Intel run 2026-07-14T0409Z

Intraday run, about 8 hours after the previous one (2026-07-13T20:09Z). The coverage window spans the last 24 hours (the standard floor), though most of it was already swept by earlier runs, so only genuinely new signal is published. Research covered breaking vulnerabilities, the Swiss/European home-region and sector picture, threat-research labs and incident disclosures; no closed-source material was present this window. Coverage focus: Switzerland and Europe, Swiss/European critical infrastructure and government at the centre.

Verification & coverage notes

A quiet-but-non-empty window: two new entries and one update. No deep dive (no candidate decisively earned the long-form treatment) and no critical-priority item (nothing met the stop-and-act-now bar).

• New (threat): CrashStealer — native-C++ macOS infostealer (Jamf Threat Labs + BleepingComputer, 2026-07-13; in-window under the 24 h floor, not previously covered). Novel tradecraft: notarized dropper clearing Gatekeeper, ad-hoc-re-signed payload from a hidden /private/tmp path, local dscl -authonly password validation, EDR-tooling reconnaissance, keychain/browser/wallet harvest. One do-now compromise-check action (fleet sweep for the Apple-impersonating bundle staged from a hidden path).
• New (annual-report): Check Point Annual AI Security Report 2026 (Check Point Research, 2026-07-14, in-window). Covered once as a dedicated report entry — the durable defender takeaway (an agent's trusted config/context store is the new persistence surface) framed over the telemetry percentages, which are flagged as CPR's own product data. Distinct from CPR's earlier bimonthly AI Threat Landscape Digest.
• Update (incident): OFAC/UK sanctions on First VPN Service (1VPNS), its administrator and a Belarusian cryptor seller (US Treasury + FBI, 2026-07-13). Filed as an update to the 2026-05-22 Operation Saffron takedown entry — the takedown (with Swiss joint-investigation-team participation) was already covered; the new development is the individual designations and the explicit targeting of the cryptor-as-a-service layer. The update carries only the new development, not a recap.

Single-source / carve-outs:

• Check Point AI Security Report 2026 — single-source (CPR's own report; telemetry uncorroborated). Classification B2, confidence medium.
• CrashStealer — multi-source but BleepingComputer relays the Jamf research rather than independently corroborating; credibility held at 2 (B2), confidence medium.

Borderline drops (recoverable audit trail):

• borderline-drop: SAP July 2026 Security Patch Day (CVE-2026-44747 NetWeaver AS ABAP memory corruption CVSS 9.9; CVE-2026-44761 Commerce Cloud sample-OAuth2-credential CVSS 9.1; CVE-2026-27690 Approuter HTTP request smuggling CVSS 9.1) — routine monthly patch-cycle disclosure: EPSS 0.0, no exploitation, no public PoC, same-day patches; nothing here warrants action beyond the routine monthly SAP patch cycle, even at CVSS 9+. Relevant to the SAP-heavy constituency but correctly out of scope for an out-of-band item; logged for awareness. Surfaced first by ENISA EUVD before any vendor blog or press.
• borderline-drop: DIRAC grid-computing framework eval-injection RCEs (CVE-2026-61667 FileCatalog, CVE-2026-45579 RequestManager, both CVSS 9.9) — authenticated (PR:L), patched same day, no exploitation/PoC; narrow research-computing audience (WLCG/HEP, CERN-adjacent). Routine patch cycle for a niche product.
• borderline-drop: Swiss federal administration Microsoft 365 exit / OpenDesk (Kommando Cyber + Federal Chancellery PoC BOSS) — directly concerns the constituency's own core and is well-sourced (Republik/Netzwoche/heise + first-party bk.admin.ch), but it is a strategic sovereignty/policy decision with no near-term operational defender action. Held for the weekly strategic summary rather than the daily operational feed, and flagged for that run.
• borderline-drop: Compass Security CRA Part II (IP-camera CRA/IEC 62443-4-2 compliance-assessment walkthrough) — high-quality defensive methodology, but GRC/procurement-oriented and single vendor-blog source; not operational SOC threat signal.
• borderline-drop: Lidl online-shop third-party breach (DE/BE/NL) — retail, outside the constituency's sectors; limited personal data (no passwords/payment), no named actor, and a repeat of the third-party-service-provider trust-boundary pattern already covered this week (KDDI/Nayax/Odido/Nextcloud). No transferable new lesson.
• borderline-drop: D1R extortion claim vs Synopsys/Bosch/ARM — unconfirmed leak-site claim, no vendor confirmation, possibly recycled from an earlier "Arkana" Synopsys claim; not published without corroboration. The one transferable point (a registration-form business-logic flaw enabling bulk client-database enumeration) is generic and does not justify an unverified named-victim entry.
• borderline-drop: Qilin leak-site listing of Centro Científico e Cultural de Macau (Portuguese public institute) — bare listing, zero technical detail, no corroboration or victim statement; direct EU public-sector nexus but no actionable content, and unconfirmed leak-site claims are not published on their own.

Data-quality note: the FBI FLASH PDF (ic3.gov/CSA/2026/260521.pdf) referenced by both OFAC and the FBI Boston release returned self-flagged "paraphrased" text on fetch and named ransomware families/protocol details not verifiable in first-party text; those specifics (incl. VLESS/Reality protocol masquerading) were deliberately excluded from the 1VPNS entry, which stands on OFAC + the FBI Boston release only.

• Coverage gaps: ncsc-uk (reports-advisories listing JS-only/cookie-shell — news RSS used instead); cisa-advisories (listing returned filter chrome only, JS-rendered results grid); mandiant-gtig (client-rendered SPA, no dated listing); intel471 (Next.js SPA, RSS 404); govcert-at (empty RSS); edpb, cnil-fr, truesec, withsecure-labs (SPA/cookie shells — no in-window content surfaced by searches either); inside-it-ch (article-detail 403 both transports; RSS reachable direct); industrialcyber-co (homepage 403; /feed/ reachable direct).
• Watchlist: no product/supplier watchlist configured — product and supplier sweeps are structural no-ops this deployment (products checked=0, suppliers checked=0).
• Essential-coverage: cisa-directives not confirmed attempted this run (it was allocated but the CISA-directives listing was not drilled after the CISA advisories fetch). CISA emergency directives are infrequent and nothing new was expected in this window; flagged for the next run to attempt explicitly.