2026-07-19T0408Z-intel

Verification & coverage notes

Standard 24 h window (gap 16 h to the previous run, the 2026-07-18T1208Z-audit). The national-CERT / government source layer was genuinely quiet across the window (weekend — Sat/Sun): every essential source (NCSC-CH CSH, NCSC-NL, BSI CERT-Bund, CERT-FR, CERT-EU, NCSC-UK, CISA advisories/directives/KEV, ENISA EUVD) was fetched live but carried no in-window items — verified against catalog version numbers and post timestamps (CISA KEV catalogVersion still 2026.07.16, no new additions; freshest CERT content clusters on Fri 2026-07-17), not assumed. Three entries published; one is the day's deep dive.

Published

• 2026-07-19/clicklock-stealer-macos-clickfix-forced-password-coercion — deep dive (category other). Novel, active macOS ClickFix infostealer (Group-IB) with >50% of victims in Europe; coercion-by-app-killing tradecraft, rich behavioral detection surface, no IOCs. Deep dive earned on the "substantive new technical analysis, actionable" criterion with a strong home-region concentration; no deep dive had been published today.
• 2026-07-19/ancpi-romania-cadastre-cyberattack-bytetobreach — live, unresolved EU public-sector incident (Romanian national cadastre/land-registry authority); tracked data-leak operator ByteToBreach with a documented cross-country victimology spanning government, banking and other sectors (KELA). Clears the incident gate on a direct home-region/coverage-focus + public-sector nexus.
• 2026-07-19/ernst-young-third-party-itsm-platform-breach-client-tax-data — Big Four (global significance) confirmed regulatory disclosure; third-party ITSM support-ticket platform breached, client tax/financial documents exfiltrated. Included on the out-of-nexus breach gate's global-significance criterion, framed around the transferable ITSM-attachment exposure lesson (public-sector helpdesk outsourcing).

Single-source / carve-outs

• ANCPI and EY entries are multi-source but the load-bearing actor/scope claims are single-origin: ByteToBreach's theft/ransomware claims are the actor's own dark-web assertions (disputed by ANCPI); EY's undisclosed vector/scope leaves credibility at 2. Both rated and sourcing-noted accordingly.

Borderline drops (recoverable)

• borderline-drop: @fastify/http-proxy prefix-rewrite bypass CVE-2026-16117 (CVSS 10.0, S1) — genuine fresh pre-auth access-control bypass, but no exploitation, no public PoC, no scanning; the fix is a routine dependency upgrade (11.6.0). Fails the vulnerability gate's "action beyond the regular patch cycle" test; high CVSS alone does not carry it. Recover if exploitation/PoC/scanning emerges.
• borderline-drop: WP2Shell WordPress pre-auth RCE exploitation update (S1) — the only new element is a single-source, unconfirmed watchTowr-CEO "first indications of in-the-wild exploitation" claim (no CISA KEV, no named victim, no independent telemetry). The prior 2026-07-18 entry already carries the dual-route WAF mitigation (/wp-json/batch/v1 and ?rest_route=/batch/v1) and correctly declines to assert ITW. No material new development; fails the two-source/fake-news bar for asserting an exploitation-status change.
• borderline-drop: July 2026 SharePoint exploitation-chain update (S1 + S3) — the prior 2026-07-17 entry already carries CISA's named AMSI/MDAV signatures (SuspSignoutReqBody.A, ToolPaneAuthBypass.A/.C, LeakFang.A!dha), the machine-key-theft framing, and the hunt-before-rotate guidance. The only incremental content is Resecurity's farm-account SQL-role lateral-movement narrative — from a reliability-C source whose "Operation FarmKey" case study is explicitly fictional/illustrative — which is deeper analysis of already-covered exploitation, not a material new development (no new CVE, victim, or exploitation-status change).
• borderline-drop: Abbott LabCentral / ShadowByt3$ second incident (S4) — already covered in the 2026-07-18 Abbott entry from the same BleepingComputer source; the additional API-endpoint-exfil detail is same-source backfill, not a new development.
• borderline-drop: SFR "NOVA" internal-tool data-theft claim (S2 + S4) — unconfirmed criminal/leak claim, no SFR confirmation, no independent Admiralty A/B verification; a widely-circulated "SFR confirmed" quote traces to a recycled December 2025 SFR breach (aggregator conflation). Fails the leak-site-claim verification bar.
• borderline-drop: German mid-July cluster — Wiesbaden/Mülheim DDoS + Netze BW/Stuttgart Netze meter-installer supply-chain breach (S2) — the DDoS thread is low-value municipal availability (restored; Mainz was a DNS-provider fault, not an attack). The Netze BW/Stuttgart Netze meter-contractor breach is 2.5–3 days old and its transferable third-party-meter-supplier lesson duplicates the already-covered IWB Basel entry; the recurring-German-pattern framing is strategic material for the weekly, not an operational entry.

Coverage gaps: cert-eu (advisory series stale since 2026-06, may need a wider endpoint), team-cymru (per-post schema.org datePublished unreliable — recipe review), cisa-kev (quiet, no additions since 2026-07-16), apple-security (bridge returned unrendered head only, no positive lead). FortiSandbox KEV additions (CVE-2026-25089 / CVE-2026-39808, added 2026-07-16) are absent from the 14-day index — a genuine earlier-run miss, outside this window and with no fresh development; flagged for the quality audit / next relevant cycle to recover.

Watchlist: not configured for this deployment (product and supplier watchlists empty) — sweep is a no-op; line omitted from telemetry.

Essential-coverage: all essential national-CERT/government sources attempted and reachable; no misses.

Deep-dive rotation: category other (macOS endpoint malware) — not used in the trailing 7 days (recent picks: firewall-vpn-rce, apt-campaign, identity-infra, linux-lpe). No prior deep dive today.

Verification. Five iterations (Opus/Sonnet/Opus/Sonnet/Opus rotation); confirmed CLEAN published (double-CLEAN gate: iteration 4 Sonnet + iteration 5 Opus, two consecutive CLEANs on two different models). Residuals fell monotonically — iter1 (Opus) 4 truth, iter2 (Sonnet) 3 truth, iter3 (Opus) 1 truth, iter4 (Sonnet) CLEAN, iter5 (Opus) CLEAN — a benign convergence where each cold cross-model read surfaced a distinct, low-severity, fully-remediable defect the others missed. The ClickLock deep dive was clean from iteration 1 (all evidence verbatim, T1685 confirmed as the active v19.1 rename of revoked T1562.001, no IOCs); every defect was confined to the two incident entries plus the registry/run-record prose, and every one was a precision fix (a wrong ~6-week→~11-day arithmetic on EY; a Poland-as-a-bank-not-a-government mischaracterization that recurred across entry/registry/run-record and was chased down in all three; a backup-deletion citation re-pointed to the source that actually carries it; an inverted vendor-contract framing corrected against the Romanian primary re-read directly; an unsupported SSN/payment-card overstatement removed; a Telegram-as-module-delivery error corrected to exfiltration-only). All remediated before commit. entries_dropped_by_verification: 0; verification_residual_count: 0.