2026-08-10T0411Z-intel

Verification & coverage notes

This run's shape: an empty discovery window and a fully drained coverage backlog. All four window sweeps (S1–S4) returned zero publishable items against a 24 h window — the previous fire was the 0110Z weekly, which stood down as a duplicate week and published nothing, so the last content-publishing fire was 2026-08-09. Every national authority in the home-region slice has been silent since Friday 2026-08-07, and this year's Black Hat and DEF CON research wave was already absorbed by the 2026-08-08 and 2026-08-09 fires. Three independent sweeps agreeing on zero is a genuine quiet weekend, not a search failure.

Everything published here therefore comes from two places: the fifteen open rows of state/coverage_backlog.md (plus a sixteenth opened and resolved inside this run), and three uncovered items this run's own completeness sweep recovered. That is why a quiet window produced eighteen entries, and it is not a volume increase — dedup guarantees a re-scan republishes only the delta, and each of these items was researched and verified by an earlier fire that could not publish it. All fifteen backlog rows are now resolved: fourteen published, one struck on relevance. The backlog file records each resolution with its publishing entry id.

Backlog framing corrected before publication — the reason the deep read is mandatory. The queue row for CVE-2026-66066 asserted that "Rapid7 confirms active exploitation". A raw-body search of both Rapid7 posts for "wild", "exploited" and "scanning" found no such claim anywhere, and Rapid7's own tracker states the opposite: it is not aware of exploitation in the wild. What actually happened is Rapid7 reproducing the chain across five Rails version lines and shipping a public Metasploit module. The entry publishes that as weaponisation and stays at high; publishing the row as written would have been a fabricated escalation inherited from a note nobody had re-checked.

Two further attribution corrections applied at composition. The Żabka entry is composed strictly on what Żabka itself confirms — a compromised external service-provider account reaching the ticketing system — with the 541,000-ticket and 89-repository scope attributed to a criminal-forum seller and the Jira-to-production mechanism attributed to the reporting outlet's own explicitly stated guess. And in the Moucka entry, the platform's name, the absence of enforced multi-factor authentication, both of Moucka's aliases and the co-conspirator's identity are all attributed to KrebsOnSecurity, because none of those words appears anywhere in the Department of Justice release, which was verified directly.

Quote fidelity: on the first pass, twenty of the then thirty-four evidence quotes failed a literal substring check (the run finished with 66 records across 18 entries, all verified). Most failures were extraction artefacts — the saved bodies are raw HTML, so tags and entities sit inside otherwise-genuine prose — and resolved once the bodies were stripped with empty-string replacement rather than whitespace. Four were real defects and were fixed against primaries re-fetched for this run: a Forescout sentence beginning "Although we cannot confirm…" had been turned into a standalone de-hedged assertion by dropping the subordinating conjunction; a second Forescout sentence was cut mid-clause with a fabricated full stop; and both CISA quotes ended in a comma inside a larger sentence rather than a period. One further "quote" was a composite of a vendor page's headline copy and was replaced with the contiguous sentence that actually exists. The Forescout and Nextgov bodies had never been saved by the sub-agent, so those eight quotes were unverifiable until the main agent re-fetched both primaries — which also surfaced a fact the relay reporting had lost: 19 of the 22 exposed controllers in attacked cities sat on the same mobile carrier network via cellular routers, a finding distinct from the 19-of-22 firmware-susceptibility figure despite sharing the ratio. The entry keeps them separate.

Item granularity and dedup. Five entries ship as update_of deltas against tracked ground rather than as new stories: the Rails weaponisation, the ikeext root cause, the Forescout census, the BINDCLOAK teardown (Part 2 of a series whose Part 1 is already published) and wp2root. The store-wide CVE index was checked for every identifier; CVE-2026-31431, CVE-2026-66066 and CVE-2026-33824 were already present and all three ship as updates accordingly, while the nine new identifiers were absent store-wide.

