2026-08-29T0409Z-intel

Verification & coverage notes

Coverage window: standard (13.16 hours since the previous run, 2026-08-28T1500Z-audit; that record's own publish outcome is still recorded as pending on main, with its own explanatory note that it was an operator-interactive session with no automated publish step — not an operational failure, so no action taken here beyond noting it).

Published this run (7 new, 1 update, 1 deep dive, 1 critical):

• 2026-08-29/papercut-ng-mf-tapestry-request-confusion-preauth-rce (critical, deep dive) — PaperCut NG/MF pre-auth RCE chain, actively exploited before a patch existed.
• 2026-08-29/servicenow-ai-platform-four-unauth-cvss10-flaws (high) — three unauthenticated CVSS4.0 10.0 flaws plus a related sandbox escape.
• 2026-08-29/exchange-mrsproxy-auth-bypass-cve-2026-62911-poc (high) — public exploit code for an Exchange MRSProxy relay flaw, MSRC rating unrevised.
• 2026-08-29/swiss-cantons-eautoindex-vehicle-registry-data-harvesting (high) — six Swiss cantons, rate-limit bypass on public vehicle-registry lookups, extortion attempts.
• 2026-08-29/eu-cra-reporting-obligation-ncsc-fi-checklist (notable) — NCSC-FI's operational CRA reporting-clock checklist ahead of the 11 September go-live.
• 2026-08-29/redc2-npm-supply-chain-redshell-linux-implant (notable) — closes a coverage-backlog item open since 2026-08-22; TrendAI's vendor primary replaces the aggregator-only sourcing that blocked it.
• 2026-08-29/german-carriers-imei-leak-call-setup-signaling (high) — BR/heise investigation, GSMA-confirmed device-fingerprinting leak in call setup.
• Update on 2026-08-06/endlessdoors-zbtlink-router-factory-shipped-root-backdoor — two new pre-installed implants (DARKLANTERN, SPEAKINGSTONE), a domestic-China surveillance-deployment finding via sinkhole, and a German OEM-rebrand extension.

Borderline drops:

• borderline-drop: Minea (Swiss ad-intelligence platform) 533K-profile breach claim — single Admiralty-C source (cyberattaque.org) reporting an unverified hacker claim; the outlet's own reporting doubts the data's currency (records stop in August 2024 despite a claimed August 2026 compromise), no victim confirmation, and the affected business (ad-intelligence/dropshipping SaaS) has no nexus to the profiled constituency's sectors. Dropped for insufficient verification, not held at low priority.
• borderline-drop: Qare (French telemedicine) hacker disclosure claiming exposed patient photographs including children — single Admiralty-C source, no victim statement, no independent corroboration despite a search attempt. Sensitive subject matter argues for more caution, not less, absent a second source.
• borderline-drop: Boston Scientific cybersecurity incident (global medtech manufacturer, three Irish/EU plants idled) — genuinely clears the relevance bar on EU/healthcare nexus alone, but no source (including a named commentator quoted by Industrial Cyber) states any attacker behaviour, access vector, or mechanism; an incident entry needs a genuine, evidence-supported ATT&CK mapping, and none exists yet to compose one honestly. Logged in the coverage backlog for publication the moment a vector is disclosed — the same disposition already applied to the Berlin Landesnetz compromise.

Contradiction: 2026-08-29/servicenow-ai-platform-four-unauth-cvss10-flaws — ServiceNow's own advisory classifies CVE-2026-18886 as a code-injection flaw in its AI Platform; The Hacker News, reporting on the same advisory, classifies it as an improper-access-control flaw in a system-configuration image-upload processor. A second, related disagreement on the same entry: ServiceNow's own prose describes CVE-2026-6876 as reachable by an "unauthenticated user," while the CVSS4.0 vector ServiceNow itself assigned to that CVE (per The Hacker News's reporting) specifies PR:L — low privileges required. The entry carries all of these readings, attributed to their respective source, with the vendor's own classification treated as authoritative for the frontmatter cves[] records.

Single-source items: 2026-08-29/redc2-npm-supply-chain-redshell-linux-implant — TrendAI Research is the sole discloser; no independent lab has corroborated it. Update on 2026-08-06/endlessdoors-... — VulnCheck remains the sole discloser for both the original ENDLESSDOORS finding and this run's DARKLANTERN/SPEAKINGSTONE follow-up; heise's coverage is journalism relaying VulnCheck's research, not independent technical corroboration.

Verification loop: 8 iterations, every one independently spawned and cold-reading fresh from disk. Iterations 1-8 all returned NEEDS_FIXES; every truth- and editorial-class finding across all eight was remediated (a running per-fact citation-attribution defect was the dominant pattern, plus one classification recalibration each on the ServiceNow and PaperCut entries, three technique-mapping corrections, and one hallucinated-fact removal each on the ENDLESSDOORS update, the ServiceNow entry, and the Swiss-cantons entry). The loop reached its 8-iteration cap without a confirmed CLEAN; publishing anyway is the documented fail-open (never a blocking condition). Three low-confidence advisory items from iteration 8 remain as residuals, none rising to a confirmed defect: an ambiguous ENISA citation date on the EU-CRA entry, an unverifiable BSI CERT-Bund corroborating-source page on the ServiceNow entry not tied to any specific claim, and a stretch-case missing ATT&CK mapping for SPEAKINGSTONE's PPPoE-credential exfiltration on the ENDLESSDOORS update. verification_residual_count: 1 reflects iteration 8's final truth+editorial count (1+0).

Coverage-backlog re-check: all five previously-open rows re-gated on today's facts. Struck: the RedC2 npm row (published). Stayed open, untouched or lightly re-checked at low cost: Zurich District Court verdict (not due until 2026-09-10), Berlin Landesnetz (re-confirmed no vector named by any authority, seventh consecutive fire blocked on the same ground), Siemens S7 joint-advisory re-read (low priority, not re-probed), CVE-2026-16242 OpenShift/HyperShift (still out of window), the Keycloak Red Hat product-state correction (low priority, meta-fact only). One row added: Boston Scientific (see borderline-drops above).

Watchlist: no product or supplier watchlist configured for this deployment (config/org-profile.yaml); the product and supplier sweeps were no-ops as a result; the sector/region lens was applied in their place.

Coverage gaps: searchlight-cyber (Cookiebot consent wall defeats every transport); team-cymru, sans-ics (both resolve through an ad-tracking redirect returning only a 1×1 pixel); paradigm-shift-research (client-side SPA stub, no server-rendered content); inside-it.ch's "Insel Gruppe verschiebt Wechsel zu ServiceNow" article (403 on every transport — flagged as a lead, not corroborated, plausibly but not confirmably related to the ServiceNow CVEs published the same day); cisa-advisories, cisa-directives (reachable, but no in-window item on either listing); cert-pl (newest item just outside the 24h window).

Essential-coverage: no misses — all essential-tier sources were attempted and returned content (even where that content held no in-window item).