2026-08-01T0409Z-intel

Verification & coverage notes

Window: 26 h, derived from a 24.0 h gap to the previous run (2026-07-31T0409Z-intel). Standard window; no catch-up disclosure required. No closed-source drops were present — intel/ holds only its README — so no intake pass ran. The previous run's record shows publish status ok on main, so no missed publish to report.

Eight entries published, two of them updates to existing coverage. The window held three vulnerability disclosures that demand action ahead of the routine patch cycle, one state-actor campaign against a target population this constituency has a lot of, one confirmed European public-sector incident, one macOS supply-chain malware analysis, and two updates where a tracked story materially moved.

Deep dive: the captive-portal campaign entry. It was selected on active in-the-wild operation combined with direct exposure for the profiled constituency — an SVR-attributed sub-cluster running since May 2026 against travelling corporate and government personnel, with government and diplomatic entities named as the parent actor's primary targets. Its category, state-actor campaign, was also used on 25 and 31 July, which would normally demote it one rank in the rotation; the demotion is waived because the item independently satisfies the top selection criterion. No earlier run published a deep dive today.

Borderline drops, each recoverable from this line:

• borderline-drop: CosmosEscape (Azure Cosmos DB cross-tenant sandbox escape, Wiz Research) — genuinely novel research, but the provider fixed it server-side roughly eight months before disclosure, no CVE was assigned, the provider reports no evidence of unauthorized activity, and no customer-side action is possible or required. Nothing a responder would do differently in the next seven days, so it fails the actionability limb despite its technical interest.
• borderline-drop: Kaspersky's published KATA network-anomaly correlation rules for Kerberoasting and DNS tunnelling — concrete and vendor-portable, but unique-service-principal-name thresholding per account and volumetric subdomain-plus-TXT thresholding are established practice for the detection engineers this brief is written for, and the piece is the vendor's own product documentation. Dropped as not materially improving what this audience can already do.
• borderline-drop: Amgen's 8-K disclosing exfiltration of proprietary data and patient health information from third-party-hosted cloud environments — a US-headquartered company with no confirmed European victim data, and the filing names no vendor, no vector, no actor and no scale, so there is no transferable technical lesson beyond a third-party-cloud exposure pattern this brief covered three times in the past fortnight. It does not clear the out-of-nexus breach gate. Worth revisiting if the promised amendment names a vector or a shared provider.
• The incident tracker and leak-site sweeps surfaced only uncorroborated listings for already-tracked actors (a German solar-technology firm, Spanish, Belgian, Dutch and German victims across three groups) with no victim statement, regulator filing or high-reliability journalism; all dropped on the fake-news gate.
• NCSC-CH's newest incident post (2026-07-31, a QR-code crypto-wallet phishing letter) is a citizen-facing scam warning with no Tier 2/3 content and was judged below the inclusion bar rather than treated as a coverage gap.

Two entries were kept whose vendor advisories predate the window: the application-server pair (vendor bulletins 2026-07-28) and the helpdesk authentication bypass (vendor advisory 2026-07-23). In both cases the freshest available source is in-window — the Swiss national CERT published advisories for both on 2026-07-31 — and that national-CERT publication is the operational trigger for this constituency. Each entry's event_date records the underlying disclosure date rather than the date this pipeline surfaced it, so the reader is not misled about freshness.

Corrections applied during the editorial read of the primary sources, each of which had propagated into the initial research and would otherwise have shipped:

• The interim-fix identifiers for the application-server flaws were wrong in the initial research. The bulletins name one identifier for the console flaw and a different one for the deserialization and log-disclosure pair; neither matches what was returned. Both were read from the bulletins' own remediation sections and corrected.
• The helpdesk advisory's companion denial-of-service flaw initially carried an identifier and a severity score sourced only to a press article, and was cut from the entry's structured records because the vendor's advisory page for the authentication bypass does not mention it. Verification then found that the vendor's release notes do carry it with a description, a score and a credit, so it was reinstated as a full structured record. A later pass then rebound it to 2026.2 on the release notes' phrasing, and a further pass reversed that too, after finding that the vendor publishes a dedicated advisory for the flaw which carries its own CVSS vector and names 2026.2.1 as the fixed release. The entry now follows that advisory, and the disagreement between the two vendor pages is stated rather than resolved. All four states of the decision are recorded here rather than only the last, because the reasoning changed three times on new evidence — twice because a source assumed not to exist turned out to.
• The device-code phishing wave was initially written up as the tracked campaign having moved hosting in July. The source in fact describes a second, parallel wave that began in April and ran alongside the first, with the July figures being a later slice of it. The entry was reframed accordingly.
• The plugin advisory's own introduction and its structured severity block disagree by one day on the fix release date. The structured block's date is used and the discrepancy is recorded in the entry's sourcing note.

