2026-07-14T2009Z-intel

Verification & coverage notes

Intraday fire; previous run 2026-07-14T1210Z-intel (~8 h gap). Window held at the 24 h floor. It happened to be Microsoft and SAP patch day (14 July), which drove an eventful window: eight entries cleared the gate (seven new, one update), none rated critical.

Operational incident — container reclaim + full reconstruction. After verifier iterations 1 (Opus) and 2 (Sonnet), during an extended idle wait for iteration 3 the execution container was reclaimed and re-cloned fresh from main, wiping all uncommitted work (the eight entries, this run record, the registry/state/sources edits, and the per-run work/ artefacts). No commit had yet been made (the publishing chain commits atomically only after verification). main had not advanced (no later fire published, base unchanged at 21e9c44), so the entries, state edits, and dedup context were reconstructed byte-for-identical to their post-iteration-2-fix state from the run's working context, and verification was re-run against the reconstructed files (iteration 3 onward). The wall-clock duration_seconds reflects the reclaim gap, not active processing; the true compose/verify work was ~35 min before the reclaim plus the reconstruction and re-verification after it. Sub-agent research telemetry (S1–S4) is preserved from the pre-reclaim returns.

• No deep dive. No candidate earned the long-form kill-chain treatment: the two exploited Microsoft zero-days and the SonicWall CVSS-10.0 chain have no published exploitation mechanics to walk through; SAP, the Talos survey and the ShinyHunters map are roundups/retrospectives; the Patriot Bait AI-C2 case is a low-CI-relevance fraud operation. Depth was not manufactured to fill the slot.
• No critical. The strongest candidate — SonicWall CVE-2026-15409 (CVSS 10.0, vendor-confirmed active exploitation, unauthenticated, internet-facing edge) — is an SSRF chained to a post-auth code-injection, not a direct pre-auth RCE, and the field observation (Volexity-assisted) reads as targeted rather than mass exploitation with a public PoC. The Microsoft zero-days are elevation-of-privilege (AD FS post-foothold; SharePoint a CVSS 5.3 EoP), not stop-the-world RCE. All three are patch-now, so they ship at high; none clears the extreme critical bar. Where uncertain, high not critical.
• Truth correction applied at compose time (not a verifier finding): the breaking-vulnerabilities research characterised Exchange Server CVE-2026-55008 as an "OWA XSS, near-term exploitation likely." The authoritative MSRC page classifies it as a spoofing vulnerability (cross-site scripting) requiring user interaction with an Unproven exploit-code-maturity rating. It is a UI-required, unexploited flaw that does not demand out-of-band action, so it was excluded from the Patch Tuesday entry's CVE table and noted for awareness only. The release's third zero-day (a publicly-disclosed, physical-access BitLocker recovery-mode bypass, reported unexploited) is likewise mentioned as context only, not action-worthy.
• Single-source / carve-out items: SonicWall SMA1000 (single-source) — the sole citeable source is the vendor PSIRT advisory for its own product (vendor-advisory carve-out); CISA independently listed both CVEs on its KEV catalog the same day, recorded in the entry's CVE status (the KEV catalog root is not a citeable per-item source), and full mechanics rest on the vendor advisory. IFAGE/DragonForce (single-source, C3) — the DragonForce attribution and 850 GB figure rest on a single C-reliability outlet (Inside IT) and are unconfirmed by the victim; the underlying April 2026 breach is separately victim-confirmed (La Télé citing IFAGE) but narrower and with no vector disclosed. Framed as a watch item on the MedusaLocker/Canton-of-Zürich precedent (2026-07-02). Talos "Serpent's Tongue" (single-source) — technique survey from a high-reliability research lab.
• borderline-drop: D1R Synopsys/Bosch/ARM extortion claim — an unconfirmed ransomware leak-site claim (no confirmation from any of Synopsys, Bosch or ARM; all reporting traces to the same leak-site post; C-tier journalism only). Fails the fake-news guard, which requires victim disclosure or high-reliability journalism for leak-site claims; the actor is a brand-new unknown with three listings. Recoverable as a new entry if victim confirmation emerges. (Distinct from the IFAGE item, whose underlying breach is victim-confirmed and which is a direct home-region hit.)
• borderline-drop: Lidl online-shop customer-data breach (DE/BE/NL) — a European retail consumer-PII exposure via an unnamed processor, victim-confirmed but out of the constituency's sector nexus (retail is not a profiled sector), with no named actor, no disclosed vector and no novel TTP; the third-party-processor exposure lesson is generic and already amply covered. Geographic proximity alone did not carry it over the breach-inclusion gate.
• Also dropped upstream by the incidents research (out of nexus / no transferable TTP): UK NCA charges tied to the Russian Coms spoofing platform (legal update on a 2024 takedown); Nihon Kotsu taxi-operator malware (Japan-only, no actor/TTP); Centers Laboratory (NJ) and AssuranceAmerica (US) consumer-PII breaches (US-only, no EU/CH nexus, no transferable TTP).
• out-of-window drop: Swiss Kommando Cyber → OpenDesk migration (freshest source inside-it.ch 2026-07-13T12:13Z, just below the 24 h floor); a one-off sourcing/policy decision better suited to the weekly strategic/policy lens than an operational intel entry.
• SAP consolidation: the SAP July Patch Day surfaced independently in both the breaking-vulnerabilities and the home-region research passes; published as a single consolidated entry citing NCSC-CH, SAP's notes page, Onapsis and SecurityWeek.
• Watchlist: no product or supplier watchlist is configured for this deployment — the product and supplier sweeps are no-ops; the sector/region lens was applied throughout.
• Coverage gaps: cert-eu, ncsc-uk (not separately queried — the in-window Patch-Tuesday/SAP CVE set was corroborated via NCSC-NL and NCSC-CH); enisa-euvd (recent-exploited listing only); group-ib, ibm-xforce (JS-only/CMS listing pages returned no enumerable posts — recipe probe owed on a future run); cert-at, cert-pl, enisa, withsecure-labs, truesec, synacktiv, compass-security, cnil-fr, le-monde-info, jpcert, ico-uk, sec-disclosures-edgar, troyhunt, us-treasury-ofac — fetched, quiet or no in-window nexus content.