Intel run 2026-07-14T1210Z

Intraday run, about 8 hours after the previous one (2026-07-14T0409Z). The coverage window spans the last 24 hours (the standard floor); most of it was already swept by earlier runs today and yesterday, so only genuinely new signal since the morning fire is published. Research covered breaking vulnerabilities, the Swiss/European home-region and sector picture, threat-research labs and incident disclosures; no closed-source material was present this window. Coverage focus: Switzerland and Europe, Swiss/European critical infrastructure and government at the centre.

Verification & coverage notes

A quiet-but-non-empty window: two new entries and one update. No deep dive (no candidate decisively earned the long-form treatment) and no critical-priority item (nothing met the stop-and-act-now bar).

• New (incident): AsyncAPI npm supply-chain compromise via GitHub Actions (M-RED-TEAM), 2026-07-14, in-window. An attacker abused a misconfigured pull-request-triggered GitHub Actions workflow in the asyncapi/generator project to steal the org's npm publish token and ship five backdoored @asyncapi package versions (over three million downloads a week) carrying a multi-stage IPFS implant. Anchored on Wiz's primary analysis and corroborated by an independent same-day SafeDep post on the identical incident (matching package/version set and commit timestamp), so the entry is multi-source. The two sources disagree on the payload's self-identifying string — Wiz's "M-RED-TEAM v6.4" versus SafeDep's "miasma-train-p1" — which is surfaced in the entry so hunting teams check both. Aikido Security also reported the compromise independently but is not cited because the publisher renamed the post and its client-rendered blog would not resolve to a live URL this run. All indicators (IP, contract addresses, dead-drop, payload paths) were deliberately kept out of the entry per the no-IOC rule; the entry describes the behaviour. One do-now action: inventory imports of the affected versions and rotate exposed credentials.
• New (vulnerability): Forgotten pre-0.9 UEFI shim Secure Boot bypass, CVE-2026-8863 / CVE-2026-10797 (ESET Research + CERT/CC VU#616257, 2026-07-14, in-window). A signature-length validation mismatch plus MOK-deny-list and SBAT non-enforcement in 11 Microsoft-signed legacy shims lets an attacker bypass Secure Boot on any machine trusting the third-party UEFI CA, no admin or memory-corruption primitive required. Microsoft revoked all 11 via the 2026-06-09 dbx update; no in-the-wild exploitation has been reported. Published now because the full technical disclosure is today's news and the actionable control (verify dbx enrollment, audit EFI System Partitions for forked shims) is concrete for fleets whose firmware-level dbx lags OS patching. Considered for deep-dive treatment and kept as a standard vulnerability entry — patched five weeks ago and not exploited in the wild, so it did not clear the reserved deep-dive bar.
• Update (incident): Progress ShareFile Storage Zone Controller — active exploitation confirmed (Shadowserver honeypots, relayed by BankInfoSecurity + The Register + the vendor status page, 2026-07-13). Filed as an update to the 2026-07-13 shutdown entry: the new developments are Shadowserver's confirmation of in-the-wild exploitation of CVE-2026-2699 beginning 2026-07-10 (moving it from PoC-public to actively exploited), the exposed-instance count collapsing from about 30,000 to roughly 1,000, and a named researcher's public (explicitly unconfirmed) Clop-involvement assessment. Delta only; the original entry's shutdown and compromise-check actions still stand, so this update carries no new action items (the brief's action list is a union — repeating them would duplicate).

Single-source / carve-outs:

• AsyncAPI M-RED-TEAM — multi-source (Wiz primary + SafeDep corroborating, both same-day, both resolving; reliability B, credibility 1 on the corroborated core compromise). The two sources disagree only on the payload's self-ID string (M-RED-TEAM v6.4 vs miasma-train-p1), surfaced in the entry. Clop-attribution NOT asserted anywhere; both sources explicitly decline definitive attribution.
• ESET UEFI shims — multi-source (ESET primary + CERT/CC coordinated note); credibility 1. CVSS left null (not stated by ESET).
• ShareFile update — multi-source; the exploitation-confirmation fact traces to Shadowserver honeypot telemetry relayed by BankInfoSecurity and corroborated by The Register and the vendor status page (credibility 1). The Clop framing is one named analyst's public hypothesis (Recorded Future's Allan Liska, on Bluesky), not attribution — Progress has named no actor.

