Run record — 2026-07-27T0409Z-intel

Monday-morning UTC fire, 3 h after the 01:10Z weekly and ~24 h after the previous intel run. The window is the 24 h floor. The active source surface was swept across four parallel research tracks — active threats and vulnerabilities, home region and sector, research and investigative reporting, and incidents and disclosures. The research track returned nothing, a genuine weekend-to-Monday publishing lull in which every major lab's newest post was dated 2026-07-24 or earlier; the other three returned one, two and two items respectively. Three entries published: two new and one update. No deep dive.

Verification & coverage notes

• Published (3). An exploited, unpatchable-in-1.x remote code execution flaw in Alibaba fastjson (CVE-2026-16723, high); a delta update on the PTC Windchill / FlexPLM campaign now running a mass extortion-email phase attributed to Cl0p affiliates (high, update_of the 2026-06-27 entry); and a hacktivist doxing operation against French political figures over the Chat Control file — 24 by ZATAZ's count, with a further group and no stated total (notable).

• Sourcing correction caught before composition. The fastjson research return stated that "ThreatBook and Imperva independently confirmed" in-the-wild exploitation. A direct read of the Imperva post found no mention of ThreatBook anywhere in it, and no other fetched source carried that attribution. The ThreatBook claim was dropped and the exploitation evidence is attributed solely to Imperva's own telemetry, which is also why the entry's credibility rating is 2 rather than 1.

• An apparent contradiction that is not one. CISA's SSVC record for CVE-2026-16723 scores exploitation as none, but it is timestamped 2026-07-23 and Imperva's exploitation report is dated 2026-07-24. The entry states both dates rather than picking a side, and the sourcing note explains the ordering.

• CVSS discrepancy resolved to the owning records. Reporting on CVE-2026-12569 splits between 9.3 and 9.8. Both are correct on different scales: 9.8 is NVD's primary CVSS v3.1 score, 9.3 is the CVSS v4.0 score PTC assigned as CNA and the figure this store's June entries carry. The update entry uses 9.8 and states the split in its sourcing note. For CVE-2026-16723 the only published score is the 9.0 Alibaba assigned as CNA.

• Cross-track recovery. The vulnerability track investigated the Cl0p / Windchill story and dropped it as three days stale; the incidents track surfaced it independently with the extortion-phase development the first had not seen. The completeness check recovered it, and it publishes as an update carrying only the delta — the actor attribution and the extortion wave — not a recap of the June exploitation coverage.

• Attribution kept split where the sources split. The joint Ransom-ISAC / eCrime.ch / DEFUSED advisory frames the Windchill campaign as Cl0p affiliate activity; ReliaQuest, quoted by BleepingComputer, holds the actor unconfirmed on tradecraft overlap. Both framings appear in the entry, and the registry relation carries the same caveat in its note. Similarly, the handle "Cybernox" is named only by Cyberattaque.org — ZATAZ reports the same operation without naming the actor — so the entry attributes the handle to the source that supplies it.

• Indicators withheld. The Ransom-ISAC advisory publishes command-and-control IP addresses, a file hash, a distinctive attacker request-header value and a web-shell filename pattern. None of these appear in the entry; the behaviour is described instead.

• borderline-drop: CuteSec / "misère" claim of a 111,528-record French Interior Ministry and Gendarmerie personnel leak — a single hacker post relayed by two lower-reliability outlets with no independent verification of the data's origin, no ministry confirmation or denial, and no high-reliability journalism. Scale and the shared Chat Control campaign link argued for inclusion; corroboration is simply absent. Recoverable as a watch item if the ministry or a stronger outlet confirms.

• borderline-drop: Deadlock leak-site listing of Schaad, Balass, Menzl & Partner AG, a Zurich and Winterthur intellectual-property law boutique (2026-07-25). Home-region nexus and real client-confidentiality stakes, but the only sources are a leak-site tracker and an aggregator mirror of the same post. The previous fire dropped this item for the same reason and logged it for follow-up; 24 h later it is still uncorroborated, so it stays out.

• borderline-drop: ExfilSquad claims against the UK Department for Education, the Police National Legal Database and Newcastle University — direct public-sector nexus, but multiple write-ups document this brand posting fourteen victim claims in a single day including implausible entries, with no official confirmation. Publishing would amplify what looks like a fabricated-claim campaign.