CVE provenance. Each of the four Wazuh identifiers was read off its own advisory record — which required forcing the HTML render, because a GHSA page's markdown variant drops the sidebar panel where the CVE ID lives — and then cross-checked against BSI's independently published list, where all four matched. This is precisely the pairing that the 2026-08-09 audit declined to publish on, and it is now resolved rather than guessed. None of the four had propagated to NVD or MITRE at composition time; that is propagation lag, and it is stated in the entry rather than papered over. For NatJack, the mapping of two CVEs to two platforms was taken from the researcher's explicit statement, not inferred by position: both identifiers name the downstream-spoofing TCP-hijack primitive, one per platform, and the other three primitives carry no identifier and therefore no vendor fix.

Absences confirmed rather than filled. Three published items carry no CVE at all, and in each case the absence was verified rather than assumed: the FreeBSD CTL HA primitives (no identifier from the project or the researchers), the Linux bridge STP use-after-free (absent from both the advisory and the fix commit), and the PHP unserialize use-after-free underlying wp2root (consistent with PHP's own position that such bugs are not treated as security issues). No identifier was invented for any of them.

• borderline-drop: Université libre de Bruxelles Qilin leak-site listing — S4 surfaced it and recommended against publishing. Single-source from an Admiralty-C tracker, no victim statement, no Belgian federal notice, and nothing in French- or Dutch-language press despite a targeted search. A leak-site claim needs victim disclosure or high-reliability journalism before it can be stated as fact.
• borderline-drop: Intrinsec Enterprise LLM Threat Atlas — a methodology and reference document restating widely known LLM threat categories, with a risk ranking whose basis is unquantified in the reachable text. Does not change what an already-highly-skilled responder detects, hunts or hardens. Struck from the backlog with this reason.
• borderline-drop: 1Password Off-by-1 Labs "FLAWED" study (54% of 6,080 LLM-generated patches failed to fully remediate or introduced new bugs) — a study statistic about AI-assisted patching rather than tradecraft a responder acts on, and the pipeline has already published a concrete instance of the same lesson. Carried to the backlog rather than discarded, in case a future fire covers AI-assisted remediation practice.
• borderline-drop: several unconfirmed single-source leak-site claims against French private-sector SMEs, associations and sports clubs, and a claimed listing against a French municipality — none clears the public-sector or critical-infrastructure relevance bar, and all fail the fake-news scrutiny bar.
• borderline-drop: recycled Coldcard "insider" reporting dated 2026-08-09 — re-framed 2026-08-04 news with no new fact; the underlying incident is already covered.
• out-of-window, then published: Retelit (Italy) Qilin compromise — primary dated 2026-08-04, updated 2026-08-06, outside window_hours=24. Initially deferred to the backlog; published in this run instead after verification iteration 1 flagged the inconsistency (see above). Its event_date is the confirmed incident date of 2026-06-08, which is honest about the item's age.
• out-of-window: NatJack traces to 2026-08-06, and the Novee coding-agent CI research and the Linux bridge STP use-after-free both to 2026-08-05 — all outside both the 24 h and 72 h windows. Rather than let them fall through a second time they were treated as recovered coverage gaps: S3 verified all three were absent from both the 14-day coverage index and the entity registry, a scoped follow-up sub-agent deep-read and verified them, and they are published here with honest event_date values under the same reasoning the coverage backlog applies to verified-but-unpublished items. This is disclosed deliberately because it stretches the recency gate, and the verifier should challenge it.
• Single-source: 2026-08-10/interlock-volatility3-winpmem-credential-theft, 2026-08-10/esxi-busybox-ash-command-obfuscation-21-techniques, 2026-08-10/pam-rootok-identity-shuffle-as-anti-forensics-xmrig and 2026-08-10/coding-agent-forensic-artefacts-opencode-codex-credentials — each a single originating research or incident-response publication with no independent second assessor. Where a vendor published two documents on the same finding, that is recorded as one assessor with two publishers and credibility stays at 2.
• Single-source: 2026-08-10/cve-2026-33824-ikeext-double-free-root-cause-published — 0patch is neither the vendor nor a national CERT, so no carve-out applies to its root-cause analysis. Microsoft's own record corroborates the CVE, its CWE-415 classification, its CVSS, its patch date and the affected range, but not the module- and function-level detail.
