2026-07-22T0409Z-intel

Verification & coverage notes

Standard 26 h window (gap 24 h to the previous fire 2026-07-21T0409Z-intel, which published ok). Seven entries published — five new, two updates — from 12 candidate items across S1–S4. No deep dive this run: the strongest technical candidate (SharePoint CVE-2026-50522) is an escalation of an already-covered July cluster, so it ships as a richly-detailed high update rather than a fresh deep-dive treatment of well-trodden ground.

Published

• high new — Langflow CVE-2026-0770 actively exploited (CISA KEV 2026-07-21) plus the 15-CVE NCSC-NL batch fixed in 1.10.1. Multi-source (CISA + ZDI per-CVE advisory + NCSC-NL/IBM). Distinct from prior Langflow coverage (CVE-2026-55255 IDOR 2026-07-08, CVE-2025-34291 2026-05-22) — new CVEs, so a new entry, not an update.
• notable new — Zimbra 10.1.20 SNMP command-injection RCE + 4 stored-XSS; NCSC-CH and BSI dual-flag. No confirmed ITW; three CVEs RESERVED on NVD, headline SNMP RCE carries no CVE. Included on home-region relevance (self-hosted CH/EU webmail) + dual national-CERT flag; priority held at notable because no exploitation is confirmed.
• notable new — Everest ransomware / Stadler Rail supplier-platform breach. Direct Swiss home-region hit (transport manufacturer, Thurgau); trusted-relationship vector (T1199); Stadler's own systems/production unaffected, refused CHF 10M.
• high update — SharePoint CVE-2026-50522 escalates to active ITW exploitation via public PoC (machine-key theft → forged auth surviving patch); update_of 2026-07-15 July-cluster entry. Actions left empty: the patch and evict-then-rotate-keys tasks are already carried in-window by the 2026-07-15 and 2026-07-17 SharePoint entries — repeating them would duplicate the aggregated Action Items list.
• notable new — XEntry Team living-off-the-land BitLocker extortion (Kaspersky GERT). Single-source (reputable lab); strong behavioural-detection value, no IOCs.
• notable update — Project CAV3RN / Cavern: Kaspersky independently corroborates the Cavern/HOLLOWGRAPH cluster and adds a DNS AAAA-record C2 config-recovery fallback; on attribution it retains only a LOW-confidence association with OilRig (APT34) — first drawn in a prior report, no direct code reuse or infrastructure overlap — reported as an analytic lead, not a settled attribution; update_of the 2026-07-21 HOLLOWGRAPH entry. Registered actor:oilrig with a single related-to edge to tool:cavern-c2-framework (low-confidence note).
• notable new — South Korea KNDA diplomatic-academy e-learning zero-day breach. Out-of-home-region but government-sector with a transferable exposure-class lesson (externally-reachable staff training platforms; cross-agency detection). Cleared the breach gate on scale (a) + transferable shared threat (d).

Borderline drops

• borderline-drop: DD-WRT CVE-2021-27137 / C0XMO botnet KEV listing — dedup. C0XMO/DD-WRT was already covered on 2026-06-08; the only in-window fact is the CISA KEV listing, which is jurisdiction-agnostic exploitation confirmation but on its own never opens a new/update entry for this audience. Recorded cisa-kev awareness only.
• borderline-drop: WordPress Core CVE-2026-63030 + CVE-2026-60137 (same 2026-07-21 CISA KEV batch as Langflow/DD-WRT) — dedup. These two CVEs are the WP2Shell pre-auth RCE chain already covered on 2026-07-18 and updated 2026-07-21 (the GPT5.6 autonomous-exploit-chain entry); they were already reported as actively exploited. The 2026-07-21 KEV listing confirms that exploitation but, per policy, a KEV listing alone does not open a new or update entry over already-covered ground. WordPress Core is highly relevant to the constituency, but the operational signal (patch/hunt WP2Shell) is already published — no blind spot.
• borderline-drop: SentinelLABS Iran War midyear assessment — strategic-leaning periodic assessment (weekly-run territory); the CH/EU nexus is indirect (US/Israel/Middle East targeting) and its defender priorities are generic hardening. Logged for possible weekly pickup.
• borderline-drop: Estée Lauder Cl0p Oracle EBS breach (CVE-2025-61882) — out-of-nexus (US cosmetics), and the underlying campaign/CVE is from 2025 (patched Oct 2025, KEV since Oct 2025). Disclosure of another victim of a known campaign is awareness, not a near-term decision change for the constituency.
• borderline-drop: Anubis ransomware / Coca-Cola fairlife — out-of-nexus (US food/beverage); the distinctive claim (full Nutanix HCI encryption, ~1 TB) is Anubis's own unverified leak-site assertion, and the confirmed baseline (a production-halt ransomware incident via SEC 8-K) carries no new/materially-evolved transferable TTP.

