2026-07-10T2009Z-intel

Verification & coverage notes

An intraday fire — gap ~7.7 h from the previous run 2026-07-10T1228Z-intel (24 h floor applied, so the research window was a full day even though the morning's two runs had already swept most of it). S1–S4 all returned (Sonnet 5, per each agent's harness-injected model line); no S5 (no in-window intel/ drops). Six items cleared the gate against a window earlier runs had largely covered — the delta this fire is genuinely new signal that landed since ~12:53Z: one high vulnerability (actively-exploited iCagenda KEV addition), two notable vulnerabilities (Siemens SICAM OT, Zimbra/NCSC-CH), two notable threats (Forg365 M365 PhaaS, WP-SHELLSTORM webshell brokerage), and one notable research synthesis (Open WebUI access-control cluster). Zero critical. No deep dive: the earlier run already published today's deep dive and no candidate here independently earned a second with materially higher urgency (iCagenda is a focused vuln; the two threats are strong-notable but not deep-dive-grade this window). Four S3/S4 candidates were dropped at the gate (below).

• New vs update — CVE-2026-48939 (iCagenda). New CVE, not in prior coverage or the store-wide index. It is the fourth Joomla third-party extension in ~a month to ship the same unauthenticated-upload class, surfaced by the same researcher (mySites.guru) as the SP Page Builder / Page Builder CK / Balbooa cluster already covered — published as a distinct new entry (distinct product and CVE) linking trend:joomla-extension-file-upload-rce-wave, not an update. Priority high not critical: the vendor patch is ~3.5 weeks old (2026-06-15/16) and the in-the-wild exploitation evidence is from the pre-patch June window; the in-window trigger is CISA's KEV listing today, which formalises rather than newly weaponises. Key technical nuance carried from the primary: the upload-to-RCE fires on Joomla 6 only (earlier Joomla blocks unsafe uploads in core), while the access-control bypass affects all versions.
• Siemens SICAM 8 (SSA-229470) — included at notable, honestly framed. Four CVEs, no in-the-wild exploitation, none a remote pre-auth vector (firmware-signing bypass CVE-2026-54799 is local + high-privilege; the admin-API and debug flaws require authentication; the OPC-UA-off default CVE-2026-54800 is network but high-complexity and config-mitigable). It clears the bar on the energy-CI nexus (a core additional sector), a home-region authority (CERT-FR/ANSSI) republishing it in-window, and OT firmware updates being inherently out-of-band rather than routine patch-cycle work — framed as a prioritised OT hardening/patch action, with the OPC UA config default called out as the exposure closable immediately without a patch. Not high: no exploitation and no remote pre-auth path.
• Zimbra Classic Web Client (NCSC-CH) — the weakest include, kept for constituency completeness. No CVE assigned, exploitation status explicitly "unknown", legacy client Zimbra is steering users away from. Included because the deployment's own national authority (NCSC-CH, Admiralty A) published an advisory for the constituency about an unauthenticated, on-message-open mailbox-compromise path in a webmail platform still used across European public-sector and telecom orgs — a concrete "identify Classic Web Client use, switch to Modern, patch 10.1.19" decision. notable with confidence: medium and the unknown-exploitation caveat stated in the body; dropping it would have left a real (if minor) blind spot for a Swiss public-sector reader relying on this feed.
• Distinct-entry vs update — Forg365. The device-authorization-grant phishing primitive was covered this morning (M365 Conditional-Access / Railway-LSHIY research entry). Forg365 is a distinct commercial PhaaS product and operator (ZeroBEC), shipped as a standalone threat entry framed on the deltas — in-panel AI lure drafting and the ForgCookie browser-extension SSO-cookie-refresh persistence — and cross-linking the morning's entry via references[] so the shared primitive is not re-taught. Attribution (Kali365-class, Sneaky2FA overlap) reported as ZeroBEC's assessment, no asserted common ownership (classification B2).
