Run record — 2026-07-28T0409Z-intel

Tuesday-morning UTC fire, 24 hours after the previous intel run, so the window sits exactly on the 24-hour floor and widens to 26 hours for overlap. Four parallel research tracks covered active threats and vulnerabilities, the home region and sector, research and investigative reporting, and incidents and disclosures. All four returned inside the cap. Six entries published: five new and one update. No deep dive. The fire ran just under two hours end to end, most of it in a five-iteration verification loop.

Verification & coverage notes

• Published (6). Two vulnerabilities that CISA confirmed as exploited on the same day — an unauthenticated OS command-injection flaw in Arista's on-prem VeloCloud Orchestrator (critical) and a FortiOS SSL-VPN flaw that defeats the vendor's own fix for the symlink-persistence technique (high); a vBulletin pre-authentication code-execution flaw whose working exploit went public four weeks after the patch (notable); an update on the Ernst & Young support-platform breach now claimed by an extortion group (notable); and two threat entries, an IoT botnet that moved its command-and-control addressing onto blockchain name services (notable) and a malware-as-a-service trojan that drives the victim's own logged-in browser on a hidden Windows desktop (notable).

• One critical this window, and why it clears a bar nothing has cleared in fourteen days. The store has published no critical entry in the trailing fortnight, and comparable items — including a CVSS 10.0 actively-exploited SonicWall appliance flaw on 2026-07-14 — shipped at high. The Arista item is rated higher on facts the vendor states rather than on severity score. Exploitation is asserted by the vendor itself, not inferred from a catalog listing. There is no exploitation precondition an operator can remove in configuration: the advisory says the interface is exposed by default, that no configuration can prevent the exposure, and that no credentials are required, leaving network placement as the only lever — where the SonicWall comparison required the appliance to be internet-facing. And the affected component is a management plane whose compromise the vendor says may extend to the managed Edge fleet, so the blast radius is not one host. Disclosure, patch and exploitation confirmation all landed inside this window.

• A vendor field and a government catalog disagree, and the entry says so. As fetched during this run, Fortinet's FG-IR-25-934 still displays "Known Exploited: No" with a timeline whose last update is 2026-03-12, while CISA added the same CVE to the Known Exploited Vulnerabilities catalog on 2026-07-27. This is not treated as a contradiction between two claims about the world — the vendor field appears simply not to have been refreshed since March — but the entry records both states rather than quietly presenting the catalog listing as vendor-confirmed.

• A CVSS figure that looked like a vendor contradiction and was not. The research return carried CVSS 5.3 for the FortiOS flaw from the FortiGuard advisory page, while the vector Fortinet submitted as CNA computes to 5.9. Composition initially recorded that as an inconsistency inside Fortinet's own records. Verification found the actual explanation: the 5.3 on the advisory hyperlinks to the same base vector with temporal metrics appended, so 5.3 is the temporal-adjusted score of the 5.9 base. The entry now carries 5.9 — the rest of the store's CVE records carry base scores, and mixing a temporal one in would have quietly corrupted comparison — and explains the relationship so a reader who sees 5.3 on the vendor page can reconcile the two. Separately, the vBulletin score is the 9.3 the CNA publishes on its own advisory.

• An affected range widened by reading the owning record. Two research tracks reported the vBulletin flaw as affecting the 6.x branches only, following the discloser's advisory. The NVD record states 5.x through 5.7.5 as well, and no fixed 5.x build is named anywhere — a materially larger and less remediable exposed population than the advisory's own summary implies. The entry carries the wider range and flags that 5.x operators need a migration plan rather than a patch.

• A claimed intrusion, framed as a claim throughout. The Ernst & Young update rests entirely on assertions an extortion group made to one outlet, which states plainly that it cannot verify them and that the victim has not confirmed the attribution. Every element — the supply-chain credential theft, the reach into issue tracking, source control and a cloud tenant, the deadline — is attributed rather than asserted, the entry's confidence is low and its credibility rating is 3. The transferable lesson is written so it holds whether or not the claim is true.

