2026-08-24T0110Z-weekly

Verification & coverage notes

Disposition: duplicate-week — stood down. The primary weekly published 2026-W34 and this fire withdrew its own output.

This is the scheduled backup fire for the weekly strategic run. At preflight (01:11 UTC) the duplicate-week guard was run in full, against origin/main and against every unpromoted claude/** branch: no record carrying week: 2026-W34 existed on either, origin/main stood at the previous day's intel run, and git ls-remote returned no feature branches at all. On that evidence the primary fire had produced nothing and the week was uncovered, so this run executed the full pipeline. The pre-verifier re-check at 02:24 UTC found runs/2026-08-23/2026-08-23T2311Z-weekly.md on origin/main carrying week: 2026-W34 and publish_status: ok. The primary had in fact started at 23:11 UTC and completed at 00:07 UTC; it was invisible to the preflight guard on both surfaces and became visible only afterwards. The stand-down rule applies as written: the composed strategic entries were deleted before commit, the registry additions were reverted, and entries_published is 0.

Two things follow, and the second is the one that matters.

First, the guard worked and the cost was bounded. The pre-verifier re-check exists precisely because the preflight guard reads a snapshot that a concurrently-running primary can invalidate, and it caught this before any verification iteration ran — so the run stood down at the cheapest available point rather than after the verification loop had run. What it could not do is prevent the duplicated research, because at preflight there was genuinely nothing to see on either surface. This is the fifth consecutive weekly cycle disrupted by the same race — the backup fires for 2026-W30, W31, W32, W33 and now W34 all stood down as duplicate-week (records 2026-07-27T0110Z, 2026-08-03T0110Z, 2026-08-10T0110Z, 2026-08-17T0110Z and this one), and the 2026-07-27 record describes the identical preflight-versus-promotion sequence. The pattern is now stable enough to name plainly for the operator: the backup fires 01:10 UTC against a primary that fires 23:11 UTC and finishes around 00:07 UTC, and the promotion of the primary's record to main is not reliably complete an hour later. Nothing in this run's control can close that gap — it is a scheduling and promotion-latency question, not a prompt question — so it is surfaced here rather than worked around.

Second, and the point of the stand-down rule: this fire's research was not wasted, and seven rows were written to the coverage backlog rather than left to die in this record — six verified residuals, plus one forward row for a publication that no window could reach. The 2026-08-03 stand-down listed nine verified, in-scope, unpublished items in its notes body, where nothing was able to consume them — and that is what state/coverage_backlog.md was created to fix. The mechanism then worked: once those items were seeded into the backlog, the intel run of 2026-08-10 drained it, and the backlog's own struck section records fourteen of the fifteen rows then open as published and one struck on relevance. Seven of the 2026-08-03 nine are traceable to published entries within a week, and the only one never published — an LLM threat-atlas reference document — was struck deliberately on relevance rather than lost. So the reason this run writes its residuals to the backlog rather than narrating them here is not that prose has failed in the abstract: it is that the queue is the only surface a later fire actually reads, and it has a demonstrated record of being drained. This run compared its own thirteen composed entries against the primary's fourteen and found the primary's coverage genuinely comprehensive on the week's main threads — the exploitation-status disagreement, the C2-rendezvous convergence, the AI-in-the-attacker's-workflow pattern, the Cl0p Windchill status, the Berlin Landesnetz situation, the vulnerability roll-up and the looking-ahead list are all covered there, in several cases better than here (the primary additionally carried a NetNTLMv1 cracking finding, an NCSC UK agentic-AI control baseline and an AI-tool-search access vector that this run did not surface at all). But five findings appear nowhere in the primary weekly, and a sixth only partially, and all six were fetched, deep-read and literal-substring-verified by this run:

