ctipilot.ch

2026-07-26T2309Z-weekly

One pipeline fire, in full · weekly run of 2026-07-26 · sub-agent allocation and telemetry, per-iteration verification verdicts and findings, source-list edits, coverage gaps, bridge invocations — and the run's own verification & coverage notes: what was published, what was dropped at the borderline or judged not relevant (and why), single-source carve-outs, and contradictions. Rendered from runs/2026-07-26/2026-07-26T2309Z-weekly.md.

Run telemetry

2026-07-26T2309Z-weekly weekly prompt v3.29 publish ok
30m 50s duration 11 published 2 updates
Claude Opus 5 (claude-opus-5) main agent
W1 stalled

Claude Sonnet 5

Past the 30-min wall-clock cap; abandoned.

W2 Claude Sonnet 5 (claude-sonnet-5)
Items returned
3
Duration
10m 30s
Tool calls
12 WebFetch24 WebSearch8 bridge
Cited sources
3 of 14 in slice

Verification

✓ double-CLEAN · Opus 4.8 + Sonnet 5 #? NEEDS_FIXES · Opus 4.8 · t=3 e=1 a=2 #? NEEDS_FIXES · Sonnet 5 · t=1 e=0 a=0 #? NEEDS_FIXES · Opus 4.8 · t=2 e=0 a=2 #? NEEDS_FIXES · Sonnet 5 · t=2 e=0 a=0 #? NEEDS_FIXES · Opus 4.8 · t=2 e=0 a=0 #? NEEDS_FIXES · Sonnet 5 · t=4 e=2 a=1 #? CLEAN · Opus 4.8 · t=0 e=0 a=0 #? CLEAN · Sonnet 5 · t=0 e=0 a=0

Deep dive

Entries published (this run)

Sources changed (this run)

Edits this run made to sources/sources.json · promotions, demotions, new candidates, and fetch-method / category / reliability / url corrections (the run record's sources_changed[]). Paginated; 10 per page.

No source-list edits recorded for this run.

Coverage gaps (this run)

Sources this run's brief needed that returned no usable content via any documented recipe. Bridge-recovered or quiet-day sources do NOT appear here. (Distinct from the independent source-accessibility probe at the foot of this section, which probes all active sources regardless of what any run needed.)

No coverage gaps in this run · every source the brief needed returned usable content via its documented recipe.

Bridge invocations (this run)

1 bridge call this run · these are successful bridge fetches (separate from "Coverage gaps" above).

1 other
  • fetch_source.py (bridge) ×1

Verification findings · all iterations

Per-iteration finding detail. Each table is one verifier pass · what was flagged, how the main agent remediated it, and the outcome. Walking the tables top-to-bottom shows the verifier's debugging trail across iterations.

Iteration #? NEEDS_FIXES · 6 findings (truth=3, editorial=1, advisory=2) · Claude Opus 4.8 · 11m 11s

F-codeSectionItem · URL/quoteVerifier summaryRemediation · outcome
F3
claim-not-supported
ServiceNow strand: the 2026-07-18 activity date and 'hosted already patched / self-hosted residual' framing were bound to the [NCSC-CH, 2026-07-20] citation, which states only 'Actively exploited' andSplit the clause: NCSC-CH now cites only the 'Actively exploited' status; the 07-18 date and hosted/self-hosted framing are re-cited to BleepingComputer (2026-0
F3
claim-not-supported
SharePoint strand: 'to steal machine keys for long-term access' was bound to [NCSC-NL, 2026-07-21], whose current advisory (rev 1.0.2) states only that a public exploit was published and on-prem is acRebound the machine-key-theft clause to BleepingComputer/watchTowr; NCSC-NL now cites only the public-exploit/actively-abused claim. sourcing_note corrected to
F4
hallucinated-fact
The msaRAT evidence[] and body quote substituted the subject noun: 'msaRAT never touches the network directly…' — the Talos page reads 'This RAT never touches…', so the quotation-marked text was not aRestored the verbatim 'This RAT never touches…' in both the evidence[] record and the body quote.
F5
missing-citation
The Check Point CVE-2026-16232 KEV-listing claim had no inline citation; the only CISA source present was the 2026-07-21 four-KEV alert, which does not list 16232 (it was KEV'd in the 2026-07-22 two-KAdded the CISA 2026-07-22 two-KEV alert to sources[] of both entries and cited it inline on the Check Point KEV claim.
F11
editorial-advisory
'the instant a target opens a message' was in quotation marks but is not a verbatim Proofpoint phrase (accurate paraphrase).Removed the quotation marks; kept as paraphrase. Substance unchanged.
F11
editorial-advisory
Frontmatter evidence[] rendered the BaFin quote with Swiss ss orthography (Geldbusse/verstossen) while the source uses ß.Normalised the frontmatter evidence quote to the source's ß (Geldbuße/verstoßen), matching the body quote.

