2026-08-15T0412Z-intel

Verification & coverage notes

Coverage window: catch-up of 48 h (previous run 2026-08-13T0412Z-intel) — the scheduled 2026-08-14 fire did not run, so nothing published after 2026-08-13T04:13Z had been swept before this run. Because the gap exceeded a day, the research pass covering vendor and independent labs additionally walked publisher listing pages filtered to the gap dates rather than relying on advisory and catalogue feeds alone; that sweep is where the Kaspersky, Talos and SentinelLabs items came from, none of which route through a CVE or catalogue path.

Reader transport unavailable for the whole run. All seven configured keys for the last-resort reader returned a balance-exhausted error and the anonymous tier refused, so every research pass lost the bottom rung of the fetch ladder. Three consequences are visible in this run's output: Citrix's own knowledge-base article for the NetScaler bulletin could not be read (its page serves an empty client-rendered shell rather than an access error, so no fallback triggers), and the CVE descriptions and scores in the deep dive are taken from the CNA records instead; one research source stayed blocked behind a 403; and two corroboration attempts for a dropped item could not be adjudicated. No published entry rests on an unread source, but the operator should top up or rotate the key pool — this is a standing capability loss, not a one-off failure.

• Single-source: 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit — Kaspersky's own first-hand analysis, with trade-press coverage that re-reports rather than independently observes; rated on one assessor.
• Single-source: 2026-08-15/jwr-phishing-framework-realtime-operator-websocket-mfa — Cisco Talos's own analysis; no independent second party has published on this framework.
• Single-source: 2026-08-15/cve-2026-73487-flowise-prompt-injection-rce-fix-exists — the assigning CNA is the only party with a technical description; the vendor advisory was not reachable from this environment.
• Single-source: 2026-08-15/cve-2026-19188-haiwell-hmi-gateway-unauth-root-rce — CISA is the disclosing authority and no vendor advisory could be located. The entry does not claim the national-CERT carve-out, because the advisory was read from CISA's structured mirror rather than from the authority's own domain.
• Single-source: 2026-08-15/nhsbt-transplant-data-unencrypted-pager-network — the BBC's investigation is the only first-hand account and carries the organisation's, the network operator's and the regulator's statements directly; other coverage re-reports it.
• Single-source (victim's own disclosure): 2026-08-15/threema-nine-colocation-ddos-swiss-messenger-outage — the operator's own account of its own outage; the corroborating outlet derives from the same post.
• Correction to this pipeline's own record: the 2026-07-01 NetScaler entry stated that no in-the-wild exploitation of CVE-2026-8451 was confirmed. Switzerland's NCSC has carried that flaw as actively exploited with a public proof of concept since its advisory of 2026-07-03, and this pipeline never picked the status change up. The correction ships inside this run's deep dive rather than as a separate entry, because the same entry carries the in-window research that prompted the re-check.
• Identifier hedged, deliberately: the exploitation chain in the deep dive is attributed to the bug the researchers analysed, not asserted as CVE-2026-8452. The researchers say they cannot confirm the mapping and Switzerland's NCSC calls the analysis "likely related" to that identifier; the remediation is identical either way.
• Claim-versus-fact separation held in two incident entries: the French tax authority's confirmed figure of 678,000 records is kept apart from the same actor's unverified claims of a second, larger compromise and of retained access, which the government disputes; and the extortion group's stated exfiltration volumes for the two newly-confirmed victims are reported as the attackers' own claims relayed by a leak-site monitor that cautions they are unverified.
• Deliberate non-update decision: 2026-08-15/trivy-not-litellm-behind-2500-org-credential-collection shares the TeamPCP actor key with an entry from 2026-08-08, but that entry is a vendor threat report profiling the actor among others, and this one is a re-attribution of a specific compromise's blast radius. It is a distinct story rather than a delta on that report, so it ships as a new entry; the shared key is co-occurrence, which the renderer already surfaces.
• The claim that the actor behind the French tax-authority intrusion had separately compromised a cadastral registry did not survive a re-read of the cited reporting: the larger figure it rests on is that actor's own description of the same advertised dataset, and the entry now reports it that way.
• One claim in a research return was left out of the Polish healthcare update as unadjudicable: a report that the breached processor cannot lawfully supply its data to the national breach-checking portal without regulator authorisation sits in tension with the minister's statement that the information will be available there. Neither was published.
• The Fortinet entry's version data is read from the vendor's CSAF records, not its rendered advisory tables: the tables omit the FortiWeb 7.0 branch that the structured records list as affected, and present two builds as available that the records mark as upcoming. An earlier draft of the entry followed the rendered tables and told a 7.0 estate it was out of scope; the verifier caught it against the CSAF and the entry now carries the structured data throughout.

