2026-09-04T0410Z-intel

Verification & coverage notes

Verification loop closure: iteration 6 (the confirmation pass following iteration 5's CLEAN) returned NEEDS_FIXES with truth=1, editorial=1, no F1/F4, both findings remediated. Per Phase 5.7 decision rule 5 (NEEDS_FIXES with truth+editorial ≤ 2 and no F1/F4 → apply remediations, publish), the run stops here on an early exit rather than spawning a 7th iteration; verification_residual_count: 2 reflects the two remediated findings from the final iteration.

Declined verifier findings (iteration 3), with rebuttal:

• F16 (Chrome CVE-2026-85046 priority): the verifier flagged, at low confidence and explicitly as a weigh-it-yourself point, that a same-day vendor-confirmed exploited 0-day sits closer to this store's critical precedent than its high precedent. Declined: Google's own advisory withholds all technical/exploitation detail (no confirmed mass exploitation, no named campaign) and the entry's own text notes the bug is a sandbox-escape primitive requiring a second bug to reach full compromise; the critical bar requires either confirmed ITW exploitation right now at scale, imminent mass exploitation (pre-auth RCE on exposed enterprise edge + public PoC + verified scanning), or a campaign with confirmed ongoing impact; none of those is established here beyond Google's single-sentence "an exploit exists." Per the prompt's own guidance, "if unsure, it is high, not critical."
• F11 (CNIL entry sectors tagging): the verifier flagged, advisory-only, that sectors: [healthcare, public-sector] names public-sector though the victim (Hôpital privé de la Loire) is a private Ramsay Santé facility. Declined: sectors[] tags audience relevance, not victim classification; the entry is included specifically because its access-control lesson (VPN/MFA, care-team-scoped RBAC, access-velocity monitoring) is directly transferable to Swiss cantonal/regional hospitals, which are public institutions within this deployment's constituency; both tags reflect who should read this, not what kind of entity was breached.

Coverage window: Standard (gap_hours 24.0, window_hours 26, no catch-up/major-gap disclosure required).

KEV mechanical sweep (v4.8 duty): tools/kev_window_diff.py --window-hours 26 found 0 in-window CISA KEV additions, nothing to disposition this run.

Single-source items (standard, no carve-out): CVE-2026-85046 Chrome V8 (Google as vendor PSIRT for its own product); CVE-2026-20212 Cisco Nexus 9000 (Cisco PSIRT); HPE Fabric Composer/ArubaOS-CX bundle (HPE PSIRT via MITRE CNA records; HPE's own bulletin pages sit behind a support-portal login wall); ASCII-smuggling phishing campaign (Microsoft Threat Intelligence only, no independent corroboration); CL-CRI-1131/1163 (Unit 42 alone; the BREEZE COMET material cited alongside is a separate, independently-sourced finding from GTIG, not corroboration of Unit 42's two clusters).

Single-source, national-authority carve-out: CNIL fine (Hôpital privé de la Loire); CNIL is the disclosing regulator for its own jurisdiction's sanction decision. cnil.fr/www.cnil.fr added to tools/check_run.py's NATIONAL_CERT_HOSTS allowlist this run (a national data-protection authority disclosing its own regulatory action fits the same carve-out already extended to other non-CERT-named national authorities, e.g. BACS).

Single-source, victim's-own-disclosure carve-out: Coder Terraform-registry Cloudflare compromise; Coder is the affected organization disclosing its own incident via a formal GitHub Security Advisory.

Borderline drops:

• Germany BSI Zentralstelle constitutional-amendment reversal (the sole home-region/sector candidate this run), German domestic policy decision with no change to any Swiss defender obligation; the only nexus offered was an analytical structural-parallel to BACS-cantons cooperation not stated by any cited source. Doubt about constituency relevance resolves toward drop per PD-11 calibration.
• CVE-2026-67402 ConfigServer Security & Firewall Messenger v3 RCE (CVSS 9.2), two stacked preconditions (MESSENGERV3 disabled by default; the vulnerable code path only serves requests from an IP CSF has already blocked) narrow real-world exposure well below the pre-auth-RCE-on-exposed-service bar; no exploitation reported.

Coverage backlog (state/coverage_backlog.md): one new open row, Thomson Reuters C-Track court-system breach (a dozen US state appellate courts, US Virgin Islands, Ontario; no source names an access vector or attacker identity, so no incident entry can carry an evidence-bound ATT&CK mapping, same blocking condition as the standing Boston Scientific and IDScan.net rows). One row struck: CVE-2026-16242 (Red Hat OpenShift/HyperShift Konnectivity proxy), this run's re-check found Red Hat's own CVE JSON now lists 16 affected_release records with real RHSA fix advisories dated 2026-08-04 through 2026-08-26, contradicting the row's repeated "no fixed version" notes; no exploitation found, no longer time-critical. Six existing open rows re-checked with dated notes, all "no change" except IDScan.net (substantial new forensic reporting (DoD confirming exposure evaluation of senior officials' licenses) but still no named access vector, so the blocking condition is unchanged).

Coverage note (not a backlog row): Novocure (Baar, Switzerland-headquartered oncology medtech) ShinyHunters extortion/data-exposure disclosure; checked this run; every available source (SEC 8-K 2026-09-01, BleepingComputer/HIPAA Journal 2026-09-01/02, inside-it.ch 2026-09-02T13:24Z) falls outside this run's 26 h window with no fresher delta. Almost certainly a genuine miss by the 2026-09-03 fire (inside-it.ch was whole-host rate-limited that day), but PD-7's recency gate has no exemption for an item that was never verified-and-held by an earlier fire; only the coverage backlog's own verified-but-unpublished items are exempt. Logged here for operator awareness; not published, not backlogged.

Coverage gaps: ssd-disclosure (6th consecutive anti-bot block); cisa-advisories/cisa-directives (filter-shell-only content on the bridge transport; CISA KEV JSON feed unaffected and separately confirmed 0 in-window additions); inside-it-ch (article-body 429 persists for the Insel Gruppe/ServiceNow backlog row specifically, though the whole-host block has otherwise cleared).

Deep dive: none this run. The richest technical candidate (Unit 42's CL-CRI-1131/CL-CRI-1163 LatAm clusters) was considered and declined; category apt-campaign was used 2026-09-02 within the last 7 days (demotes one rank per the rotation rule) and no active exploitation is stated for the profiled Swiss-public-sector constituency specifically, so criterion 1 does not apply to override the demotion.