Single-source items and carve-outs: the macOS supply-chain analysis, the Joomla plugin disclosure and the device-code phishing wave are each single-source, marked as such, with the researcher's own hedges preserved. The captive-portal entry is marked multi-source for the attack surface but its sourcing note is explicit that the actor attribution and every malware detail rest on one vendor, while the second vendor cited assesses its own overlapping cases as resembling the tradecraft of a different Russian service, never evaluates the cluster the primary vendor names, and declines attribution only to one specific named campaign. That divergence is surfaced in the entry rather than smoothed over.

Attribution held open, not resolved: the water-sector campaign. Neither the federal announcement nor the parallel national alert names an actor, and the investigating bodies have actively declined to offer one — the cited news report states that the bureau declined to say who it thought was responsible and that state officials had not identified anyone either. The Iran framing in circulation traces to two other things entirely: a prior sector-wide advisory about Iranian targeting of water utilities, and a named outside expert quoted in the same report. The entry says so explicitly, carries no attribution, and no actor entity was created.

A duplicate entity key was avoided: one research return proposed registering a new incident entity for the water-utility attacks, which the registry already carries from the 29 July coverage. The existing key is used and the entry ships as an update rather than as new coverage.

Contradiction surfaced rather than resolved: the two SolarWinds pages disagree on where the companion denial-of-service flaw was fixed. Its own advisory names 2026.2.1 as the fixed release; the 2026.2.1 release notes list the same flaw among fixes the release carries in from 2026.2. The entry records the advisory's version, because that is the record owning the identifier, and states the divergence in the body so an operator sitting on 2026.2 does not read the release-notes phrasing as clearance. Both pages are cited.

Deliberate non-update decision, flagged by the gate for confirmation: the Joomla anti-spam plugin entry shares the extension-vulnerability wave entity with an entry from 26 July. It is a new entry rather than a delta because it is a different CVE in a different vendor's plugin, disclosed by a different researcher, and a different vulnerability class — object injection through a deserialised token, where the earlier item was a forged identity cookie. The shared entity is the wave they both belong to, which is the point of linking it.

Watchlist: no product or supplier watchlist is configured in the organization profile, so both sweeps are no-ops and no counts are reported.

Coverage gaps: sysdig (no transport succeeded — the blog is an unhydrated shell to a direct fetch and the metered reader returned a payment error); ccn-cert-es (same reader-credit exhaustion, and its direct bridge is known to return only a navigation shell); cisa-directives (no bridge subcommand exists for the directives listing and the landing page renders as an overview shell — a recipe gap, not a transport failure); msrc-blog and 0patch-blog (both redirect to single-page-application shells with no dated post listing in the fetched body); group-ib (transport succeeded, but the listing carries no publication dates in static HTML and the newest identifiable post predates the window); safeonweb-be (homepage shell without a dated listing); apple-security, cert-pl, cert-at, enisa, ncsc-ch-focus, redcanary, swisspost-cybersecurity, kommunaler-notbetrieb-de (all reachable, nothing inside the window); cryptotimes and project-discovery (not swept, low expected yield against the time budget).

Essential-coverage: all 15 essential sources attempted.

Transport note: the metered reader pool started this run on a single live credential with a low-balance warning and was fully exhausted by the end of it. It cost two sources their sweep during research, and by the final verification pass two government hosts had become unreachable on every transport, so that pass corroborated their quotes against independent secondary reporting rather than leaving them unchecked. The direct ladder carried everything else. This is now an operator action item: the reader pool needs new credentials before a run hits a host that only the reader can reach.

Wall clock: this run took substantially longer than a typical fire, almost entirely in the verification loop, which ran the full eight iterations. That was a deliberate choice rather than a stall — the loop kept returning real defects, including two occasions where a later pass overturned an earlier verifier's own finding, and it converged on a confirmed clean verdict rather than a fail-open. The run stayed inside the wall-clock watchdog and no later fire was pending.