• A relationship recorded at the strength the source supports. The registry now carries an attributed-to edge from the Ernst & Young incident to the claiming group, with a note stating in the edge itself that the basis is a leak-site self-claim the reporting outlet could not verify and the victim has not confirmed. The edge exists because the claim is the news; the note exists so no downstream reader mistakes it for an established attribution.

• An alias deliberately not created. The research return proposed registering the two predecessor malware families as aliases of the new botnet key. They are ancestors in a code lineage, not other names for the same thing, and aliases drive dedup on permanent keys — an incorrect one would silently pull future reporting on those families into this record. The lineage is described in the registry summary instead.

• A revoked ATT&CK id caught before it shipped. The technique planned for the advertised defence-evasion feature of the hidden-desktop trojan is revoked in the pinned v19.1 dataset in favour of a successor id. The mapping was validated against the pin on disk before composition and the successor used. All mapped ids across the six entries were checked the same way.

• Indicators withheld. Four of this run's primaries publish indicators: the Arista advisory names attacker source addresses, the botnet report publishes hashes, conventional domains, blockchain names and infrastructure addresses, and the hidden-desktop analysis names a hardcoded command-and-control endpoint and the sample's dropped file names. None appears in any entry; the behaviour is described instead, and each entry's sourcing note points the reader at the vendor page for the indicators themselves.

• A vendor pitch stripped from a primary. The hidden-desktop analysis closes by recommending its publisher's own product. Only the non-promotional part of its detection reasoning is carried, and the entry's triage discriminators are derived from the mechanics the analysis documents rather than from its remediation section.

• Two entries corrected from multi-source to single-source. Verification found that the second source on the botnet and hidden-desktop entries was in each case a same-day press write-up of the single research report the entry already cited, attributing every technical claim back to it and adding no first-hand observation. Independence is about first-hand observation rather than count, so both entries were reclassified single-source and their credibility ratings lowered from 1 to 2. The reporting is still cited — it is simply not corroboration.

• borderline-drop: internet-wide scanning for a Spring Boot Actuator heap-dump endpoint using default admin:admin credentials, reported by a single handler diary. The one genuinely new detail is that the scanner probes a relocated management base path rather than the default, which retires path-obscurity as a control. That is a real but small refinement to a misconfiguration class this audience already inventories, it is single-sourced, and the honest answer to whether a Tier 2/3 responder would act differently in the next seven days is no. Recoverable if exploitation or a named victim emerges.

• borderline-drop: leak-site listings for roughly six small and mid-sized German organisations and one French brokerage. Home-region nexus, but leak-site claims only, with no victim confirmation and no high-reliability journalism — the corroboration bar for extortion claims is not met.

• borderline-drop: a third breach claim against a US airline. No home-region or sector nexus, thin transferable technique content (a previously-disclosed unpatched flaw re-exploited by a second opportunistic actor), and the primary was unreachable on every transport, so it could not have been cited even if it had cleared the gate.

• out-of-window: macOS trusted-application code-replacement research (primary 2026-07-23, with a 2026-07-27 pickup that added no technical delta); a fake-Teams-update multi-RMM phishing campaign (primary 2026-07-21, outside even the 72-hour developing window); a Council of Europe extortion case; a hotel Wi-Fi DNS campaign; and a beverage-sector extortion claim. Also dropped as too thin a delta: a French advisory adding one CVE to an already-covered June batch of an IT-asset-management platform.

• A duplicate correctly caught rather than re-published. The home-region track investigated the sixteen-nation joint advisory on Russian webmail espionage in full technical depth before confirming, against the coverage index and the registry, that it is the same advisory at the same URL already used as the primary for entries published on 2026-07-24 and 2026-07-25. It was dropped as a genuine duplicate rather than reframed as an update, which is the correct disposition when there is no delta.