Iteration #? NEEDS_FIXES · 1 finding (truth=1, editorial=0, advisory=0) · Claude Sonnet 5 · 6m 52s

F-codeSectionItem · URL/quoteVerifier summaryRemediation · outcome
F4
claim-not-supported
Iteration-1's F3 SharePoint remediation overcorrected the sourcing_note: it asserted NCSC-NL 'states only' the public-exploit/actively-abused facts and not the machine-key detail. Iteration 2 fetched Rewrote the sourcing_note: the machine-key detail is corroborated by both watchTowr (via BleepingComputer) and NCSC-NL's own 1.0.2 revision, cited inline to wat

Iteration #? NEEDS_FIXES · 4 findings (truth=2, editorial=0, advisory=2) · Claude Opus 4.8 · 13m 08s

F-codeSectionItem · URL/quoteVerifier summaryRemediation · outcome
F3
claim-not-supported
Certighost CVE-2026-54121: the 'full public PoC' clause was cited to [Microsoft MSRC, 2026-07-14], whose page carries exploit-maturity E:U (Unproven) and never states a public PoC exists — MSRC supporSplit the clause: MSRC now cites only the July patch / vuln nature; the 'full public PoC' claim is re-cited to CybersecurityNews (2026-07-24, the PoC/discoverer
F3
claim-not-supported
msaRAT: the entry stated the WebRTC DataChannel is 'relayed through Cloudflare Workers'; the Talos page states the relay is a Twilio TURN server (global.turn.twilio.com) and Cloudflare Workers handle Corrected summary and body: relayed via a Twilio TURN server, with Cloudflare Workers handling signalling.
F11
editorial-advisory
The Gridbox body quotation inserted 'on a Joomla site' and 'browser' into quoted mySites.guru text without brackets; substance accurate but not a contiguous verbatim substring on the current page.De-quoted to an accurate paraphrase (become a Super User by setting a single cookie value); removed the quotation marks.
F11
editorial-advisory
Frontmatter summary said 'co-sealed by 16 US/NATO/EU-member agencies'; the advisory is ~28 agencies from 16 nations, one of which (Moldova) is neither NATO nor EU. Body already said '16-nation'.Changed the summary to 'co-sealed by agencies from 16 nations'.

Iteration #? NEEDS_FIXES · 2 findings (truth=2, editorial=0, advisory=0) · Claude Sonnet 5 · 5m 48s

F-codeSectionItem · URL/quoteVerifier summaryRemediation · outcome
F4
nonverbatim-quote
The Cavern DNS-AAAA sentence was presented in quotation marks (evidence[] + body) but the live Securelist page text is materially different (OAuth/tenant-validation/TenantId-ClientId-ClientSecret-UserRemoved the Cavern evidence[] record and de-quoted the body to an accurate paraphrase naming the recovered settings (TenantId, ClientId, ClientSecret, UserEmail
F4
nonverbatim-quote
The ENISA Health Action Plan body quote spliced a contiguous sentence with two inserted ellipses (dropping 'was signed' / 'This Contribution Agreement is') — the verbatimness rule treats inserted elliDe-quoted the body to a paraphrase (a EUR 6 million, three-year Contribution Agreement with the European Commission); the correct verbatim quote remains only in

Iteration #? NEEDS_FIXES · 2 findings (truth=2, editorial=0, advisory=0) · Claude Opus 4.8 · 16m 21s

