2026-08-09T2315Z-weekly

Verification & coverage notes

The week carried 64 operational entries. Sixteen strategic entries were composed against them, three of which are status updates on ground prior weeklies already consolidated.

Section composition. top-stories: 2 · multi-day: 1 · vuln-rollup: 1 · sector-patterns: 1 · incidents-recap: 1 · research: 4 · annual-reports: 0 · long-running: 2 · policy: 3 · looking-ahead: 1.

Empty section, stated deliberately. No annual or periodic threat report published inside the window beyond the two the daily runs already treated (the CrowdStrike 2026 Threat Hunting Report and Wiz's half-year cloud review). Both are cross-referenced where relevant and neither is re-summarised. The annual-reports section is therefore empty, which is the correct outcome rather than a gap.

Deliberate avoidance of prior weeklies' lenses. Three W32 clusters sit close to ground a previous week already consolidated, and each entry states its own distinct point rather than re-running the earlier one. The management-plane vulnerabilities of this week (Check Point, Cisco Secure FMC, WALLIX, Veeam, Aruba) were NOT written up as a repeat of the prior week's management-plane top story; they appear only in the roll-up, and the top-story slot went to the remediation-failure pattern instead. The CVE-record entry is adjacent to a prior week's "both prioritisation feeds failed" entry and opens by naming the distinction — that one was about the feeds, this one is about the identifier itself. The government-incident cluster avoids the two sector lenses prior weeks used (third-party access; valid credentials plus the platform's own tools) and is framed instead on what was taken and on entry points absent from any internet-facing asset inventory.

Backlog recovery. Five verified-but-unpublished rows from the coverage backlog were re-fetched from their own primary sources and published this run, and are struck in state/coverage_backlog.md with their entry ids: the joint four-nation OT-isolation guidance, NCSC UK on forensic observability, the 2026 SBOM minimum elements, the EU AI Act application-date amendment, and Germany's lapsed NIS2 registration deadline. All five are policy and obligation material, which is this run's own lens; the remaining open rows are operational and stay queued for the intel runs. These items pre-date the reporting window by up to two weeks and are exempt from the recency gate by the backlog's own contract; each entry states its source's real publication date rather than implying it fell inside the week.

On the EU AI Act item specifically. The backlog row flagged that the surfacing run got the timetable wrong three times across six verification iterations. The amended Article 113 text was therefore read from the amending regulation on EUR-Lex and quoted verbatim rather than paraphrased. Worth recording for the operator: no consolidated version reflecting the amendment was available on EUR-Lex, and the European Commission's own Article 113 explorer page still displayed the pre-amendment text when checked during this run — sixteen days after the Commission published the amending act.

Sourcing provenance split, Germany NIS2. The entry deliberately separates what BSI's own publications confirm (the ~29,500 obligated-entity population; that the statutory registration deadline has expired, from BSI's live site banner) from what circulates attributed to BSI but could not be confirmed against any first-party BSI publication (a ~18,500 end-of-May registration count and a 31 July grace period). The only registration count traceable to an official document is the Federal Government's written parliamentary answer: 11,388 as of 5 March 2026. That figure is cited exactly and not rounded.

Single-source items and carve-outs.

• 2026-08-09/weekly-w32-kerberos-identity-confusion-poc-public — single-source: Semperis is both the discovering lab and the Black Hat presenter. Mitigated by verifying both identifiers independently against the National Vulnerability Database in this run; the NVD publication dates (2026-03-10 and 2026-04-14) match the March and April patch months Semperis states.
• 2026-08-09/weekly-w32-half-of-c2-never-asks-dns — single-source: the proportions rest on one vendor's sandbox population and its own labelling of malware C2. Reported as that vendor's telemetry, confidence medium, and the defensive conclusion drawn does not depend on the exact percentage.

Quote verification. Every candidate quote used from a source this run fetched was literal-substring checked against the saved body before the entry was written. One quote a research sub-agent returned for the Semperis write-up failed that check because it carried an ellipsis; it was replaced with the contiguous sentence pair that does appear. Three figures the same sub-agent attributed to Socket (a package-name count, a poisoned-version count, and a mean detection latency) were not present in the fetched body and were dropped rather than carried.

