2026-08-16T2315Z-weekly

Verification & coverage notes

Week covered. ISO week 2026-W33, Monday 2026-08-10 through Sunday 2026-08-16, seven days since the previous weekly record. The week's operational output was 61 entries across six run days — 26 vulnerability, 15 threat, 14 incident, 6 research, of which 24 were updates and 6 were deep dives; 28 carried high priority and none carried critical. No run record exists for 2026-08-14 and no entry carries that discovery date; the fire of 2026-08-15 covered the gap with a widened window.

Duplicate-week guard. Run at preflight and again before the first verifier spawn, against origin/main and against every unpromoted claude/** feature branch. No -weekly record carrying week: 2026-W33 exists on either surface. This run is the primary for the week.

ATT&CK pin. tools/attack_data.py --check reports: up to date, local v19.2 equals upstream latest v19.2. No update required and none performed.

Sub-agent research. Both W1 and W2 returned inside the 45-minute cap. Both reported running on Sonnet 5 from the model line in their own system prompts, consistent with the research definition's pin. No W3: intel/ carries no dated drop directories.

Three sub-agent findings were corrected against their own primaries before composition. Each is recorded because the correction, not the finding, is what shipped.

• W1 reported that the SpecterOps Entra ID replay weakness "persists". The cited write-up says the opposite: SpecterOps has not retested since June but "now considers the full Windows-to-Entra vulnerability chain broken" because Microsoft's July 2026 updates make event-log assertions unusable for replay, and Microsoft told the outlet it has also applied mitigations on the relay-assertion side. The entry was composed as a closure, not an open exposure, and its priority set accordingly.
• W1 reported "North America still the largest absolute total (514)". The 514 figure is genuine — it is the report's North America regional total — but the surrounding claim is not: Dragos records North America as the second-most impacted region, and the entry needed a country figure, which the report gives as the United States at 431 incidents, or 38%. The entry uses 431 / 38%. (This note itself was corrected after the first verification iteration, which caught the original wording asserting the 514 figure did not appear in the report at all.)
• W1's framing implied a European nexus for the Jewelbug watering hole. Symantec states the campaign reached more than 15 government webmail tenants "in a Middle Eastern country". The planned entry lens was re-scoped from geography to technique class, with the European nexus carried only by the Lazarus case, where Check Point states successful targeting in France and Germany.

A fourth, smaller correction: W2 wrote that ETSI submitted the draft standards to "all 41 European Economic Area member organisations"; the press release says "41 member organisations across Europe, including the national standardisation bodies of the European Economic Area", and the entry uses the source's phrasing.

A published vendor claim is reported as contradicted rather than resolved. Dragos's 2026-08-13 water-sector retrospective attributes the Minnesota MicroLogix intrusions to CVE-2021-22681. The catalogue date it gives is correct — CISA added that CVE on 2026-03-05 — but the CVE's own National Vulnerability Database record enumerates CompactLogix, ControlLogix, DriveLogix, Compact GuardLogix, GuardLogix and SoftLogix controllers reached through Studio 5000 Logix Designer or RSLogix 5000, and the string "MicroLogix" does not appear in it. Both records were fetched directly this run. The entry states the discrepancy from the primary records, carries verification: contradicted, does not assert what actually happened in Minnesota, and notes that Dragos has not been asked for comment and may hold information not in the published piece.

Entity-overlap confirmations (the gate asks for these explicitly). Twelve of the fifteen entries carry entity keys at all, and the gate flagged fourteen overlaps among them against earlier strategic or operational entries. Every one is a deliberate new-story decision, not a missed update_of, and the weekly dedup rule sanctions a weekly-long-running status entry as the alternative to an update note:

• actor:clop / campaign:clop-windchill-flexplm-extortion-2026 on the Windchill status entry, against the W31 and W32 looking-ahead entries — an outlook bullet listing a campaign as pending is not a treatment of it. No prior weekly carried a Windchill status entry, and this one has two deltas (first victim responses, first post-exploitation detail).
• actor:exfilsquad and incident:uk-dfe-exfilsquad-breach-2026-07 on the ExfilSquad status entry, against W31's incidents recap — that entry covered four actors' claims collectively and recorded a fabrication assessment; this is a dedicated status entry reporting that a different vendor validated the data at file level. The delta is the reversal.
• policy:eu-cyber-resilience-act, policy:netherlands-nis2-cyberbeveiligingswet-2026, policy:switzerland-isv-federal-isms-deadline-2026, incident:mydr-poland-ehr-breach-2026 and the Cl0p keys on the looking-ahead entry — the outlook is a watch list by construction and necessarily re-references entities treated elsewhere in the same week. It carries no new claim about any of them.
• actor:qilin and actor:akira on the Q2 reports entry, against the W31 incidents recap and two operational entries — the reports are a landscape treatment naming these actors as volume leaders in a quarterly count, which is not the same story as any incident they appear in.
• actor:qilin on the sector-patterns entry, against W31's incidents recap — Qilin appears there only as the claimant of the Retelit intrusion, which is one of seven cases in a pattern about processor and supplier position.
• actor:teampcp on the developer-credentials entry, against the Wiz H1 report entry of 2026-08-08 — the shared key is incidental; the new story is SOCRadar's re-attribution of the victim population to the Trivy compromise.

Borderline drops.