F-codeSectionItem · URL/quoteVerifier summaryRemediation · outcome
F3
claim-not-supported
IFAGE strand: the DragonForce actor attribution was bound to the 20min article, which does not name DragonForce (it reports the published-data content and the French quote only). The attribution is trRe-attributed the DragonForce naming to ICTjournal (2026-07-17, added to sources[]); 20min retained for the publication event and the verbatim French quote.
F3
claim-not-supported
Autismuslink strand: 'INC Ransom's leak-site listing exposing [cantonal BKD contracts / IV agreements]' was cited to the victim PDF, which names no actor, describes no leak-site listing, and says it cSplit the strand: the victim PDF cites only the confirmed exfiltration + temporary server encryption; the INC Ransom leak-site claim is re-cited to Ransomware.l

Iteration #? NEEDS_FIXES · 7 findings (truth=4, editorial=2, advisory=1) · Claude Sonnet 5 · 7m 27s

F-codeSectionItem · URL/quoteVerifier summaryRemediation · outcome
F3
residual-summary-overclaim
The frontmatter summary still carried the pre-iter5 over-claim '(INC Ransom) exposed cantonal education-directorate and disability-insurance records' after the body had been corrected.Reworded the summary to match the corrected body: the foundation serves cantonal education-directorate and disability-insurance-linked clients and confirmed dat
F3
claim-not-supported
The 90-days-of-mail / Global Address List / 2FA theft was cited to NCSC-UK; those facts are stated by the CISA joint advisory AA26-204A, not the NCSC-UK announcement.Re-cited the 90-days/GAL/2FA clause to the joint CSA AA26-204A.
F3
claim-not-supported
The 'ZimbraWeb application-specific password created via the SOAP API that survives both a password reset and the CVE patch' claim (headline/summary/body/Triage) was not supported by any of the entry'Softened to the supported core: Proofpoint documented an attacker-created application-specific password used for persistence (specifics deferred to the referenc
F5
missing-citation
The Check Point CVE-2026-62144/-62145 sibling attribution to NCSC-NL and CERT-FR carried no inline citation.Added NCSC-NL (2026-07-24) and CERT-FR (2026-07-23) to sources[] and cited both inline; noted the CVSS-10.0 on 62144 is NCSC-NL's CVSS v4 score.
F5
missing-citation
The nginx 'F5 framed as primarily DoS' framing claim was uncited.Dropped the uncited F5-framing clause; the rollup now states only the discoverer-demonstrated pre-auth RCE and the withheld-PoC clock (detail in the referenced
F3
claim-not-supported
The nginx 'disputing F5's DoS-only framing' clause was cited to cyberstan.co.uk, which does not discuss F5's framing (that is The Hacker News's).Dropped the F5-framing clause; kept cyberstan.co.uk for the discoverer-demonstrated ASLR-defeating pre-auth RCE and the withheld-PoC clock.
F11
nonverbatim-quote
The BaFin evidence[]/body quote's parenthetical '(Market Abuse Regulation - MAR)' dash was a verbatimness risk against the source.Trimmed the quoted text to the unambiguous first sentence; the MAR-violation detail is now paraphrase, not quotation.

Verification & coverage notes

The run record's narrative body, verbatim. This is where the run accounts for its own judgement calls — every borderline drop and judged-not-relevant item with its reason, dedup decisions, single-source items and their carve-outs, contradictions, and per-source coverage gaps — so nothing the run considered disappears silently.

Verification & coverage notesrun record body

2026-07-26T2309Z-weekly · weekly · Claude Opus 5 · 11 entries published

Verification & coverage notes

ISO week 2026-W30 (2026-07-20 00:00 UTC → 2026-07-26 24:00 UTC). Gap to previous weekly run (2026-07-19T2310Z-weekly) = 7 days; window_days = 7. Duplicate-week guard: no prior -weekly record covers W30 — proceeded.

ATT&CK pin freshness (weekly maintenance duty): tools/attack_data.py --check → up to date, local v19.1 == upstream latest v19.1. No update required.

Closed-source intake: intel/ carries only README (no in-window drops) — no W3 spawned.

Phase 1 week-in-review working lists persisted to work/2026-07-26T2309Z-weekly/week-review.json (46 operational W30 entries synthesised).

