2026-08-16T0411Z-intel

Verification & coverage notes

Standard 26 h window against a 24 h gap to the previous fire, which published cleanly. Six entries: two exploitation-status changes on ground the store already carried, one independent confirmation of an extortion group's claims, one deep dive on newly published espionage tradecraft, one unauthenticated account-takeover flaw recovered from an earlier fire's blind spot, and one newly documented Linux botnet recovered by the review loop.

Reader transport unavailable for the whole run, for the second fire running. All seven configured keys for the last-resort reader returned a balance-exhausted error and the anonymous tier refused. The cost this run was concrete rather than theoretical: two essential-tier CISA sources (the advisories feed and the directives listing) went fully unreachable because cisa.gov refuses every direct user agent and the reader is the documented recovery path, and the vendor research post behind the ExfilSquad entry could not be read first-hand. Nothing published rests on an unread source — the CISA KEV and structured-advisory endpoints do not route through the reader and covered that surface, and the ExfilSquad entry is built from two outlets quoting the research directly, with the gap recorded in its sourcing note. This is a standing capability loss the operator needs to clear, not a one-off.

A completeness sweep of the fetch ledger recovered an item all four research passes missed. Cross-checking the run's URL-liveness ledger against the returned findings surfaced a page one pass had fetched but never reported. That page was itself four months old and irrelevant, but its sidebar named three stories worth checking, and a scoped follow-up pass established that one of them was a genuine exploitation-status change on tracked ground: the macOS Screen Sharing flaw this pipeline covered twice as unexploited is now confirmed exploited, with root obtained and a cryptocurrency miner planted. It is published as this run's fourth entry. The other two were verified stale and are recorded below. Reconciling the fetch ledger against the findings set is worth keeping as a standing step — it is what turned a silent miss into an entry.

• Single source of assessment, two publishers: 2026-08-16/cve-2026-58231-sap-commerce-cloud-exploitation-attempts — the exploitation observation is one firm's honeypot telemetry, carried by a national CERT advisory and by trade reporting. Rated credibility 2 on that basis.
• Single source of assessment, two publishers: 2026-08-16/cve-2026-65400-screen-sharing-confirmed-exploited-monero — the exploitation report is the Dutch national centre's, based on a notification it received; the corroborating outlet reports that advisory rather than observing the activity.
• Single-source: 2026-08-16/jewelbug-pdf-viewer-extension-native-messaging-webmail-hole — the investigating lab is the only party with first-hand visibility, having worked from the group's own control panel and victim database; the second outlet reproduces that research.
• Single-source: 2026-08-16/evooo1bot-mirai-derivative-enterprise-exploits-socks5-relay — the same shape: the research lab that found the botnet is the only assessor, and both corroborating outlets restate its blog and its telemetry rather than observing the activity themselves. One regional-spread figure appears only in the secondary reporting and is attributed there, not to the lab.
• Primary unreachable, disclosed on the entry: 2026-08-16/exfilsquad-fortra-confirms-13-victims-power-pages-anon-role — the research firm's own post refuses every transport available this run, so both cited sources are outlets quoting it. They agree and neither contradicts the other.
• Status calibrated down on the SAP entry. The research pass described confirmed opportunistic exploitation; what the sources actually support is exploitation attempts against honeypot sensors plus a national advisory recording active scanning, with no confirmed compromise of a production instance and no public proof-of-concept. The entry says that, and the CVE record carries exploited because the attempts are real and in the wild, not because a production estate is known to have fallen.
• Priority calibrated down on the macOS entry. A case exists for treating a confirmed pre-authentication path to root on an internet-exposed service as critical, and the research pass suggested it. It ships at high instead: the patch has been available since 2026-08-06 and this pipeline has already twice told readers to apply it, the observed outcome is cryptomining rather than destruction or theft, and the critical bar is reserved for items where the reader has not already been given the action.
• Deep-dive category rotation noted rather than clean: the espionage deep dive is filed under the same category as the 2026-08-12 deep dive, four days earlier. The rotation rule demotes a recently used category by one rank, but this was the only candidate that cleared the deep-dive bar this run, so demotion changes nothing. Flagged so the pattern is visible if it repeats.
• No historical-context paragraph on the deep dive despite the actor having older prior reporting under three other vendor names. The investigating lab states those alternate names; the predecessor reports themselves were not fetched in this run, so nothing is claimed about their content. Writing a background paragraph from names alone would be invention.

Verification loop: six iterations, landed on the low-residual early exit rather than a confirmed double-CLEAN. The rotation held throughout — three passes on each model, alternating, with no same-model pair. Every finding raised across all six was remediated, including two entries the loop itself recovered: the account-takeover flaw an earlier fire had missed, and the Linux botnet that four research passes had left unrecorded. The final pass returned a single truth finding, an unsourced campaign name in one clause, which was removed; that is what the residual count records. The run lands there rather than spending two further passes chasing a confirmed CLEAN, because at just over two hours elapsed the wall-clock guard leaves room for the publishing chain and not much more, and the last two passes found only a naming slip and a stale source id between them.

