2026-07-13T0410Z-intel

Verification & coverage notes

Zero-entry intraday fire. Gap to the previous run (2026-07-12T2309Z-weekly, the W28 strategic run) is 5.03 h; window held at the 24 h floor. All four research sub-agents (S1–S4) swept their full essential slices plus standard-tier rotation and returned 0 qualifying items. This is a genuinely quiet window, not a coverage failure: the vulnerability/exploit ecosystem clustered on Friday 2026-07-10, the weekend produced no fresh in-window publications, and the W28 weekly (which ran ~5 h earlier, publishing through 2026-07-12T23:56Z) had already absorbed the week's home-region / sector / research signal. Every candidate lead traced to either already-covered ground in the 14-day prior-coverage index or a primary source published outside the window.

Completeness sweep (Phase 2) re-read all four findings sets including every dropped candidate; nothing genuinely relevant was left behind. Documented drops:

• borderline-drop: Comfast CF-WR631AX router command injection (CVE-2026-15511 / EUVD-2026-43252, pub 2026-07-12T23:00Z) — single VulDB source, no vendor/CERT corroboration, EPSS 0.0, no Swiss/EU critical-infrastructure nexus (S1).
• borderline-drop: Retelit SpA (IT telco, Qilin leak-site claim) and STEP Oiltools (RO, DragonForce leak-site claim) — leak-site-only, no victim or Admiralty A/B corroboration despite native-language search (S4, PD-6).
• borderline-drop: Nayax extortion claim — already covered 2026-07-09; leak deadline set for 2026-07-21, no material in-window delta yet (S4).
• out-of-window: recycled French Education Ministry "Compas" breach (actual incident March 2026), French Ministry of Culture forum claim (single low-reliability aggregator, dated 2026-07-05), River Financial 8-K/A + AssuranceAmerica (US-domestic, no nexus, outside window) (S4).
• out-of-window / duplicate (S3): SentinelLabs "One Target, Two Flags" (= 2026-07-10 e-government-portal watering-hole entry); Talos wolfSSL/GeoVision/VTK-DICOM (= 2026-07-09 disclosure entry); Nozomi Apex2/c2c botnets (= 2026-07-09 entry); ESET H1 2026 / Check Point Cavern Manticore / Sygnia AI-cloud (all covered by the W28 weekly); Silver Fox MODBEACON (QiAnXin primary 2026-07-06), Group-IB Millenium RAT (2026-06-25), Calif "My Cousin Vinyl" CVE-2026-50052 (2026-07-01) — all outside the 24/72 h window; CYFIRMA and Comparitech H1 healthcare-ransomware roundups (2026-07-10) — vanity-metric/strategic narrative, no technique-level substance.

• Operational — jina reader key balance exhausted (HTTP 402), pipeline-wide. All four sub-agents independently reported that tools/fetch_source.py jina … returns HTTP 402 "JINA_API_KEY balance exhausted" on every call this run (jina-usage confirms total_balance = -1,951,663). This removes the rung-3 reader fallback for hosts that 403 the direct/bridge transports (industrialcyber.co article pages, CISA/CERT-PL under WAF, JS-rendered SPAs such as PRODAFT and NCC Group). It cost no content this run — the affected leads were all out-of-window or dropped on merits, and CISA/CERT feeds were reached via their structured recipes — but it degrades fetch resilience for future runs until the operator generates a new key at <a href="https://jina.ai/api-dashboard/" rel="noopener noreferrer">https://jina.ai/api-dashboard/</a> and updates the environment. Operator action required.
• Tooling fix shipped this run: tools/source_health.py previously flagged every jina-fetch_method source as needs-demote when the reader 402s, creating false "standing repair orders" (3 sources this run: ccn-cert-es, reliaquest, mysites-guru — all healthy, two contributed primary content within the last week). Added a dedicated reader-quota probe class: a jina HTTP 402 is now recognised as an account-level transport block (402 never demotes, same hard rule as 403/429), classed handled (action none) and surfaced visibly in the class breakdown, while genuine per-source recipe deaths (404/5xx/non-402 errors) still fall through to needs-demote. Re-ran the probe: 157/157 sources, 0 UNSOLVED, 5× reader-quota.

• Source-health: 157/157 probed, 0 UNSOLVED (0 needs-demote after the reader-quota fix). No source demoted. No sources_changed[] this run — the RSS-path mismatches S3/S1 flagged for sophos-xops, calif-codex and recordedfuture-insikt are already documented correctly in each record's rss_url/notes; the sub-agents guessed alternate paths because the run's slimmed source slice omitted the rss_url field, an execution detail, not source drift.
• Coverage gaps: cisa-advisories, cisa-directives, ncsc-uk (S1 — reached via bridge recipe; no in-window advisories); claroty-team82 (S1 rotation, no in-window post); ico-uk (S4 — JS-rendered listing, jina reader unavailable this run, WebSearch fallback found no in-window enforcement action); industrialcyber-co (S3 — /feed/ RSS reachable 200, per-article pages 403 + jina 402).
• Essential-coverage: none missed — all 15 essential sources attempted across S1/S2.