Recency / out-of-window

• Two S3 leads dropped on recency (source publication outside the 26 h/72 h window), logged for the next run: Expel "CylindricalCanine" (DigiCert code-signing theft, published 2026-07-15) and Symantec "Spirals" Rust ransomware (published 2026-07-16).

Other

• Verification: 8 iterations (Opus/Sonnet rotation), reaching the iteration cap without a confirmed double-CLEAN — published under the v3.27 fail-open. The loop was genuinely productive: iterations 1/3/4/5/6/8 each surfaced real truth/editorial defects that were remediated (Cavern OilRig over-attribution → low-confidence; Everest background → Halcyon-cited; Langflow uncited PoC removed and a wrong KEV-date framing corrected; KNDA unsupported diplomat-count dropped; XEntry two-incident conflation corrected; Zimbra CVE→issue mapping hedged; OilRig 'Lyceum' alias removed; SharePoint 'Janggggg' re-cited to BleepingComputer). Iterations 2 and 7 returned CLEAN but each was refuted by the next model's confirmation pass — exactly the blind-spot catch the double-CLEAN gate exists for. Of iteration 8's four findings, three (the two F4s and the F3) were remediated post-verdict; one (F6, Zimbra CVE-2026-10631/-50054 issue mapping) was left as an accurate hedge rather than re-sourced from an unverified new source at the cap. verification_residual_count is recorded as 4 per the fail-open rule (final verifier verdict's truth+editorial), acknowledging the post-cap fixes were not independently re-verified; the weekly quality audit should confirm them and add SecurityWeek to resolve the Zimbra mapping.
• Single-source: 2026-07-22/xentry-team-bitlocker-lotl-extortion-rmm-gpo — first-hand Kaspersky GERT IR analysis (reputable lab); credibility held at 2 pending corroboration.
• Sub-agent note: the first S3 (research) spawn terminated early on the content-safety classifier before writing any findings; re-spawned with an Opus model override, which completed cleanly and returned three items. No S3 coverage lost.
• Coverage gaps: cert-eu (feed low-cadence, latest 2026-06-10); cert-pl (latest 2026-06-12, already covered); ncsc-uk (latest 2026-07-15); cert-at (latest 2026-06-01); enisa (latest 2026-07-14, non-advisory); ncsc-ie (2026-07-20 Citrix/WordPress already KEV-covered); chrome-releases (feed returned 0 items — jina credit exhausted mid-run, recipe re-verification flagged); keycloak (fetched, no security items in window); crowdstrike / trellix / withsecure-labs / infoguard-labs / shadowserver / zimperium-zlabs (quiet in-window).
• Watchlist: no product or supplier watchlists configured in this deployment — sweeps are no-ops (products checked=0, hits=0; suppliers checked=0, hits=0).
• Essential-coverage: all essential-tier sources attempted; cert-eu, cert-pl, cert-at, ncsc-uk, enisa returned no in-window items (low-cadence feeds, not failures).