• ShieldBreak mechanism and hunting package (LevelBlue SpiderLabs, 2026-08-19) — the strongest residual. The primary names ShieldBreak only in its vulnerability roll-up, as an unpatched flaw; the published mechanism of the chain and the entire detection package are absent. The flaw still has no vendor fix, so detection is the only available control.
• SynkLoader (Expel, 2026-08-20) — zero mentions in the primary. A Teams help-desk-impersonation loader whose tunnel plus harvested domain password defeats IP allow-listing.
• Rapid7 Labs Quarterly Threat Landscape Report Q2 2026 (2026-08-18) — zero mentions. A newly published periodic report, so the week's periodic-report coverage has a hole.
• Truffle Security leaked-AWS-key study (2026-08-19) — zero mentions. Concrete hardening lever, measured leak surfaces that current-working-tree scanning does not cover.
• SOCRadar FTP-banner dead-drop resolvers with the E4del and PINHOLE RATs (2026-08-21) — zero mentions. The primary's own C2-rendezvous entry does not include this material, so both the delivery channel and the two families are uncovered.
• SilkParasite dedicated coverage and registry entities (Bitdefender, 2026-08-19) — partial: named inside two of the primary's synthesis entries but with no dedicated entry, and none of the five newly documented malware families is registered.

Each is now a row in state/coverage_backlog.md carrying its primary URL, its event date, why it clears the gate, and the verification work already done — including the quote corrections, so a later fire does not have to redo them. The saved source bodies are committed under work/2026-08-24T0110Z-weekly/ for the same reason.

Verification work that survives the stand-down. The scoped deep read fetched six primaries and checked every candidate quote by literal substring match against the saved body. That pass rejected material that would otherwise have shipped: a claim attributed to the Expel article that Microsoft had earlier flagged Teams help-desk impersonation as increasingly common appears nowhere in that article and was dropped; a SOCRadar quote about "versatility and resilience" appears nowhere on that page and was replaced with the page's actual statement; two LevelBlue quotes carried a fabricated trailing period and a substituted function list; two Truffle Security quotes carried bracketed insertions; and two Rapid7 quotes were truncated with invented closing punctuation. Separately, a spot-check of the Tagesspiegel Berlin report caught a research quote that had been spliced from two separate quoted fragments with narration between them — the exact defect the literal check exists for. None of these reached an entry. The corrections are recorded in the backlog rows so the next fire inherits them.

One item for the weekly quality audit, not fixed here. The intel-run master prompt's description of the coverage-backlog mechanism still states that none of the 2026-08-03 stand-down's nine residual items was ever published. That was true when it was written on 2026-08-09 and is no longer true — the backlog was seeded and drained, and the store now carries entries for seven of the nine. This run repeated the outdated claim in an earlier draft of these notes and a verification pass caught it against origin/main. Correcting the prompt itself requires a banner bump, a changelog entry and the three master prompts moving in lockstep, which is not proportionate work for a fire that publishes nothing; it is flagged here so the audit can make the edit properly.

Coverage gaps. cisa-directives and cisa-advisories were unreachable: cisa.gov hard-403s every direct user agent and routes only through the reader, whose entire key pool is at HTTP 402. This is a standing operator item, not a source fault, and the KEV JSON feed is a separate sub-path that was unaffected, so the week's catalogue additions were still captured. ahnlab-asec and ibm-xforce returned client-rendered shells with no drillable listing; fox-it-blog 403'd on a source whose documented cadence is roughly three posts in eighteen months. proofpoint's listing returned only items dated outside the window, and claroty-team82 returned titles with no publication dates, so in-window status could not be established for either — neither is a transport failure, so neither appears in fetch_failures, but neither was genuinely swept. ccn-cert-es, swisspost-cybersecurity and openssf-policy were not attempted, deprioritised behind the Berlin deep read and the policy sweep.

Policy sweep result: nothing in window. The full standing watch — the Cyber Resilience Act, NIS2 transposition across Germany, Ireland, Belgium, Italy, Greece, Portugal and Austria, DORA, Swiss federal, FINMA and BAKOM, EU and US sanctions, Europol, and the Council of Europe cybercrime convention — was swept and produced no development dated inside the window. One live thread was identified and could not be read: Switzerland's federal cyber authority has announced a briefing on its half-year 2026 threat report for 24 August, 09:00 to 11:00 CEST, with the report published and the embargo lifting at 11:00 CEST — later the same morning, and after this run's research window closed. It is the most directly relevant national publication of the coming days for this constituency, and the next intel fire at roughly 04:10 UTC runs before the 09:00 UTC embargo lift — so it cannot simply be left to that fire. It is written to the coverage backlog with its announcement URL and date, which is the only mechanism that survives a recency window.