• WP-SHELLSTORM — active mass exploitation, notable. Multi-source (SOCRadar primary; The Hacker News independently citing Ctrl-Alt-Intel's separate analysis of the same exposed directory). Included on the breadth-first FOFA targeting that puts any exposed Swiss/EU CMS or Nacos/Spring Boot estate in scope plus transferable detection. cves[] left empty deliberately: the operationally-named CVEs (Breeze CVE-2026-3844, ThemeREX CVE-2026-1969, Nacos CVE-2021-29441) are described in prose with the actions, but the source did not give verified vector/auth for the plugin CVEs, so they are not fabricated into frontmatter records. china-nexus tag reflects the sources' "Chinese-speaking/Chinese-linked" language-and-tooling attribution of a financially-motivated (non-state) crew.
• Open WebUI access-control cluster — research, notable. CSA Labs synthesis of six access-control CVEs, two independently confirmed against the GitHub Security Advisory Database this run. Included as substantive technical analysis (the per-endpoint-authorization architectural pattern + the client-side new Function() → server-side exec() RCE chain) relevant to the public-sector/research teams self-hosting LLM front-ends; one CVE (CVE-2025-63681) is unpatched, so a compensating control is the only mitigation. CVSS for CVE-2025-64496 recorded as the advisory's 7.3 with the body noting NVD's later 8.0 reassessment.
• borderline-drop: MODBEACON / Silver Fox Rust RAT (S3) — the only reachable source was an aggregator (The Hacker News) relaying a QiAnXin primary that could not be located this run; APAC-only targeting, no Swiss/EU nexus. The gRPC-over-Xray/V2Ray C2-transport tradecraft is genuinely transferable, but aggregator-only sourcing with an unreachable primary plus no nexus is too thin to publish as fact.
• borderline-drop: Wiz Red Agent / XBOW autonomous AI pentesting (S3) — largely a vendor (Wiz) product case study plus aggregate percentages; the vulnerability classes found (BOLA/SSRF/JWT alg:none) are commodity misconfigurations with generic API-hygiene remediations, and the "AI compresses time-to-exploit" observation is a strategic/weekly-horizon point, not operational detection intel.
• borderline-drop: CISA GovCloud key-leak post-mortem (S4) — a national authority's candid lessons-learned document (secret sprawl, EDR-gated repo uploads, key-rotation agility) with directly transferable DevSecOps value, but no fresh TTP or operational detection surface; a weekly-strategic candidate rather than an operational-run entry. Underlying May incident already in the registry (incident:cisa-nightwing-contractor-aws-govcloud-keys-exposed-github), outside the 14-day window; no prior entry to hang an update_of on.
• borderline-drop: DigitalMint DOJ ransomware-negotiator sentencing (S4) — already borderline-dropped in the 12:28Z run; US-only adjudicated insider-corruption case, a third-party-IR-vendor-trust governance lesson with no operational detection surface and no home-region nexus. The proposed actor:blackcat-alphv / incident:digitalmint-... entities were not registered (item dropped).
• Cited-but-untracked sources (for a future run): Siemens ProductCERT (cert-portal.siemens.com) and ZeroBEC (zerobec.com) both served as published primaries this run but are not in sources.json; only one new candidate is allowed per run (mySites.guru taken), so these are flagged for addition on a later fire. Zimbra's vendor blog similarly cited but untracked.
• Coverage gaps: industrialcyber-co (article pages 403 across transports for S3+S4; /feed/ RSS reachable — prefer the feed); github-advisory (the /advisories web listing is a client-rendered SPA with no structured endpoint — recommend adding a GitHub Advisory GraphQL/REST subcommand to tools/fetch_source.py; per-GHSA pages were reachable directly for the Open WebUI cluster); rapid7-research (both candidate RSS paths 404 via direct + jina); ncsc-uk (highlights page has no reliable date discriminator — items appeared stale); numerous CH/EU authority and research sources (BSI/CERT-EU/CERT-AT/CERT-PL/ENISA/NCSC-IE/CNIL/ICO/OFAC/JPCERT and the research slice) reached but quiet — newest items predate the intraday cutoff. No essential source missed this run.
• Essential-coverage: all essential sources attempted and reachable this run (NCSC-CH, CISA-KEV, CISA-advisories via RSS, ENISA-EUVD, ANSSI, BSI, NCSC-NL, CERT-EU, CERT-PL, CERT-AT, NCSC-UK all reached).
• Watchlist: no product or supplier watchlist configured in config/org-profile.yaml — the sweeps are no-ops (S1 products checked=0/0, S4 suppliers checked=0/0); no Watchlist: line emitted per policy.