Borderline drops, each researched and verified before being dropped:

• borderline-drop: IBM i August patch cycle (CVE-2026-16860 at 9.9 plus a Debug Server bundle topping out at 9.8) — a coordinated quarterly PTF cadence with no exploitation and no exposure-driven urgency; the normal patch process already covers it.
• borderline-drop: Siemens Siveillance Video CVE-2026-3014 (9.1 command injection) — the structured advisory carries no vulnerability narrative beyond the weakness class and version ranges, the authentication prerequisite is unstated, and the vendor's own advisory could not be located; not enough to write an entry a responder could act on.
• borderline-drop: GitLab 19.2.2 / 19.1.4 / 19.0.6, fourteen flaws including an authenticated package-registry path-traversal RCE — authenticated, unexploited, and handled by the normal self-managed upgrade cadence.
• borderline-drop: Johnson Controls Metasys CVE-2026-34491 (persistent cross-site scripting, government-facilities sector) — requires an authenticated low-privilege account and supported versions are already patched; the end-of-support branches that will never be fixed are a lifecycle problem rather than this week's decision.
• borderline-drop: Hitachi Energy APM Edge (CVE-2026-43284, CVE-2026-43500) — kernel-inherited flaws whose only stated remediation is disabling the affected modules, no exploitation, thin advisory narrative.
• borderline-drop: ANDRITZ HIPASE-250, four flaws including a fleet-wide hard-coded remote-desktop password — the fixes shipped in December 2024 and July 2026, so the disclosure is catching up to a long-available remedy.
• borderline-drop: Johnson Controls Airwall (CVE-2026-64887, CVE-2026-34492) — a hard-coded key in an OT remote-access gateway is conceptually worse than its 6.4–6.8 scores suggest, but there is no exploitation and no out-of-band response to take.
• borderline-drop: Flow Neuroscience FL-100 brain-stimulation device (CVE-2026-18164) — a consumer home-use medical device reachable only within Bluetooth range; outside this constituency's estate even under the healthcare lens.
• borderline-drop: Kaspersky's Armored Likho "Still Toolkit" — the campaign targets Russian individuals and organisations through a Russian-language donation-app lure, and the transferable lesson (a stolen desktop-messenger session survives a password reset) is generic and not tied to this constituency's platforms.
• borderline-drop: Gambit Security on attacker use of AI coding assistants across three intrusions — the report's own conclusion is that the entry vector is unchanged exposed-service exploitation, so nothing here changes what this constituency patches, hunts, blocks or detects.
• borderline-drop: Operation Klonen arrests over a 2023 payment-processor fraud that drained roughly €30 million from German bank accounts — a law-enforcement outcome on a three-year-old incident whose third-party-risk lesson is generic.
• borderline-drop: two Swiss leak-site listings surfaced from a ransomware tracker — uncorroborated claims with no victim statement and no high-reliability reporting; dropped under the fake-news gate.

Identifier conflict logged for the quality audit rather than resolved here: the CVE that the reporting attaches to the Trivy ecosystem compromise is recorded in this pipeline's own CVE index against a different TeamPCP supply-chain incident. The two cannot both be right. The new entry therefore carries no CVE in its metadata, so nothing unverified reaches the store's CVE surface, and the reconciliation is left to the audit with both readings on the record.

Coverage backlog: one row open (an AI-generated-patch study surfaced 2026-08-10). Re-reviewed against today's facts and held open unpublished for the same reason the surfacing run gave — it is a study statistic about AI-assisted patching rather than tradecraft a Tier 2/3 responder acts on. It remains inside the retention period the file itself sets.

Coverage gaps: paradigm-shift-research (no dated listing or feed exists and no in-window article surfaced); sygnia (403, reader unavailable); prodaft (pinned to the unavailable reader; seventh consecutive run without a contribution); venarix (single-page-app listing with no per-post dates); cnil-fr (news page fetched cleanly but the sanctions sub-page was not drilled); cert-eu, cert-pl, kela-cyber, ox-security, seqrite-labs, xlab-qianxin, dfirreport, akamai-sirt, hunt-io (fetched cleanly, no in-window content); csa-labs (heavy in-window output, all of it consolidation of items already covered here or of pre-window primaries — dropped as re-reporting); ncsc-uk (in-window publication was guidance rather than advisory content); cert-fr (a large 2026-08-14 advisory batch was drilled; the flaws are bundled dependency updates without exploitation or severity signal, so none cleared the bar against stronger candidates).

Watchlist: no product or supplier watchlist is configured for this deployment, so both sweeps are no-ops and no entry carries a watchlist flag.