• borderline-drop: Recorded Future — malware crypting-service market survey (24 named providers, tiered pricing) — a survey of criminal service pricing whose defender-facing conclusion, prefer behavioural indicators to static signatures, does not change what an already-highly-skilled Tier 2/3 responder detects, hunts or hardens. Single-source, and the named-vendor and pricing detail is inventory rather than tradecraft.
• borderline-drop: NCSC UK — water-sector worked example added to the Secure Connectivity Principles for OT — voluntary guidance carrying no obligation and dating no compliance clock, which is this domain's own stated inclusion bar; the sub-agent flagged it borderline on the same grounds. A prior weekly already carried the four-nation OT isolation guidance in the same lane, and NCSC UK states the example is not intended to prescribe an architecture.
• borderline-drop: a separate incidents-recap entry pairing the ICO/ACRO reprimand with the UNC5537 guilty plea as retrospective accountability — two items is too thin a pattern to carry a section. ACRO is carried inside the sector-patterns entry, where its outsourced-patching-without-an-owner root cause is the strongest single instance of that entry's own lens. The UNC5537 guilty plea is a straight drop: it is a law-enforcement outcome on a 2024 campaign whose operational lesson — SaaS tenants reachable with valid credentials and no enforced multi-factor authentication — this store already carries, and it adds no in-window defender decision. weekly-incidents-recap is legitimately empty this week. (This note was corrected at the third verification iteration, which found it asserting a disposition the output did not implement.)

Tracked waves that produced no in-window delta and therefore ship nothing: the Joomla third-party extension disclosure wave (no in-window disclosure found), the npm and developer-ecosystem supply-chain wave including Shai-Hulud/CHAINDROP (no in-window delta beyond the Trivy re-attribution, which is carried in the developer-credentials research entry), and ShinyHunters (no in-window development). Recording these explicitly so their absence reads as a checked result rather than an unswept domain.

Single-source items and carve-outs.

• Single-source: weekly-w33-passkey-fourth-thread-documented-and-closed — one outlet's write-up, which quotes SpecterOps and carries Microsoft's response directly. The researcher's own talk page was located but no publication date could be established from its metadata, so it was not cited rather than being cited with an inferred date. This is the deliberate opposite of the prior weekly's handling, which dropped the thread entirely for want of any citable source.
• Single-source-national-cert: weekly-w33-dutch-nis2-in-force-no-transition — NCSC-NL is the first-party authority for the legal-effect date in its own jurisdiction; Dutch compliance press corroborates the date independently. The absence of a transition window is stated as an absence in the guidance, not as a positive ruling-out.

Contradiction: weekly-w33-water-plc-lockout-status — Dragos names CVE-2021-22681 as the Minnesota exploitation vector; the NVD record and the CISA catalogue entry for that CVE name a different Rockwell controller family. The entry reports both and resolves neither.

Reduced-confidence inclusions. The Cl0p Windchill status entry and the ExfilSquad status entry both carry confidence: medium. In the first, the 44 named listings are the actor's claims and neither responding organisation attributes its incident to the Windchill flaw; the possible link between an earlier masked batch and this campaign is one vendor's assessment from advertised data categories, and that vendor states leak-site data cannot establish an access route. In the second, the Power Pages access path is explicitly Fortra's leading theory and no named victim has confirmed it as its own entry point.

Citation-date and per-fact attribution discipline. Every inline citation date in the fifteen entries is either the publication date read from a source fetched by this run or the date recorded verbatim in a referenced operational entry's own source record; no date was taken from a discovery timestamp. Twenty primaries were fetched and written to work/2026-08-16T2315Z-weekly/raw/ this run, and every quoted passage was literal-substring-checked against the saved body. That check was applied to the first fourteen entries before they were written and to the fifteenth only after composition — which is how a spliced quotation reached it, caught at the second verification iteration and repaired; every quotation in that entry was then re-checked, and the third iteration re-checked them again against the live page.

Two primaries could not be re-fetched and both are recorded in fetch_failures above with the substitute path taken. Neither left a claim unsourced.

Watchlist. The organization profile configures no product and no supplier watchlist, so both sweeps are no-ops and no watchlist line is emitted.

Coverage gaps: prodaft (reader pool at HTTP 402, ninth consecutive run; direct fetch returns a JS-only shell); ccn-cert-es (unreachable on three probed paths, reader exhausted); ec-digital-strategy-newsroom (reader-pinned, not attempted beyond the pool probe); cisa-directives and eurojust and consilium-eu-cyber-sanctions (direct 403 plus exhausted reader — searches found no in-window publication for any of the three); edpb, ccb-belgium, cert-at (reachable, but no items published inside the window); sans-ics, searchlight-cyber, team-cymru, withsecure-labs, nozomi-networks, claroty-team82, shadowserver, citizen-lab, esentire, google-tag (swept, no in-window items).

The reader credit pool is exhausted and it is now shaping coverage. All seven keys returned HTTP 402 throughout. This run converted two of the resulting failures into permanent fixes rather than logging them again — ico-uk was pinned to the reader when the generic bridge reaches it directly, and fbi-cyber-alerts pointed at a path that no longer resolves when the IC3 public service announcement listing does. Both were re-probed after the change and both return content. ccn-cert-es and prodaft remain genuinely reader-dependent and are left flagged rather than muted: restoring reader credit is an operator item, and acknowledging these warnings is the quality audit's decision, not this run's.