• Reduced confidence: 2026-08-10/zabka-supplier-account-jira-access-confirmed and 2026-08-10/pam-rootok-identity-shuffle-as-anti-forensics-xmrig carry confidence: medium — the first because the operationally interesting scope is unconfirmed attacker claim, the second because a single incident-response account describes an engagement no second party has reported.
• Deep dive: 2026-08-10/freebsd-ctl-ha-three-preauth-kernel-rce-primitives-port-999, category network-stack-rce, selected on criterion 3 (substantive new technical analysis with enough public detail to act on). No deep dive had been published today. Category rotation applied: web-app-rce, the category the alternative candidate would have taken, was used on 2026-08-05 and is therefore demoted.
• Action-item discipline: 6 action items across 18 entries, with 12 entries carrying none. Every action names a specific product, version boundary or configuration surface derived from that finding's own mechanics; none restates the body's detection guidance.
• ATT&CK mapping: every id validated against the pinned dataset at ATT&CK v19.2 before composition. One revoked id was caught and replaced — T1070.002 is superseded by T1685.006. Group-IB's own cited T1564.013 was deliberately not carried: it resolves in the pinned dataset to "Bind Mounts", which does not describe the behaviour reported, so the source-supported mappings were used instead.
• Retelit published within this run after the verifier challenged its deferral. The out-of-window note below was written when this run intended to defer the item to the backlog. Verification iteration 1 flagged that as inconsistent — the run was publishing three items of the same 2026-08-05 and 2026-08-06 vintage as recovered coverage gaps while deferring the one its own notes called relevant and uncovered, and the deferred item was the most constituency-relevant of the four. That criticism was accepted: a scoped follow-up sub-agent (B5) deep-read the primary, and the item published as 2026-08-10/retelit-qilin-italian-telco-cloud-operator-public-sector. The backlog row was therefore opened and struck inside the same run. The deep read also changed the story materially — Retelit had in fact given its own account, in a right-of-reply to the investigating outlet rather than through its own press channel, which this run confirmed carries no statement about the incident.
• Dedup confirmation (gate warning, deliberate): 2026-08-10/retelit-qilin-italian-telco-cloud-operator-public-sector shares actor:qilin with a Romanian university incident of 2026-07-29 and with a W31 weekly entry. Neither is a predecessor: this is a separate victim, a separate country, a separate sector and a victim-confirmed intrusion rather than a leak-site claim. Not an update.
• Dedup confirmation (gate warning, deliberate): 2026-08-10/esxi-busybox-ash-command-obfuscation-21-techniques shares the entity actor:akira with 2026-08-05/vbs-ruag-akira-ransom-payment-review-governance. The non-update decision is deliberate and the two share nothing but the actor key — one is a governance review of a ransom payment at a Swiss defence subsidiary, the other a catalogue of shell-obfuscation techniques in which CrowdStrike names Akira only as one of several operators that reach the hypervisor layer. Neither is a delta on the other. The entity link is kept because the prose names the group and every named actor is linked by registry key.
• Source-URL liveness (gate warning, transient): the abbreviated upstream commit URL returned HTTP 403 to the gate's own re-check while resolving normally when fetched during the run — an anti-bot response to the checker's user agent, on a URL this run verified live and whose page title matches the cited commit.
• Coverage gaps: prodaft (frozen client-rendered snapshot, sixth quiet run); chrome-releases (feed subcommand returned zero items on a live source — recipe drift); csirt-acn-it (listing returned no date-bearing rows); git.kernel.org (anti-bot interstitial on every transport — recovered via a source-code mirror, no coverage lost); typhoonpwn (fetched cleanly but carries no per-category privilege-level text).
• Essential-coverage: no misses. All 11 S1 essential-tier records and all 13 S2 essential-tier records were attempted.
• Source health: 181/181 probed in 101s, no source flagged for action; no UNSOLVED entries to repair this run.
• Wall-clock: this run overran its own soft watchdog. It completed the publishing chain at roughly 2h55m against the ~3h guidance. The cause was scope rather than a stall: an empty discovery window turned the run into a sixteen-item backlog drain, and the verifier loop then ran five iterations because each pass kept finding real defects in a batch of eighteen entries — 21 findings, then 2, 6, 5 and 4, every one of them remediated. The final iteration's CLEAN confirmation was waived under the watchdog rather than delaying the run record, and the residual is recorded. Nothing was carried unverified: the last iteration re-checked 42 URLs live and confirmed no truth-critical defect beyond the four it reported, all of which were fixed before commit.