2026-08-09T0412Z-intel

Verification & coverage notes

A quiet weekend window. The gap to the previous fire was 24 h, giving a 26 h window that covers Saturday 2026-08-08 and the small hours of Sunday 2026-08-09. Every national authority in the essential floor — the CISA KEV catalog and advisory feeds, ENISA EUVD, NCSC-NL, BSI CERT-Bund, ANSSI/CERT-FR, CERT-EU, CERT-PL, NCSC-CH, NCSC-UK, CERT.at — was fetched and confirmed to have published nothing after Friday 2026-08-07. That is normal business-day cadence, not a coverage failure, and the KEV catalog has added nothing since Progress Kemp LoadMaster on 2026-08-07, which the previous run already covered. Four entries publish — three new findings and one update, the last of them recovered by the verification pass rather than by the research sweep.

Out-of-window inclusion, stated openly. The TeamDavid entry was published on 2026-08-07 and therefore sits roughly a day outside this run's window. It is included as first coverage anyway, and the reason is a defect in this pipeline rather than a judgement about the item: the InfoGuard Labs source record carried a listing-extraction fault that hid every publication date on that site, so no previous run could ever have seen it. The research sub-agent found and fixed the feed recipe during this fire and flagged the disclosure explicitly rather than letting it disappear behind the recency rule. Dropping it would have left a silent blind spot on roughly 12,000 internet-facing instances of a collaboration suite sold specifically to German-speaking organisations that want to avoid a hyperscale cloud — which is the home region and, for many public bodies, the estate itself. The entry carries event_date: 2026-08-07 and a sourcing note stating the lag, so no reader is misled about freshness.

A name collision, caught late, that would have manufactured a third victim. One research agent reported LexisNexis as a third confirmed Metabase data-theft victim; another traced the same thread to an unrelated earlier breach and dropped it. A re-read of BleepingComputer supported neither: it reports LexisNexis warning customers about a cyberattack at a third-party vendor affecting its Diligence, Metabase API and Newsdesk services, without stating a link to the Metabase flaw and without establishing whether customer data was exposed. The first draft of the entry carried that as a carefully hedged clause. Verification then established the fact that changes the disposition entirely: LexisNexis's "Metabase API" is LexisNexis's own news-aggregation product, which shares nothing with Metabase the business-intelligence platform except the word, and the two sibling services named alongside it in the same sentence are LexisNexis products too. Even hedged, the clause invited a reader to infer a third compromised Metabase instance from what is a coincidence of naming. It has been removed rather than disambiguated, and the entry now names Framework and Tally as the only confirmed victims. The source sentence is also self-contradictory on its face — it says the company did not specifically state a link to the Metabase API and then that it did say its Metabase API was impacted — so the original entry's "BleepingComputer is explicit that…" attribution claimed more than the sentence can carry, and is gone with it.

Sourcing corrections made during composition. The Metabase GitHub security advisory is quoted second-hand through BleepingComputer rather than cited directly: GHSA-vwf4-m7j8-wcjf is absent from OSV and github.com is not reachable from this environment, so the advisory page was never fetched and is not listed in sources[]. The CVSS 10.0 rating and the active-exploitation wording rest on BleepingComputer's reproduction of it, which the entry states. For the TeamDavid entry, the discloser groups several CVE identifiers under single headings without saying which identifier names which flaw; pairing them by position would have been a guess, so every identifier, base score, per-flaw mapping and the affected bound were read from the individual published CVE records instead. Those records are the same researchers' findings with a second publisher, not an independent assessment, so the entry is marked single-source and its credibility stays at 2 rather than being lifted to 1 by republication. One internal inconsistency is disclosed in the entry: the record for CVE-2026-54211 describes an authenticated attacker while its own CVSS vector carries PR:N, and the entry follows the description, which agrees with the discloser.

One verification finding was considered and declined. The second verification pass argued the Metabase entry should be critical with an immediate-action block, on the strength of this store's own precedent: the criticals it sampled all share the same shape — unauthenticated, CVSS around 10, confirmed exploitation, patch available. The argument is a good one and the precedent is real, but the bar for that priority requires every one of its elements to hold, and the first does not: the flaw was disclosed on 2026-08-06, outside this run's window, and this entry is late first coverage carried under the developing-window allowance rather than a fresh disclosure or a fresh weaponisation. Where the remaining doubt sits — is the action time-critical to the hour or the day, three days after a fix shipped and with no reporting of ongoing mass exploitation — the rule resolves it downward, not upward. It stays high. The disagreement is recorded here rather than resolved silently, because the next audit should be able to see that the question was asked and on what grounds it was answered.

The CERT Polska deep dive is single-source under the national-CERT carve-out — the national CSIRT reporting its own forensic investigation in its own jurisdiction. Its report makes no actor attribution, and the entry says so rather than importing the contested cluster labelling attached to the wider December 2025 campaign from the pipeline's earlier coverage. The report PDF could not be read usefully by local text extraction, which silently truncated sentences mid-clause; the reader transport returned it intact, and every quote was checked as a literal substring of the fetched text before the entry was written.

• borderline-drop: MSI Radix AXE6600 Wi-Fi router command-injection CVEs (CVE-2026-71990 / -71991 / -71992 / -71993, EUVD-listed 2026-08-08/09 at CVSS 9.3) — consumer and gaming SOHO networking hardware sits outside the critical-infrastructure, government and public-sector asset profile, and no exploitation is reported that would override that.
• out-of-window: Retelit SpA compromise claimed by Qilin (IrpiMedia investigation) — underlying compromise early June 2026, leak-site claim 2026-07-11, investigative article 2026-08-04; outside even the 72 h developing window, with no fresher development found.
• borderline-drop: Head Mare trojanizing TrueConf client installers (Kaspersky, reported 2026-08-08) — unauthenticated access to TrueConf Server over a port open by default, ending with the legitimate client installer on the server replaced by a backdoored build served to participants as an update. Dropped on constituency relevance: the reported victimology is Russian organisations and TrueConf has effectively no footprint in Swiss or EU government estates. The transferable mechanic is named here rather than lost, because it generalises past the product: an organisation that does not run the compromised conferencing server can still be infected by joining a compromised counterparty's server and accepting its installer.
• No delta: Phoenix Contact CHARX SEC-3xxx firmware 1.9.1, checked deliberately because the vendor committed to shipping it no later than 2026-08-12. Still unreleased, advisory unchanged since 2026-07-30. Worth re-checking before the deadline.
• Not carried: InfoGuard Labs' TeamDavid disclosure was initially dropped by the research sub-agent on the recency gate and restored by the completeness sweep. See the note above.
• Coverage gaps: ssd-disclosure (robot-challenge interstitial on both transports — regression from 2026-08-08); prodaft (fifth stale run; dead subdomain in the source note now corrected); csirt-acn-it (listing returned no date-bearing rows); technadu (JS-rendered homepage, no dated listing); sans-newsbites (no August issue indexed yet); cisa-news (feed items carry no dates); paradigm-shift-research (SPA shell, no server-rendered listing); siemens-productcert-csaf (directory index 403s as documented — the per-advisory recipe works but no Siemens advisory surfaced this run to exercise it); trellix (index stale since April–May 2026); flatt-security (genuinely monthly cadence, newest item 2026-06-01); claroty-team82 (listing carries no dates; both plausibly-recent titles drilled and dated June 2026).
• Essential-coverage: no misses. All 15 active essential sources were attempted across the S1 and S2 slices.

No watchlists are configured for this deployment, so the product and supplier sweeps are no-ops and no Watchlist: line is reported. No closed-source drops were present under intel/, so no intake ran.