2026-07-11T0409Z-intel

Verification & coverage notes

Intraday fire, 8 h after the previous run (2026-07-10T2009Z-intel). The 24 h window floor re-scanned a full day; five entries published are the new delta the earlier runs had not surfaced — most primaries dated 2026-07-08/07-09 with 2026-07-10 trade-press corroboration, confirmed in-window and closing a coverage gap rather than duplicating.

• Dedup: CVE-2026-47291 is already in the store (June Patch Tuesday entry, 2026-06-10 — outside the 14-day in-context window, caught by the store-wide CVE index). The in-window development is ZDI's full exploitation write-up (2026-07-10), so it ships as an update_of delta, not a new entry — never recapping the original.
• borderline-drop: FlowiseAI CSV Agent RCE (CVE-2026-41264) — underlying CVE is April 2026; the only in-window delta is a public Metasploit module for a niche self-hosted AI-agent platform whose public-sector nexus is speculative, with no confirmed in-the-wild exploitation of this specific bypass. Doubt about relevance-to-constituency resolved toward drop.
• out-of-window: REF6045 / SCMBANKER (Elastic Security Labs) — freshest source 2026-07-08 (~72 h), outside the 24 h window and not an update/background/patched-reference case; victimology is out-of-region (Mexican retail banking) and the transferable ClickFix delivery-chain content is already well-covered as a technique. Dropped on recency + weak nexus.
• Single-source / carve-out: none — all five published entries are multi-source.
• Reduced confidence: NHS England entry set confidence: medium — the concrete information-governance technical-control annex (digital.nhs.uk) 403'd this run; composed from the NHS press release, the guidance long-read and Infosecurity Magazine, with the specific incident counts attributed to Infosecurity Magazine (the NHS release cites the incidents only in general terms, including the Nottingham attacks). A follow-up run could retry that annex.
• Contradictions: none. One correction folded into the CVE-2026-47291 update: ZDI's write-up clarifies the exposure condition (a host must have MaxRequestBytes raised to ≥ 262,144 bytes to be exploitable; ≤ 65,535 is the conservative safe setting) more precisely than the original 2026-06-10 advisory framing.
• Deep dive: none. No candidate cleared the bar — no active in-the-wild exploitation with constituency exposure; the strongest technical items (GigaWiper, GodDamn/PoisonX, Friendly Fire) are substantive but observed against out-of-region targets or are PoCs. deep_dives_today was 0; no depth manufactured to fill the slot.
• Priority: no critical and no high this run — none of the published items involves active exploitation targeting the constituency, and CVE-2026-47291 is a month-patched, not-yet-exploited bug (newly-public mechanics, not new exploitation). All five are notable, calibrated to genuine-but-non-urgent action.
• Dedup catches during research (correctly excluded, not republished): Sygnia AI-assisted cloud attack (= 2026-07-09 entry); Gitea CVE-2026-20896, Zimbra, BeyondTrust CVE-2026-40138 cluster, Januscape CVE-2026-53359, Siemens SICAM SSA-229470 (all 2026-07-08/09/10 entries); recycled CISA GovCloud-keys post (2026-06-23); stale RTS "Homeland Justice" (2026-06-23) and ShinyHunters/Council-of-Europe (2026-06-15) items.
• Fake-news guard: a bulk Deadlock leak-site wave (~60 claims in a 25-minute window on 2026-07-10, incl. a Swiss SME and a Czech municipality) was dropped — no victim confirmation or Admiralty A/B journalism, and the Czech claim traced to an already-resolved March 2026 incident.
• ATT&CK: mapped against the pinned dataset (v19.1). Dropped an unsupported T1685.005 (Clear Windows Event Logs) mapping from GigaWiper — not described by the source; used T1685 (Disable or Modify Tools, the v19 replacement for the revoked T1562) for GodDamn's EDR-blinding.
• Coverage gaps: cert-eu (monthly cadence, freshest 2026-06-10); ncsc-uk (freshest 2026-04-07); jpcert (freshest 2026-06-10); vulncheck, watchtowr, exodus-intelligence, flatt-security, calif-codex, xlab-qianxin, seqrite-labs, sophos-xops, sansec-research, volexity, fox-it-blog (all reachable, no in-window content); industrialcyber-co (persistent 403 on WebFetch + jina, only /feed/ reachable — flagged 7+ runs, classed handled by source_health via its recipe, 403 never demotes); inside-it.ch (blocked both transports). Note: industrialcyber-co was flagged as a rotation priority for the vulnerabilities stream, but its source category routes it to the research and incidents streams, which did attempt it — not a real miss.
• Watchlist: no products/suppliers configured — sweep is a no-op (S1 products, S4 suppliers both 0/0); omitted from parseable line per policy.
• source_health.py: 157/157 probed in 50 s, all ok/bridge-ok, zero UNSOLVED — no repair orders this run.