• Recency disclosure. Five of the six entries rest on primaries published inside the strict 26-hour window. The botnet entry does not: its technical primary is dated 2026-07-25, two days before the window opened, and the in-window fact is the first independent security-press coverage on 2026-07-27. It is carried on the 72-hour developing-story window with event_date set to the research publication date, and the sourcing note states the framing so no reader is misled about freshness.

• No deep dive. No earlier run published one today, so the slot was open, and it was left empty deliberately. The highest-urgency item is the Arista flaw, but its advisory describes the vulnerability only as reachable "privileged internal functionality" with no component path, no exploitation mechanics and no kill chain — there is not enough public technical substance to sustain long-form treatment without padding it. The FortiOS item has the better hunt story but its advisory runs to four sentences, and the background material predates the window by more than a year. The botnet report is by far the most technically substantive primary in the window, but its measured footprint sits largely outside the constituency and its actionable surface for this audience is bounded. No depth was manufactured to fill the slot.

• Verification took five passes and closed on two consecutive clean reads from different models. Eleven truth defects were found and fixed across the first three rounds, and the two most consequential were both about sourcing rather than facts. The first: an apparent contradiction between two Fortinet scores — 5.3 on the advisory page, 5.9 from the vector — was written up as an inconsistency in the vendor's own records, when the 5.3 is simply the temporal-adjusted view of the same 5.9 base. Two later rounds re-derived the arithmetic independently and agreed. The entry now carries the base score, because every other record in this store does. The second: two threat entries claimed independent corroboration from a second outlet that had, in each case, done no first-hand work and attributed everything back to the single research report already cited. Both were reclassified single-source with their credibility ratings lowered. Also removed along the way: a motive assessment credited to researchers who never made it, a count that hardened a source's explicitly partial list, an absolute about vendor mitigations the advisory contradicts, and a claimed delta an update entry's own parent had already published. One finding was rejected rather than applied — a pass reported a research publication as a missed angle when that exact source is already the primary of an entry published two days earlier, and two later passes confirmed the rejection. The residual count is zero.

• Source health: clean. The full probe covered 168 of 168 sources in 93 seconds with nothing classed as needing a bridge or a demotion, so there is no standing repair order this run. Three recipe-quality gaps are recorded against their source records for a future run: an Apple advisory table and a UK regulator listing that both render client-side and return no rows to the current transport, and a Spanish national-CERT listing in the same condition.

• Reader-proxy credit pool still exhausted. The metered reader proxy returned HTTP 402 again this run, the fourth consecutive fire to record it. It is the pinned transport for the Spanish national CERT and the documented fallback for several anti-bot-blocked hosts, so its absence is what turned two of this run's three fetch failures into hard gaps rather than recoverable ones. Direct transports carried every source that could be reached without it.

• Coverage gaps: ccn-cert-es, inside-it-ch, apple-security (see fetch_failures); ico-uk (listing renders client-side, no dated items reachable); mysites-guru (reader returned navigation chrome only); cisa-directives (listing page returns navigation markup with no drillable content, and no in-window directive activity surfaced elsewhere); group-ib (blog index returns an alphabetical archive with no date ordering — an RSS recipe would fix it); sysdig (JS-rendered shell, newest identifiable post predates the window); intrinsec (listing resolved but the drilled article URL 404'd); kudelski-security, synacktiv, le-monde-info, jpcert (not reached inside the 45-minute research budget; rotation priority next fire).

• Watchlist: not reported — the organization profile configures no product or supplier watchlists, so both sweeps are no-ops and both tracks correctly reported zero checked and zero hits.

• Essential-coverage: all essential-tier sources in the vulnerability and home-region slices were attempted and answered. The KEV catalog returned catalogVersion 2026.07.27 carrying both of this run's additions; the CISA advisories listing was enumerable and showed no other in-window item.