sdk-ts npm package (Socket) — crypto-wallet SDK ecosystem with no Swiss/EU public-sector or CI nexus; single-sourced; the transferable lesson (pin dependencies, review simultaneous multi-package version bumps) is generic. Doubt about relevance-to-constituency resolved toward drop.
  • borderline-drop: CrowdStrike prompt-injection taxonomy expansion — vendor blog with an attached Falcon AIDR product pitch; AI-agent threat-modeling/awareness content (MITRE ATLAS space) without operational detection specificity or a constituency incident.
• Recency: RoguePlanet's base MSRC disclosure (2026-06-16) is out of window, but the in-window trigger is the 2026-07-08 engine-fix ship and the 2026-07-09 NCSC-CH tracker update — published as a fresh delta on a home-region authority's ongoing advisory, not a re-run of the old disclosure. GeoVision patches shipped 2026-04-28 and the Nextcloud exposure was discovered 2026-05-18, but both had in-window public disclosures (2026-07-09 / 2026-07-08 respectively).
• Deep dive: none. No candidate cleared the bar (none actively exploited in the wild with non-trivial constituency exposure; the threat items are single-source/spotlight rather than deep technique analysis; no in-window annual report). The 0409Z run had already placed one deep dive in the window.
• No priority: critical entries this run; none of the four cleared the extreme critical bar (no active in-the-wild exploitation with time-critical-to-the-hour defender action).
• Prior-run publish status: the immediately-preceding record (2026-07-09T1211Z-intel) carries no publish_status field — its Phase 7 publish-status amendment never landed. Operator awareness only.
• Coverage gaps: industrialcyber-co (transport-blocked, recipe repaired to RSS this run — see fetch_failures); cisa-advisories (JS-rendered advisory listing returns no structured items on direct/reader fetch — a standing recipe gap; KEV catalog and the ICS advisory pages were fetched fine); cert-eu, ncsc-uk, enisa, vulncheck, sansec-research, aikido-security, exodus-intelligence, sonatype, fox-it-blog, huntress, volexity, xlab-qianxin, cert-at, ncsc-ie, govcert-at, infoguard-ch, le-monde-info — attempted or searched, no genuinely in-window signal this run.
• Watchlist: no product or supplier watchlist configured in the org profile — sweep is a no-op (S1 products, S4 suppliers both checked=0, hits=0).
• Essential-coverage: missed=enisa-euvd — it was promoted to tier-essential by a concurrent run (the ENISA EUVD source addition) after this fire's Phase 0 source allocation had already been built, so it was not in any sub-agent slice; it will be attempted from the next run. All other essential sources in the S1/S2 slices were attempted; the cisa-advisories listing remains structurally un-parseable (mitigated via the KEV catalog + ICS advisory pages), no other essential source silently missed.