Campaign status re-checks. Nine tracked campaigns and actors were re-checked for an in-window delta — Cl0p/Windchill, Head Mare, the Metabase downstream incident, ExfilSquad, the Minnesota water-utility campaign, Payload, Akira, Qilin and Panzer. Eight produced no delta beyond what the week's operational entries already carry. The ninth, Payload, produced a thin one: the leak-site listing's own title names the compromised Swiss provider, but that name propagates only through automated leak-site-mirror blogs restating the criminals' listing verbatim, none of which is independent confirmation, and neither the named company nor HWZ has confirmed. It was deliberately not elevated.

Borderline drops (recorded so a wrong call is recoverable; none was dropped for want of space, and none is a backlog candidate because none clears the gate):

• borderline-drop: Unit 42 collaboration-platform telemetry (2026-08-20) — headline figures are a year-on-year multiple and a share-of-alerts percentage, which this pipeline does not publish as findings; the underlying technique class was already covered operationally this week.
• borderline-drop: MoYu Group automotive head-unit malware (Kaspersky, 2026-08-21) — genuinely novel as the first documented infection chain built for a car head unit, but aftermarket consumer head units are not this constituency's estate and no responder here changes a decision in the next seven days.
• borderline-drop: ToxicPanda 2.0 Android banking trojan (Zimperium, 2026-08-19) — consumer banking malware targeting bank customers; the wireless-ADB pairing abuse is novel but sits in the Mobile ATT&CK matrix, outside this pipeline's pinned Enterprise dataset.
• borderline-drop: SickKids second breach (Canada, 2026-08-20) — out-of-nexus healthcare incident with no named vendor or vector; clears none of the four out-of-nexus limbs.
• borderline-drop: LockBit claim against U.S. Bancorp (2026-08-21) — a leak-site claim the named victim disputes, single-source, no sample provided.
• borderline-drop: Zurich District Court trial and the DOJ Mabna Institute superseding indictment, as a paired judicial-outcome synthesis — both already published operationally with their Swiss victim nexus stated; the candidate lens (attribution arrives years later while the charged tradecraft stays current) changes no decision in the next seven days. The primary weekly did carry this pairing, as 2026-08-23/weekly-w34-two-charge-sheets-named-switzerland.
• borderline-drop: Unit 42 software-development-lifecycle supply-chain taxonomy (2026-08-21) — repackages already-covered incidents under a framework; the mitigations list is standing good practice.

Maintenance completed this run (kept, because none of it is entry content and all of it survives the stand-down):

• ATT&CK pin checked: local v19.2 equals upstream latest v19.2, no update required. The check also caught two revoked ids during composition — T1562.009 (Safe Mode Boot, revoked by T1688) and T1574.002 (DLL Side-Loading, revoked by T1574.001) — which is worth noting because both are still in wide external use and a future fire copying them from a source will hit the same gate.
• tools/source_health.py — same defect found independently, main's fix adopted. This run's sweep flagged sec-disclosures-edgar as needs-demote, an unsolved repair order. The recipe is not broken: it returned a structurally valid envelope reporting that no company filed an 8-K Item 1.05 in the probe window. The classifier judged bridge health purely on stdout byte length, so a working query recipe answering "nothing matched" was indistinguishable from a dead one — and demoting a source for having no news is exactly the content-versus-transport confusion the demotion rule forbids. A fix was written and tested here against nine cases, and the sweep then ended with an empty unsolved list. On checking the incoming changes before merging, the primary weekly of the same week turns out to have diagnosed the identical defect on the identical source and shipped an equivalent fix to the same function. Two independent runs converging on one root cause is a useful signal about the defect being real, but two competing implementations in one function is not worth shipping, so this run discarded its own and took the published one. The maintenance outcome stands either way: the unsolved list is empty across 190 sources.

• sources/sources.json: huntress carried fetch_method: rss with a null rss_url, so its documented transport had no URL and the source could not be swept by feed; the feed was located and verified, and that repair is this run's own. trendmicro-research had the same shape defect and this run could not locate a working feed — the primary weekly did, and its record for that source (carrying the feedburner URL) was taken in preference to this run's weaker note. One new candidate added, the run's single permitted addition: expel, the sole primary for the SynkLoader family and carried by no other source in the list.