Strategic output: 11 entries — top-stories: 2 (exploited internet-facing enterprise/edge software with post-patch persistence; state-nexus self-hosted webmail espionage) · multi-day: 0 (folded into top-stories) · vuln-rollup: 1 · sector-patterns: 1 (Swiss/EU public-sector third-party-mediated incidents) · incidents-recap: 0 (the AI-agent production breaches fold into the research entry; the home-region incidents into sector-patterns) · research: 2 (AI as autonomous operator + AI infrastructure as target; C2 routed through trusted infrastructure / defeating visibility) · annual-reports: 0 (Microsoft Email Threat Landscape Q2 2026 already treated operationally — cross-referenced only, not re-summarised) · long-running: 2 (npm/AI-toolchain supply-chain wave — SANDWORM_MODE delta, update_of W29; Joomla extension wave — Gridbox cookie-forgery delta, update_of W28) · policy: 2 (ENISA EUMSS certification + Health Action Plan procurement guidance; BaFin TeamViewer MAR disclosure fine) · outlook: 1. Empty sections left empty per the relevance-driven volume rule.

W1 research gap (threat-actor / campaign / research / report horizon). W1 failed twice on the Sonnet real-time cyber safeguard (classifier trip at spawn on both the initial and one retry spawn; no findings written either time). Abandoned per anti-crash guard #2 rather than blocking the run. Impact was contained: the weekly's Phase 1 week-in-review reads the 14-day operational store (46 in-window W30 entries loaded in full), which is the material the threat-actor/campaign/research synthesis entries are built from — so the actor, campaign, tradecraft and ransomware coverage in this weekly is sound and complete against what the pipeline surfaced operationally this week. The residual gap is the horizon sweep W1 uniquely adds: newly-published periodic reports not yet treated operationally, and any research not surfaced by an intel run this week. Rolled to the next weekly.

Weekly dedup (against prior strategic entries). Ran against W28 (2026-07-12) and W29 (2026-07-19) strategic entries. Already-consolidated arcs returned only as status deltas: the npm supply-chain wave as update_of 2026-07-19/weekly-w29-npm-supply-chain-developer-targeting (new fact: SANDWORM_MODE poisoning AI-assistant MCP configs); the Joomla extension wave as update_of 2026-07-12/weekly-w28-joomla-file-upload-rce-wave (new fact: Gridbox cookie-as-identity auth bypass, a new technique class). The recurring top-stories (exploited internet-facing software; the vuln roll-up) carry only W30's new crossings, not W28/W29's.

Actor disambiguation (webmail top-story). LAUNDRY BEAR (Void Blizzard / TA488, Zimbra CVE-2025-66376) and TA458 (Operation RoundPress, SOGo CVE-2026-8496) are held as DISTINCT Russian actors — Proofpoint explicitly states it has not observed TA458 using CVE-2025-66376. The entry's unifying claim is the shared attack surface and technique class, not a shared operator.

Per-fact attribution discipline (v3.29 limb b). At synthesis, citation dates were taken verbatim from the referenced operational entries' verified sources[] records (or, for the W2 policy items, from sources W2 fetched this run); each atomic fact is cited to the specific source that states it, one citation per clause; no two distinct CVEs/incidents are chained inside one identifier-labelled clause; quoted text is a contiguous verbatim substring of the cited page.

ATT&CK pin: up to date (local v19.1 == upstream latest v19.1) — no action.

  • Watchlist: products checked=0, hits=0; suppliers checked=0, hits=0 (none configured — no-op; W1 owns this sweep and was abandoned, but the watchlists are empty so no coverage is lost).
  • Coverage gaps: W1 domain (Sonnet safeguard trip ×2 — abandoned, residual rolled to next weekly); cert-pl, cert-at, ncsc-ch-incidents, ncsc-ch-focus (W2 — no in-window policy content); coe-cybercrime (unreachable host, no in-window ratification news); bakom-ofcom (live consultation, no fresh in-window movement); finma (no new cyber guidance/enforcement in-window). Two Europol leads traced to 2025 publication dates and dropped as recycled — not in-window.
  • Essential-coverage: W2 essential CH/EU/gov sources attempted; no essential miss beyond the W2 coverage-gap notes above.

← Operations dashboard · day page 2026-07-26 · run-record contract: docs/pipeline.md