Reduced-confidence inclusion. 2026-08-09/weekly-w32-water-plc-lockout-status — the FBI/EPA joint public service announcement is the authority for the targeted-controller naming and the operational effects, but a direct fetch of the IC3 page returned no usable content in this run. The facts are therefore cited to Tenable's continuously-updated tracking page, which states them as the FBI's, rather than presented as read from the announcement itself. Confidence medium and the sourcing note says so.

Borderline calls.

• borderline-drop: a separate sector-patterns entry on third-party and shared-platform access (Beacon CRM, the Flemish Government contractor, the Power Pages portal pattern) — dropped because two prior weeklies already consolidated that lens and this week's material adds no new angle to it, only new victims.
• borderline-drop: a standalone entry on the Swiss federal-administration ISMS deadline — kept, but folded into the looking-ahead list rather than given its own entry, because the research return itself flagged that its addressee is narrower than practitioner commentary implies and the item is a dated administrative milestone rather than a threat development.

Campaign status re-checks with no material in-window delta, recorded so the next weekly does not re-derive them: the Joomla third-party-extension wave (no new disclosure dated inside the week); ShinyHunters; INC Ransom and the SonicWall SMA 1000 chain (nothing beyond the 3 August reporting the daily already carried); Cl0p's Windchill and FlexPLM extortion (still no leak-site listing, so affected organisations remain between exfiltration and publication); and ExfilSquad's Power Pages campaign (nothing beyond the Swiss advisory of 4 August).

Non-update decisions, confirmed deliberate. The gate flags five entries that share an entity key with earlier coverage; each is a new strategic synthesis rather than a delta, and the reasoning is recorded here so it is auditable. The AI-evaluation entry shares incident keys with a prior weekly's AI entry and with an operational entry from 31 July, but its subject is the shared evaluation vendor rather than model capability — a different finding about the same incidents, which is the weekly's re-framing job. The government-infrastructure entry shares an actor key with a prior weekly's Swiss/EU incident entry, but covers a different victim in a different country by a different access path. The remediation-failure entry shares an actor key for the same reason. The looking-ahead entry shares policy and actor keys with the previous week's outlook by construction — an outlook list tracks the same clocks until they run out, and each item's status is restated with its current date rather than carried forward unchanged.

Two mechanical notes for the next audit. First, prompts/weekly-summary.md Phase 4 instructs that weekly-vuln-rollup entries carry per-CVE cves[] records, but tools/check_run.py FAILs any non-update entry sharing CVE ids with the last 14 days — which a weekly roll-up does by definition. The two prior roll-ups resolved this the same way this one does, by carrying the per-CVE trajectory as a body table with cves: [] in frontmatter; the prompt text and the gate should be reconciled rather than left to precedent. Second, one URL liveness warning survives: the Reuters article cited by the AI-evaluation entry returned HTTP 401 to the gate's own re-check while having been fetched successfully at run time. That is a publisher UA filter, not a dead link.

Coverage gaps. censys-blog — fetch_method: blocked in the allocation, not attempted. mysites-guru — reader keys balance-exhausted (HTTP 402) but content still returned; no in-window Joomla disclosure found. The in-window policy sweep returned empty across NCSC.ch, FINMA, BAKOM/OFCOM, the EDPB, Council of Europe cybercrime-convention tracking, EU and US sanctions listings and CERT-EU — every relevant item was either already published by this week's daily runs or dated outside the window. That emptiness is reported rather than padded: the three policy entries this run carries all come from the backlog, not from the in-window sweep. One recycled-news trap was caught and dropped during that sweep — an admin.ch press release on digital-product cyber resilience that resurfaced under a persistent URL with no visible date metadata and proved to be from August 2025.

ATT&CK pin. tools/attack_data.py --check reports: up to date — local v19.2 matches upstream latest v19.2. No update required this week.

Watchlist. No product or supplier watchlist is configured in the organization profile, so the sweep is a no-op and no watchlist line is reported.