2026-08-02T2311Z-weekly

Verification & coverage notes

ISO week 2026-W31 (2026-07-27 00:00 UTC → 2026-08-02 24:00 UTC). Gap to the previous weekly run record (2026-07-27T0110Z-weekly, which stood down on W30 as a duplicate week) = 7 days; window_days = 7. Duplicate-week guard: no -weekly record on origin/main carries week: 2026-W31 — proceeded.

ATT&CK pin freshness (weekly maintenance duty): tools/attack_data.py --check → up to date, local v19.1 == upstream latest v19.1. No update required.

Closed-source intake: intel/ carries only README (no in-window drops) — no W3 spawned.

Phase 1 week-in-review working lists persisted to work/2026-08-02T2311Z-weekly/week-review.json; 56 operational W31 entries synthesised. Triage outcome in triage.json.

Strategic output: 15 entries — top-stories: 3 (exploited management planes where the patch is not the remediation; water-sector PLC lockouts with quantified European exposure; two Russian state clusters converging on government mail and government travel) · multi-day: 2 (authentication bypasses from code trusting an attacker-supplied identity value; both KEV-driven and patch-driven prioritisation failing in the same window) · vuln-rollup: 1 · sector-patterns: 1 (European public-sector incidents entered through an already-valid credential and the platform's own export function) · incidents-recap: 1 (criminal claims outrunning confirmation in both directions) · research: 2 (tradecraft keyed to the victim host; the AI delta, as update_of the W30 strategic entry) · annual-reports: 0 · long-running: 3 (Joomla extension wave; open-source supply-chain wave; ShinyHunters status) · policy: 1 · outlook: 1. Empty sections left empty.

No critical priority this week, deliberately. The week's genuine stop-and-act item — Arista VeloCloud Orchestrator CVE-2026-16812, CVSS 10.0, exploited and KEV-listed the day of disclosure — already shipped as priority: critical in its operational entry on 2026-07-28, which is where an hours-to-days action belongs. Re-flagging it critical in a Sunday-night strategic synthesis would page on-call about a five-day-old advisory.

Weekly dedup (against prior strategic entries). Ran against the W29 (2026-07-19) and W30 (2026-07-26) strategic entries. Three already-consolidated arcs return only as status deltas: the AI-and-attackers thread as update_of 2026-07-26/weekly-w30-ai-autonomous-operator-and-target, the Joomla extension wave as update_of 2026-07-26/weekly-w30-joomla-extension-wave-status, and the open-source supply-chain wave as update_of 2026-07-26/weekly-w30-npm-ai-toolchain-supply-chain-status. The ShinyHunters status entry carries no update_of because no prior weekly held a dedicated ShinyHunters status record — W29 carried the actor as one strand of a broader identity-abuse entry, and a weekly-long-running status entry is the sanctioned form for an already-consolidated arc. The recurring top-story and roll-up sections carry only W31's own crossings.

Corrections applied to W1's returns before composition. W1 returned useful horizon framing with four defects that were caught and fixed rather than carried: (1) its item-5 title read "TA458/LAUNDRY BEAR", conflating two actors this pipeline holds distinct — LAUNDRY BEAR carries TA488 as an alias, while TA458 is the separate Operation RoundPress actor, a distinction W30's own record established on Proofpoint's statement; (2) an evidence record inserted "SVR-attributed" into a Microsoft sentence that actually ends at "sub-cluster of Midnight Blizzard based on distinctive technical and operational overlaps", so no service attribution is asserted from that source; (3) it dated the Proofpoint OWA post and the mySites.guru Gridbox audit 2026-07-31 when both are 2026-07-29; (4) it proposed T1190 for the water-utility PLC activity, which the referenced operational entries deliberately do not map because the announcement records reachability and credential control rather than exploitation of a flaw — the mapping used here is T1133/T1078.001/T1531/T1565.001, taken from those entries. Several of W1's evidence records were its own prose or a paraphrase rather than verbatim source text, and W1 labelled them as such; none was used as a quotation.

One superseded quote avoided, and one over-correction reversed. The 2026-07-31 Unit 42 operational entry carries an evidence quote that a later correction established Unit 42 never wrote, together with an impact count that understated the campaign. This weekly's AI entry quotes the corrected sentence instead, naming both the three NetScaler exfiltrations and command execution on 11 marimo endpoints. Reading that correction, this run initially also removed the earlier entry's autonomous-versus-manual framing, on the view that Unit 42 did not apportion — which verifier iteration 1 established was wrong. Unit 42 apportions twice, recording that the autonomous campaigns achieved full compromise of none of their intended targets and that the confirmed impact came from separate manual operations, while separately assessing autonomous attack cycles operationally viable with a narrow margin of failure. The entry now carries the apportionment in both directions. The correction entry had fixed only the count, not the split, and conflating the two is what produced the over-correction.

