2026-07-11T1435Z-audit

Verification & coverage notes

Operator-directed full-store intelligence-quality audit (not a scheduled fire; explicit operator directive: identify false/erroneous/incomplete/missing reports, root-cause, and improve). Six sub-agents: three retrospective cold-reader verification passes over all 55 entries of 2026-07-08…2026-07-11 against their primary sources, and three independent landscape re-sweeps of 2026-07-03…2026-07-11T12:00Z (vulnerabilities/exploitation, incidents/ransomware with CH-DACH-EU priority, threat research/APT). One entry published: the audit-recovered Armored Likho / BusySnake item (see below). Full findings and root-cause analysis: docs/audits/2026-07-11-intelligence-quality-audit.md.

Truth-verification outcome (55 entries checked, ~85 primary URLs fetched): 52 factually clean — evidence quotes verbatim, CVE/KEV/CVSS/version/attribution claims confirmed point-for-point where checkable. Three published factual errors found and repaired in place under the immutability-exception log (.claude/memory/entry-immutability-exceptions.md):

• 2026-07-09/talos-wolfssl-geovision-vtkdicom-disclosure — three wolfSSL CVE ids propagated from the Talos roundup blog contradicted Talos's own per-advisory "Vendor Response" fields: CVE-2026-28739 → CVE-2026-7532, CVE-2026-25106 → CVE-2026-5263, CVE-2026-33091 → CVE-2026-6678 (verified against all three TALOS advisory pages; state/cves_seen.json re-synced). Worst finding of the audit: an unresolvable CVE id poisons dedup, /cve/ surfaces and automated triage matching.
• 2026-07-08/beyondtrust-rs-pra-preauth-bypass-cve-2026-40138-cluster — CVE-2026-40141 shipped as CVSS 9.9; the vendor advisory BT26-03 scores it High / 8.5 (bridge-fetched, confirmed by The Hacker News). The error inverted the cluster's severity ranking above the two pre-auth 9.2 criticals.
• 2026-07-10/odido-shinyhunters-vishing-dutch-police-attribution — techniques[] carried T1656, revoked in the pinned ATT&CK v19.1 (superseded by T1684.001); frontmatter and the one inline mention repaired.

Minor (documented, no repair): iCagenda (07-10) attributes the prior Joomla-extension-wave cluster to a cited page that names a different set of examples (the named cluster is independently KEV-confirmed — citation-locality imprecision); Odido's "forensic voice analysis" phrasing leans on the NOS corroboration rather than the Politie primary; seven 07-08/07-09 vulnerability entries carry classification: null (pre-v3.18 runs — grandfathered; the v3.18 gate already closed this class).

Coverage-gap outcome: all six in-window CISA KEV additions covered; no missed Swiss/DACH/EU incident found; national-CERT surface (CERT-FR, BSI, NCSC-NL, NCSC-CH, ENISA-EUVD) confirmed clean for the outage days. Two research-blog items dated inside/adjacent to the 2026-07-06/07 scheduler-outage window were missed by the 07-08 backfill run:

• published this run: Armored Likho / BusySnake Stealer (Kaspersky, 2026-07-03) — new APT, government + electric-power targeting, LLM-generated loader; clears PD-11(d) as transferable tradecraft with concrete hunt pivots. entries/2026-07-11/armored-likho-busysnake-ai-generated-loader-python-stealer.md.
• borderline-drop: Infoblox "Lurking Lizard" residential-proxy operation (2026-07-07) — new named actor and two transferable hunt angles (drop-catch domain aging, IPLogger-as-beacon), but consumer-device victims, no government/CI nexus, and the window already carried the NetNut/Popa proxy-botnet story; does not clear PD-11 as a standalone.
• borderline-drop: Roundcube 1.6.17/1.7.2 security release (2026-07-05; CERTFR-2026-AVI-0835 2026-07-06) — no exploitation evidence for the new CVEs; noted because Roundcube is under active targeting per in-store coverage (UNK_MassTraction); a future Roundcube delta should reference this patch level.
• borderline-drop (watch item): bd.zh.ch (Kanton Zürich Baudirektion) listed by MedusaLocker on ransomware.live (published 2026-07-01, pre-window) — single-source leak-site claim, no victim statement, no Swiss press pickup despite dedicated German-language searches; correctly excluded under PD-6, flagged here because the claimed victim is squarely in the deployment's constituency. Re-check for corroboration in future runs.
• Root cause of the two research-blog misses: the 64 h backfill run swept KEV/CERT/aggregator channels but had no per-publisher research-blog listing sweep for the outage dates; research publications do not route through CVE/KEV discovery. Fix shipped in this commit (prompts v3.21, Phase 0 outage-backfill duty).

Systemic findings (fixes in this commit): two runaway main runs (17.8 h on 2026-07-04T1809Z, 11.2 h on 2026-07-09T2009Z) with an overtaken-run publish race (2026-07-10T0409Z computed gap from 1211Z because 2009Z's record hadn't landed) — v3.21 adds a main-run wall-clock watchdog + codifies re-sync-and-re-dedup when overtaken, and check_run.py now WARNs on runaway durations and stale publish_status; dead ATT&CK ids in a new run's techniques[] upgraded WARN→FAIL (v3.21 gate); CVE-id provenance rule added to Phase 2 and verifier check 4 (per-CVE authority beats roundup); essential source ncsc-uk had been dark-but-green for weeks (consent-banner shell on every transport while HTTP 200 kept bookkeeping healthy) — working all-rss-feed.xml recipe recorded in sources/sources.json and memory.

Essential-coverage disclosure: this audit run attempted the essential sources relevant to its verification/gap-sweep scope (CISA KEV, NCSC-CH CSH, ENISA EUVD, CERT-FR, BSI, NCSC-NL, CERT-EU, MSRC), not the full 15-source essential floor — it is a quality audit over already-covered ground, not a fresh intel sweep; the scheduled cadence owns the floor. sources_changed[] is empty by design: the ncsc-uk notes/rss_url update and the last_successful_fetch bumps (kaspersky-securelist, ncsc-uk, cisa-kev) are bookkeeping on existing records, not lifecycle transitions.

Verifier scope note: iterations 1–2 verify this run's single new entry + this record (cold-reader, fresh context, opus/sonnet rotation). The three retrospective verification passes above audited published entries and are recorded as sub-agent telemetry, not Phase 5.7 iterations.

Duration disclosure: the ~3.3 h wall-clock (runaway-threshold WARN) is the audit session itself — six parallel sub-agents over 55 entries plus a ~2 h platform session-limit pause mid-run (all six agents were suspended 16:0x–17:10Z and resumed after the reset). Not a container stall; no action needed.