2026-08-28T0409Z-intel

Verification & coverage notes

Wall-clock watchdog (anti-crash guard #10). This run's Phase 5.7 verification loop found genuine, substantive defects on four of its five iterations (1, 2, 4, 5 all NEEDS_FIXES; only iteration 3 returned CLEAN, and it was not confirmed by iteration 4's cold re-read) — every remediation was independently re-verified against a live re-fetch of the cited source before being recorded, so the loop's cost bought real correctness, not busywork. By the end of iteration 5 the run had crossed the ~3 h wall-clock mark (main.started_at 04:09:50Z; iteration 5 ended 07:05:58Z, ~2h56m elapsed at that point, and fix/re-verification work pushed the clock past 3h before the next spawn). Per the watchdog rule, iteration 6 is being run as the final iteration regardless of outcome: a CLEAN publishes on verification.confirmation_waived (this note) rather than requiring a second confirming CLEAN; a NEEDS_FIXES with truth+editorial ≤2 and no F1/F4 publishes on the standing early-exit rule with residuals documented; anything worse is landed with residuals rather than extending the loop further. duration_seconds genuinely exceeds the 3h/10800s runaway threshold as a result — that is the watchdog functioning as designed on a run whose entry volume and multi-day catch-up window made an unusually long verification tail likely from the outset, not a stall.

Coverage window: catch-up of 91 h (previous run 2026-08-24T0906Z-intel, which stood down on a stale-clock detection with zero substantive research). The prior genuinely substantive fire was 2026-08-24T0410Z-intel; the gap therefore spans nearly four days, most of it already covered by the 2026-08-23/24 audit and weekly runs whose entries load into the 14-day dedup window. This run's job was the new signal since the last fire, worked exploitation-first per the catch-up-class table, plus systematic clearance of the coverage backlog accumulated across that gap (state/coverage_backlog.md carried 8 open rows from the 2026-08-23T1311Z audit and 12 from the 2026-08-24T0902Z audit at the start of this run).

Backlog clearance. 24 of the 26 open coverage-backlog rows at the start of this run were resolved: 20 published (14 as new entries, plus the two-part Joomla wave and Copeland/Danfoss OT pair counted individually — see the full breakdown in the backlog file itself), 3 published as correction changelog records against existing entries, 1 struck as already-covered with no material delta (DGCCRF Bloctel), 1 struck as stale (1Password FLAWED study), and 1 struck on relevance after re-verification reversed the earlier framing (TheHatman — Unit 42 explicitly declines to verify the actor's claimed vector and the named victim TCS denies the breach). One row (GreenPlasma) was newly re-gated and struck this run as not clearing the bar (local-only LPE, PoC already deleted, no exploitation). 5 rows remain open and are carried forward unchanged or with a brief re-check note: the Zurich trial verdict (not due until 2026-09-10), the Siemens S7 PDF residual quotes (low priority), the npm RedC2 aggregator-only gap, the out-of-window OpenShift CVE, and the Keycloak VEX meta-correction (not defender-facing on its own).

Berlin Landesnetz — sixth consecutive fire with no named vector. S2's re-check found two genuine authority-sourced deltas (the intrusion is now dated to 7 August rather than 14 August, and the Senate's own data-exposure assessment has widened to being unable to rule out personal data) plus an unconfirmed press ransom-demand claim, all folded into an update record on the existing strategic-synthesis entry rather than a new operational entry — no authority has yet named an access vector, product or CVE, so an incident entry with an evidence-bound technique mapping still cannot be composed without fabrication.

Two additional corrections found and fixed outside the tasked backlog. While reviewing entries for the tasked corrections, a third machine-surface defect was found in 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule: the cves[] record for CVE-2025-49113 carried auth: pre-auth/vector: zero-click, inverting the flaw's actual credential-gated access path — a defect the entry's own body text had already correctly described. Corrected in the same pattern as the two backlog-tasked corrections (Gemini CLI CVSS/vector; SAP CVE-2026-44772 remedy).

Volume note. 36 new entries and 7 updated entries is well above a typical single-fire count. This reflects the mechanics of the window, not a relaxed gate: a 91-hour gap concentrated three audits' worth of deferred-on-wall-clock backlog items, plus a mandatory outage-backfill sweep (S3) that is specifically designed to catch vendor research-blog publications a normal recency-gated sweep misses across a multi-day gap. Every item was still put to the full PD-11 relevance/actionability gate individually; items that did not clear it (GreenPlasma, TheHatman, the 1Password study) were dropped or struck regardless of how long they had sat in the backlog.

Single-assessor caveats (PD-5). CVE-2026-59310's newly-reported China-nexus attribution and Babuk-ransomware finding — both surfaced by this run's research — duplicate CVE coverage already carried by 2026-07-30/vmware-vmsa-2026-0006-vcenter-auth-bypass-vmxnet3-escape (PD-8 dedup), so they were folded into a new update changelog record on that existing entry rather than published as a standalone entry. The record explicitly flags that both findings trace to one incident-response firm's (QUIRSO) investigation of one incident, not to cross-corroborated intelligence, despite two press outlets reporting it; the entry's overall A/1 classification is left untouched since it reflects the multi-CERT-corroborated vulnerability and initial-exploitation facts, not these two single-assessor additions. 2026-08-28/suez-eau-france-supplier-breach is published under the single-source-victim carve-out — three independent trackers each state they obtained SUEZ's own customer notification letter directly, but none is itself an Admiralty B+ outlet, so credibility is held at 2.

Shared-entity new-entry decisions confirmed deliberate. 2026-08-28/teampcp-afp-fbi-disruption-shai-hulud-arrests shares actor:teampcp with 2026-08-15/trivy-not-litellm-behind-2500-org-credential-collection and 2026-08-16/weekly-w33-developer-credential-audits-wrong-artefact, but those two entries are SOCRadar's technical re-scoping of the LiteLLM credential-collection timeline, not the actor's legal status — a law-enforcement disruption and criminal charges are a distinct event class that does not belong in either entry's changelog, so a new entry is correct. 2026-08-28/kudelski-bismarck-dprk-it-worker-gambling-fakecalls-overlap shares actor:purpledelta with 2026-08-19/purpledelta-dprk-it-worker-facilitator-rmm-detection and 2026-08-23/weekly-w34-ai-bought-throughput-not-capability, but Kudelski's finding is about a separately-designated actor ("Bismarck") whose infrastructure overlaps PurpleDelta's, not new information about PurpleDelta's own fraudulent-hiring operation — the entity link is an overlap finding, not a delta on the existing entry's subject, so a new entry is correct here too.

Watchlist: products checked=0, hits=0; suppliers checked=0, hits=0 — no product or supplier watchlists are configured on this deployment; the sweep is a no-op per policy.

Essential-coverage: no essential-tier source miss this run beyond the standing rotation-priority gaps already logged (cisa-advisories/cisa-directives 403, ssd-disclosure and fox-it-blog/ibm-xforce reader-quota/JS-shell — all pre-existing, unresolved by this run's transport ladder, covered_anyway via alternate primaries where the item was published).

Coverage gaps: cisa-advisories (403, recovered via CSAF GitHub mirror); ssd-disclosure (reader-quota, all 7 keys exhausted — covered via two independent secondaries for the Unisoc item); fox-it-blog, ibm-xforce (JS-shell/no structured feed); community.ui.com (JS SPA, recovered via NCSC-CH's own transcription); kb.cert.org (corrupted binary body on the Kaltura CERT/CC note, one quote carried at reduced confidence via prior WebFetch summarization).