Citation dates and per-fact attribution re-verified at composition. Every inline citation date was taken from the referenced operational entry's own verified sources[] record or from a source W1/W2 fetched this run — never from a discovery timestamp. That check caught four dates drafted from memory: the Apache Airflow oss-sec post (2026-07-28, not 07-27), the SolarWinds CVE-2026-28323 advisory (2026-07-23, not 07-30), the Siemens Desigo CC CSAF (2026-07-14, with CISA's ICSA-26-209-01 republication on 2026-07-28 being the in-window event), and the Searchlight Cyber research (2026-07-20, carried explicitly as out-of-window background rather than an in-window development). Quoted text was taken from the referenced entries' verifier-confirmed evidence[] blocks; one Amazon quote available only as a mid-word-truncated extract was trimmed back to its last clean word boundary and the alias list moved outside the quotation marks.

Registry maintenance — GTIG cryptonym aliases (no new entities). Google's threat-intelligence group's two-word actor-naming schema was not published as an entry: its primary is dated 2026-07-24 (outside this week), and it is a supplementary naming layer that explicitly preserves previous names, ATT&CK mappings and vendor aliases, so it changes how a defender searches rather than what they patch, hunt, block or detect. It was applied as registry hygiene instead — aliases appended to five existing records where the source states the mapping unambiguously: actor:oilrig += SOLAR ION, actor:secretblizzard += TURLA RELIC, actor:midnight-blizzard += ICE RELIC, actor:apt42 += CALANQUE ION, actor:sapphire-sleet += MIDNIGHT NEPTUNE. actor:sandworm already carried SANDWORM RELIC. Deliberately not applied: MUDDY ION → actor:muddywater, which W1 flagged as an unconfirmed mapping, and MASAN, whose relationship to UNC1069 is not stated as an alias. Separately, the actor:sapphire-sleet summary asserted the Amazon attribution "has not been independently corroborated by another vendor"; that clause is now factually wrong and was corrected, because GTIG credited the axios compromise to UNC1069 — already an alias on that record — on 2026-07-30.

An initial scripted attempt at those alias additions matched on an assumed inline aliases: [...] form and silently wrote into the wrong records for the two that use block-form lists, overwriting one record's aliases and appending MIDNIGHT NEPTUNE to actor:knaithe-knyuan. The registry was reverted with git checkout and the edit redone with record-scoped bounds handling both forms; the final diff touches five alias lines, entity count is unchanged at 512, and the alias-collision check is clean.

Gate tooling — the entity-overlap dedup warning was weekly-blind, and is now weekly-aware. The first pre-verify pass raised 29 dedup entity-overlap warnings, every one of them a strategic entry sharing an entity key with an operational entry it explicitly lists in references[]. That is the weekly's design — synthesising those entries is the job — so the warning was firing as a structural false positive on every weekly run. tools/check_run.py now treats a declared references[] link on a horizon: strategic entry as the dedup declaration for that pair, exactly as it already treats update_of. CVE-level overlap is deliberately still reported, because per-CVE metadata belongs to the operational entry that owns it and must never be duplicated upward. The change is scoped to the entity warning only; check_run.py --all re-run store-wide shows no new failure and no lost warning elsewhere, and site/test_build.py passes.

Remaining entity-overlap warnings (11) — confirmed deliberate. Nine are overlaps with prior weekly strategic entries (W29's identity-abuse, third-party-breach and CH/EU incident entries; W30's webmail-espionage and CH/EU incident entries). Those are the weekly-dedup-against-prior-weeklies case this run's dedup section documents: each is a new lens on a tracked entity, not a re-run, and references[] is reserved for the operational entries a strategic entry synthesises rather than for prior strategic entries. The remaining two are prior-week operational entries deliberately not synthesised here — the 2026-07-24 LAUNDRY BEAR Zimbra entry (this week's entry covers the Exchange OWA campaign and the travel vector, a different platform and a different CVE) and the 2026-07-26 Gridbox cookie-forgery entry (superseded within the wave's own long-running status entry). Three warnings from the first pass were resolved properly rather than suppressed, by adding to references[] the older operational entries this run genuinely does synthesise: the original Ernst & Young disclosure that the actor's reach claim is measured against, and the original Stadler Rail breach entry whose vendor statement is quoted here.