Borderline drops (recoverable audit trail):

• borderline-drop: Siemens Opcenter X JWT algorithm-confusion authentication bypass (CVE-2026-56451, CVSS 10.0, Siemens ProductCERT SSA-096828, 2026-07-14) — a pre-auth full-admin-impersonation flaw in a manufacturing-execution-system platform, patched in V2604, but with no reported exploitation, no public proof-of-concept, no exposure-driven urgency, and a specialized product class that patches on the normal operational-technology change window. Serious on paper but correctly out of scope as an out-of-band item — a high-CVSS CVE the routine patch cadence already handles is not operational signal for this audience; manufacturing/energy operators receive it through the normal Siemens advisory flow. Single-source (vendor PSIRT).
• borderline-drop: Swiss Army Kommando Cyber move off Microsoft 365 to the open-source OpenDesk suite by October 2026 over US CLOUD Act exposure (Republik/heise/SwissCybersecurity.net, 2026-07-09 to 07-13) — a direct hit on the core constituency and well-sourced, but a strategic digital-sovereignty/procurement decision with no near-term operational defender action. Held for the weekly strategic summary and flagged for that run, the same disposition the morning fire reached on this story.
• borderline-drop: Cisco Talos Python package supply-chain attack-surface taxonomy ("The serpent's tongue", 2026-07-14) — a well-executed defensive reference cataloguing known Python supply-chain mechanisms (setup.py build hooks, .pth injection, entry-point hijacking) for an audience already fluent in them; single-source, no new campaign or novel primitive. Its useful pivot — file-integrity monitoring of .pth files created under site-packages outside a package-manager transaction — is body-level detection engineering, not a new story.
• borderline-drop: D1R unconfirmed Synopsys → Bosch → ARM supply-chain extortion claim (Cybernews + a leak-site tracker reproducing D1R's own text, 2026-07-13) — an unconfirmed dark-web leak-site claim from a newly-surfaced actor with no track record; none of the three named companies has confirmed a breach, and the sourcing is a single chain plus the actor's own statement. Fails the leak-site corroboration bar; the one transferable point (enumerate a B2B vendor's registration portal, then pivot via a certificate-trusting client tool that skips interactive MFA) is a generic recon pattern that does not justify an unverified named-victim entry. Same disposition the morning fire reached.
• borderline-drop: Lidl online-shop customer-data breach via a compromised IT service provider (DE/BE/NL, BleepingComputer + Help Net Security, 2026-07-13) — out-of-sector retail with no home-region critical-infrastructure or government nexus; limited personal data (no passwords or payment details), no named actor, and a repeat of the third-party-processor trust-boundary pattern already covered repeatedly this week. No transferable new tradecraft. Same disposition the morning fire reached.

Data-quality note: the breaking-vulnerabilities research this run chased a secondary-source claim that July 2026 Patch Tuesday had landed with a specific "most urgent" CVE, cross-checked it directly against Microsoft's structured advisory feed, found the secondary source had conflated a 2025-patched CVE with this month's release, and confirmed no July 2026 cumulative had posted as of the run — the item was dropped rather than published, and a later-in-day run should re-check once the cumulative posts. The same pass also dropped a JetBrains YouTrack CVE (CVE-2026-62422) as a re-catalogued duplicate of an already-public June disclosure (CVE-2026-50242).

• Coverage gaps: cert-pl (article pages 403 the routine UA and the reader was balance-exhausted this run — recovered a July item via an EUVD cross-reference, assessed too niche, not carried); cert-eu (no numbered advisory since June — confirmed quiet, not a transport failure); the r.jina.ai reader returned HTTP 402 balance-exhausted across the research passes and during the main-agent deep read, forcing WebFetch/feed fallbacks (all content recovered, but the reader rung of the fetch ladder was unavailable — an operator top-up item); cert-at/govcert-at (recipe points at a static landing page with no dated feed — recipe needs updating to a dated listing); several standard-rotation research/regulator sources (dragos, nozomi-networks, citizen-lab, cloudflare-cf1, push-security, redcanary, intel471, edpb, cnil-fr, ico-uk, troyhunt) confirmed quiet in-window.
• Watchlist: no product/supplier watchlist configured — product and supplier sweeps are structural no-ops this deployment (products checked=0, suppliers checked=0).
• Essential-coverage: all essential sources attempted; no essential-source miss this run.