2026-07-11T2009Z-intel

Verification & coverage notes

Coverage window: intraday — gap 5.57 h from the previous run 2026-07-11T1435Z-audit (started 14:35 Z); window_hours = 24 (hard floor). No scheduler outage, so no wide-gap research-blog backfill sweep. No intel/ drops in window, so no S5 intake.

Outcome: one new entry published, no updates, no deep dive, no critical. A quiet Saturday-evening window: three of four research domains (S2 home-region/sector, S3 research, S4 incidents) returned zero in-window items after full essential-source sweeps, and everything they surfaced that touched the home region/sector was either published by today's 14:35 Z run or already in the 14-day dedup index (Gitea CVE-2026-20896, CERT.LV/LVM, PDAG Aargau, HTTP.sys CVE-2026-47291, NHS England, the Joomla file-upload wave, MOVEit, Armored Likho).

Published (vulnerability, notable): PraisonAI agent framework — three same-day CVEs (CVE-2026-61447 CVSS 10.0 unsandboxed LLM-generated Python execution with full-environment secret leak and a dead sandbox=True flag; CVE-2026-61445 CVSS 9.4 AICoder arbitrary file write / command execution via LLM tool calls; CVE-2026-60090 CVSS 9.3 SQL/CQL injection via an unvalidated vector-store dimension parameter). Ids and CVSS taken from the three per-CVE GitHub Security Advisories (vendor primary, read in full via the jina reader) and corroborated on NVD (CVSS 4.0 vectors confirm the base scores) and ENISA EUVD; all VulnCheck-assigned. Included on the transferable technique-class lesson — in an agentic framework the model's own output is an execution surface — with concrete, source-derived detection concepts (agent-host process spawning interpreters that read credential env vars or egress; tool-call writes outside the workspace; knowledge-store DDL carrying non-integer dimension tokens), not on product exposure for this constituency, which is narrow (self-hosted AI-pilot teams). Priority held at notable: the advisories publish proof-of-concept code and the PraisonAI family was scanned within ~4 h of a prior disclosure (CVE-2026-44338), but no independent weaponised exploit or in-the-wild exploitation of these three has been reported — it does not clear the critical/high bar.

Primary-over-finding correction: the S1 finding carried a TheHackerWire quote "No public PoC is available at the time of writing." The three GHSA primaries, re-read directly this run, each publish PoC code, so the entry records poc-public and frames the PoC as vendor-advisory demonstration code with no confirmed in-the-wild use — trusting the primary over the aggregator per composition discipline.

• borderline-drop: Qilin ransomware leak-site claim vs. Retelit SpA (Italian telecom infrastructure operator) — posted 2026-07-11T13:34 Z, in-window and carrying a Europe + telco nexus, but a bare leak-site listing with no victim statement, no Garante filing, and no independent journalism found despite EN + IT searches. Excluded under the leak-site verification gate (a claim of this kind ships only on victim disclosure or high-reliability journalism). Flagged here as a watch item — re-check for corroboration next run.

• Coverage gaps: cert-eu (bridge feed lags — newest item ~2026-06-10, previously-flagged staleness); cisa-directives (listing page rendered only template/nav rows, no enumerable directive entries this run — no in-window directive announcements in the cisa-news feed either). Both are content-availability gaps, not fetch failures; all essential sources returned content, just none fresh enough to clear the 24 h floor beyond what the 14:35 Z run already covered.

• Watchlist: no product or supplier watchlist configured for this deployment — sweeps are no-ops (S1 products checked=0, hits=0; S4 suppliers checked=0, hits=0). Omitting the parseable Watchlist line is correct per policy.

• Essential-coverage: no miss — all 15 essential sources were attempted across S1/S2 and returned content.

• Source health: 157/157 probed, all ok/bridge-ok, zero UNSOLVED — no repair order this run.