• out-of-window: Deutsche Bank third-party extortion claim (event 2026-07-04, denied by the company); Netze BW / Stuttgart Netze smart-meter third-party breach (freshest source 2026-07-16); SentinelOne Kubernetes CSI path-traversal research (2026-07-23 13:00, roughly 15 h outside the 72 h developing window). Also dropped as stale with no fresh delta: Windows LegacyHive/BlueHammer proof-of-concept activity, Windmill CVE-2026-29059, an OpenSSL denial-of-service issue, Ubuntu snap-confine CVE-2026-8933.

• Recency disclosure. Two of the three entries rest on sources inside the 72 h developing window rather than the strict 24 h window. The Chat Control entry has an in-window primary (Cyberattaque.org, 2026-07-26 13:12 UTC) alongside a ZATAZ piece published three hours before the window opened. The fastjson entry's substantive sources are the 2026-07-21 vendor advisory and the 2026-07-24 exploitation report; it is carried as an actively developing story because exploitation is ongoing and expanding, no 1.x patch exists, and no national CERT in Switzerland, the Netherlands, Germany, France, Poland or at EU level had published on it. The Windchill entry is an update whose delta dates from 20-25 July. A search for fresher reporting on both stories found nothing newer.

• No deep dive. No earlier run published one today, so the slot was open, but nothing earned it. The fastjson flaw has confirmed exploitation but reported targeting is almost entirely US-based and constituency exposure is unestablished, so it fails the "non-trivial exposure" half of the first criterion. The Windchill item is a delta on a CVE already deep-dived in June, and the doxing item is not technical. No depth was manufactured to fill the slot.

• Verification took seven passes, and the loop earned them. Five rounds returned fixes before two consecutive clean reads on different models closed it. The substantive work concentrated on one paragraph of the Windchill entry: the first pass found it treating a version as a patch floor when the vendor lists that version among those receiving a patch, and the correction for that error then over-stated the affected range in the other direction, which the next pass caught. Between them the rounds also removed an unsourced actor alias, a count asserted as settled that the sources leave open, and a claim about compromised sender accounts that neither source makes. One finding was rejected rather than applied: a pass reported that a version had gone unpatched until mid-July when the vendor's own change log records it patched on 18 June, and a later pass re-derived the change log independently and upheld the rejection. The residual count is zero.

• Source health: clean. The full probe covered 166 of 166 sources in 108 s with no source classed as needing a bridge or a demotion — no standing repair order this run. Three sources nonetheless have a recipe-quality gap the reachability probe cannot see: ps.tc, ReliaQuest and Trellix all answer at the transport layer but their listing pages return only navigation markup or a stale index, so their post content is not actually reachable. Documented in their records for a future run to fix; none is a demotion, since none is a transport failure.

• Jina reader pool: recovered, with one dead key. The previous four consecutive runs reported the pool exhausted at HTTP 402. It now carries a working balance and served every fetch it was asked for this run, including the github.com-hosted fastjson advisory that no direct transport could reach. One credential in the rotation still returns 402 and the fetcher rotates past it automatically, so the correct read is a partially-degraded but functioning pool, not an outage — a change from how the last four records described it.

• Coverage gaps: inside-it-ch (403 to every transport — see fetch_failures); ransom-isac blog listing (403 on the index; the specific advisory was reachable via the bridge, so only the sweep of that outlet's other recent posts was lost); apple-security (client-side-rendered advisory table returns no rows to WebFetch or the bridge — a recipe gap, not escalated to the reader because nothing suggested an in-window Apple advisory); cisa-directives (not separately fetched — the advisories and ICS listings showed no in-window CISA activity at all); mysites-guru, kudelski-security, withsecure-labs (not reached inside the 45-minute budget); ccn-cert-es (reader returned a stale 2023 snapshot); le-monde-info (fetch returned apparently mis-cached 2025 content); ncc-research (listing returns boilerplate with a stale date meta).

• Watchlist: not reported — the organization profile configures no product or supplier watchlists, so both sweeps are no-ops.

• Essential-coverage: all essential-tier sources in the vulnerability and home-region slices were attempted and answered. The CISA advisories listing was enumerable this run via the bridge and carried no in-window addition; the KEV catalog's newest entry is still dated 2026-07-22.