2026-08-09T1315Z-audit

Verification & coverage notes

Audit window 2026-08-02T13:09:58Z → 2026-08-09T13:15:57Z (168.1 h): 80 entries across the 10 run records whose start falls inside it (the 80 entries carry 9 distinct run ids; one weekly was a zero-entry stand-down). 65 of 80 verified clean against primary sources; 14 imprecisions; 1 factual error.

Four retrospective truth passes covered every window entry in batches of 20, alternating models, each fetching ground truth rather than re-reading the entries' own citations. Three independent coverage re-sweeps re-researched the window as if for the first time. The full findings are in docs/audits/2026-08-09-weekly-quality-audit.md; this record carries the operational summary.

The one factual error is defender-consequential and this run corrected it. The 2026-08-05 entry on CVE-2026-17583 told readers, in its title, summary, cves[] status and action item, that Thermo Fisher offers no fix for the missing integrity checking on Applied Biosystems genetic-analyzer result files, and that the only available control is architectural. The advisory it cited carries five vendor fixes naming patched versions with download links, and those updates implement digital signatures on the instrument software — the exact control the entry argued was unavailable. Only the three end-of-life ABI PRISM and 3130 Series products are genuinely unfixed. The advisory is at revision 1 and was never revised, so the fixes were available when the entry was composed. Root cause: the HTML rendering of the CISA advisory dropped the mitigations block on two of the three transports the run tried; the machine-readable CSAF JSON carries all fifteen remediation records, the eight per-product vendor fixes among them. That transport lesson is recorded for future runs.

A published claim that a reader could have acted on was wrong, and this run corrected it too. The 2026-07-19 weekly round-up said four classes of exploited internet-facing software were "every one KEV-listed". Eight of the ten identifiers involved are in the catalogue and were added before that entry published; the two Progress ShareFile identifiers never were. Entries are not removed from the catalogue once added, so the claim was already false when written. The exploitation itself was real and separately sourced — the error was an aggregate claim asserting more than its weakest member supported.

Coverage: the research and KEV surfaces came back clean; two genuine misses were recovered. All six in-window KEV additions were already published. Thirteen of the twenty-one items the research-blog sweep surfaced were confirmed already covered. The carried-forward Gladinet CentreStack gap turned out to have been published on 2026-08-03, closing that watch item. Recovered and published here: the WALLIX Bastion REST API authentication bypass (CVSS 4.0 base 10.0, unauthenticated, yielding the appliance's privileged-credential vault, relayed by CERT-FR on 2026-08-06 with the reporting researchers committed to publishing full technical details in September), and CVE-2026-71851 in crypto-js, a twelve-year-old generator that reduces a nominal 128-bit secret to roughly 2^39 possibilities and was under active exploitation while its discoverers were still investigating.

Eight further items cleared the relevance gate and were queued rather than dropped, alongside eight recoverable residuals seeded from the 2026-08-03 stand-down — sixteen open rows in total. Seven were queued because they could not be composed inside this run's wall clock; the eighth, Wazuh, was queued for a substantive reason given below, not for time. They are written to state/coverage_backlog.md, which this run also created: verified-but-unpublished items previously had nowhere to go, and the audit found that the nine residual items a stood-down weekly listed on 2026-08-03 were never published by anything, because the next intel run's window is 24–26 h and the next weekly's is the following ISO week. Both recency gates made them permanently unreachable. Every intel run now reads that file in preflight and works it down.

One item was deliberately not published despite clearing the gate. The Wazuh 4.14.6 advisory set — two critical cluster-protocol file-write-to-root chains and a pre-authentication stack overflow on the enrollment daemon's default listener, in a SIEM platform this constituency's own SOCs run — could not have its CVE-identifier-to-advisory pairing confirmed from the advisory pages read in this run. An unconfirmed pairing is a guess rather than a transcription, and publishing one would have repeated the defect class this audit is reporting. It is on the backlog with that verification named as the precondition.

• Coverage gaps: the OT/ICS research-lab surface (dragos, nozomi-networks, claroty-team82, sans-ics, industrialcyber-co) contributed nothing across the whole window, and five essential-tier sources (cert-at, cert-eu, enisa, enisa-euvd, ncsc-uk) likewise, all while reporting successful fetches. inside-it.ch returned 403 on both direct and reader transports, leaving one home-region claim uncorroborated. tenable-research feed recipe needs fixing.
• Watchlist: none configured — the product and supplier sweeps are no-ops.
• Closed-source intake: intel/ carries only its README; no drops in window, no intake sub-agent spawned.
• Essential-coverage: all essential sources in every slice were attempted; the zero-contribution finding above is a readability question, not a fetch miss.
• Gate at commit: python3 tools/check_run.py "2026-08-09T1315Z-audit" → 39 pass · 0 warn · 0 fail. Store-wide python3 tools/check_run.py --all → 21 pass · 0 warn · 0 fail · 14 acknowledged, and python3 site/build.py emits no self-check warnings.
• Sources: one new candidate added this run — coinspect-research, the publisher that broke the CryptoJS "Ill Bloom" active-exploitation story this audit recovered.