Borderline drops, each researched before being dropped:

• borderline-drop: FINMA chair's interview statement that cyberattacks on supervised banks and insurers are up roughly a third, and that frontier AI models are a sector-wide risk — a regulator's risk commentary with no technique, no incident and no action; the percentage is the kind of figure this pipeline does not carry, and nothing in it changes what a responder does in the next week.
• borderline-drop: Check Point's July 2026 telemetry pickup reporting a 35% year-on-year rise in attacks on Swiss organisations and naming three ransomware brands by share of published victims — aggregate vendor statistics rather than an incident or a technique, with the Switzerland-specific sector line resting on a single trade-press rendering of a vendor country data cut. The two named brands already tracked here gain nothing from a share figure; the third is a name attached to a percentage.
• borderline-drop: Scottish prosecution service third-party survey breach, roughly 300 staff names, roles and work email addresses exposed via an unnamed supplier running a centrally procured assessment — a European public-sector incident with a real third-party-procurement lesson, but no disclosed vector, no named supplier, no actor and no technique the reporting supports. The tell was the mapping: an honest technique list for it would be empty, which is the signal that the entry would be describing too little to publish rather than a reason to invent a mapping. Its freshest source also predates this window.
• borderline-drop: German and Brazilian arrests over a 2023 fraud that drained roughly €30 million from bank customers through a payment provider's faulty booking-logic update — the previous fire already considered and dropped this on the same reasoning, a law-enforcement outcome on a three-year-old incident whose third-party lesson is generic. Dropping it again keeps the two fires consistent.
• borderline-drop: Iran-linked attribution reporting on the US water-utility campaign naming two further states — checked specifically because it would be a material change to heavily tracked ground where every prior entry records that no authority has attributed the campaign. It is not one: the underlying incidents and the intelligence-assessment reporting all date to five and six days ago, the freshest touching source is a recap that itself states the government has still not named a culprit, and the strongest attribution claim available is one newspaper's unnamed-source reporting. The store's existing framing remains accurate.
• borderline-drop: a consumer-grade router authentication bypass carrying a high score and a public exploit, single-sourced to one vulnerability database with no vendor or national-CERT confirmation reachable, and no plausible nexus to this constituency.
• borderline-drop: unconfirmed leak-site listings and a stale unverified public-health data-leak claim, all failing the fake-news gate for want of a victim statement or high-reliability reporting.

Coverage backlog: three rows were resolved and two opened. The espionage research queued by the previous fire is published as this run's deep dive. The row for a SharePoint exploitation-status change is struck as already covered — the store carried that development on 2026-08-13, two days before the row was written against reporting of the same event. The study on AI-generated patches stays open, unchanged, inside its retention period. Two new rows: a malware cluster using a cloud spreadsheet API as its command-and-control transport against critical-infrastructure telecom, out of window by three days; and a critical-infrastructure infostealer study that no available transport could reach.

The unauthenticated account-takeover flaw in a widely deployed commerce platform was initially queued to the backlog on recency alone and is instead published as this run's fifth entry. The review pass was right to refuse the deferral: this run had already judged the item relevant and described it in these same notes as a genuine miss by an earlier fire, so queueing it rather than publishing it was inconsistent on its own terms — and the backlog's rule exempts exactly this shape, an item lost to a pipeline race rather than to staleness, from the recency gate. All three of its sources were re-read and the scores, affected and fixed version lines transcribed from the vendor's own table before it shipped.

Source-health repair, acted on this run rather than deferred: the sweep flagged four sources for demotion. Three of them returned full content when re-probed one at a time immediately afterwards, so the flag is contention under a dead reader pool rather than a broken recipe, and one of those corrections supersedes a previous run's conclusion that the source had no working transport at all. The fourth genuinely depends on the exhausted reader. None was demoted; a transport block is not content death. The underlying weakness is in the probe rather than the sources — a parallel sweep with the reader unavailable produces false demotion candidates — and is left flagged here for the weekly audit rather than changed mid-run.

Coverage gaps: cisa-advisories, cisa-directives (essential tier — direct 403 plus an exhausted reader; see above); paradigm-shift-research (client-rendered shell, reader unavailable); prodaft (pinned to the unavailable reader, eighth consecutive contribution-free run); netzwoche (transient server error); anssi-fr, bsi-de, cert-eu, cert-pl, ncsc-uk, cert-at, enisa, govcert-at (fetched cleanly, nothing new inside the window); the research slice including the major labs (fetched; the only in-window hit duplicated an entry published yesterday); ico-uk, cnil-fr, sec-disclosures-edgar (fetched, no in-window enforcement or filing that cleared the gate).

Essential-coverage: missed=cisa-advisories (Akamai 403 on every direct transport, reader pool exhausted), cisa-directives (same condition).

Watchlist: no product or supplier watchlist is configured for this deployment, so both sweeps are no-ops and no entry carries a watchlist flag.