A prompt-versus-gate conflict for the audit, not silently resolved. prompts/weekly-summary.md Phase 4 directs that weekly-vuln-rollup entries "carry per-CVE cves[] records with the CURRENT status", but check_run.py's cross-run dedup FAILs exactly that, because every CVE in a weekly roll-up is by definition already covered by the operational entry that first carried it. Every prior weekly roll-up (W27 through W30) shipped with cves: [], so the established practice contradicts the prompt text. This run followed the established practice and the gate: all 15 strategic entries carry cves: [], with identifiers, scores and version boundaries stated in the bodies and owned by the referenced operational entries. The prompt wording is the defect and it recurs every week, but fixing it requires a banner bump across all three lockstep master prompts plus a CHANGELOG entry, which is a change that deserves its own focused pass rather than being wedged in ahead of a verifier loop. Flagged here for the weekly quality audit.

• Contradiction: FortiOS CVE-2025-68686 exploitation status — CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-27 on stated evidence of active exploitation, while Fortinet's own advisory FG-IR-25-934 metadata (last updated 2026-03-12) records severity Medium, "Known Exploited: No" and CVSSv3 5.3. The management-planes entry carries the hedged wording "newly KEV-listed" rather than asserting vendor-confirmed exploitation, and this line records that the two cited sources disagree rather than silently taking CISA's side.
• borderline-drop: GTIG two-word actor-naming schema — primary out of window (2026-07-24) and a naming layer that preserves prior identifiers; applied as registry aliases rather than spending reader attention on an entry.
• borderline-drop: Garante fine against Città Metropolitana di Sassari (EUR 12,000, decision 2026-06-11, disclosed via the 2026-07-29 newsletter) — fails all three weekly inclusion limbs: not on fire, not a cross-day pattern, and a small fine against one Italian metropolitan body is not a horizon shift changing defender obligations, unlike the BaFin/TeamViewer disclosure precedent a prior weekly carried. Single-source on Garante's own newsletter and decision page with no independent pickup, and Garante is not on this deployment's carve-out list. A Tier 2/3 responder would do nothing differently in the next seven days — role-drift in a document-protocol system is data-governance work. No registry entity created. W2 itself flagged it borderline.
• Single-source: 2026-08-02/weekly-w31-commission-cra-application-guidance draws its scope clarifications from the Commission's own publication page with corroborating legal analysis for the obligation dates — multi-source overall. The Commission communication C(2026) 5252 and its annex are reachable from that page only via newsroom redirection-tracked document links rather than stable direct URLs, so the citable source is the library entry.
• Out-of-window sources carried deliberately, each labelled in its entry: Fortinet PSIRT FG-IR-25-934 (2026-02-10 — the advisory for a flaw CISA KEV-listed in-window on 2026-07-27); Zero Day Initiative ZDI-26-035 (2026-01-09 — the advisory for the Langflow flaw VulnCheck reported exploited in-window); Siemens SSA-734552 (2026-07-14 — republished in-window by CISA); Health-ISAC advisory (2026-07-24 — reported in-window on 2026-07-29); Searchlight Cyber (2026-07-20 — background to the AI capability assessment, not an in-window development); Ransom-ISAC (2026-07-22 — the as-of date for the Cl0p victim-listing status, stated as such).
• No standalone OT/ICS entry this week: the thread (Phoenix Contact CHARX with 20 CVEs and no firmware at disclosure, Siemens Desigo CC V7 with no fix, the water PLC campaign, Mendix Runtime) is carried on its most defender-relevant axis by the no-fix multi-day entry and the water top-story. A separate advisory-wave entry would restate the roll-up without adding a lens.
• Watchlist: products checked=0, hits=0; suppliers checked=0, hits=0 (none configured — sweep is a no-op).
• Coverage gaps: consilium.europa.eu forward-look (403 on every transport including the reader; not in the source slice, logged as a fetch failure and an editorial gap); sekoia (blog listing path 404 after redirect — the configured recipe probes healthy); group-ib and recordedfuture-insikt (JS-rendered shells via the direct transport; W1 chose not to spend metered reader credit on them given the in-window leads already secured); zdi, aikido-security, onapsis (rotational-staleness picks, oldest last_successful_fetch 2026-07-14, not attempted — rolled to the next rotation); cert-at, cert-pl (no in-window policy-specific content found); finma (news listing is JS-rendered; no cyber item published in-window, most recent was the 2026-07-09 quantum-computing Aufsichtsmitteilung); edpb (most recent substantive output traces to the 2026-07-07 plenary, out of window).
• Source health: tools/source_health.py probed 172/172 sources in 92 s — 101 ok, 71 bridge-ok, zero UNSOLVED and no repair orders outstanding.
• Four of the six regulatory clocks prior weeklies recorded had no fresh in-window development and were deliberately not restated (Dutch NIS2 Cyberbeveiligingswet, ENISA managed-security-services consultation, German KRITIS-Dachgesetz registration window, ENISA Health Action Plan). Carrying them forward without a fresh source would be recycling rather than tracking.