2026-09-05T0409Z-intel

Verification & coverage notes

Verification loop: fail-open at the iteration-8 cap. All 8 iterations returned NEEDS_FIXES; the run never reached even a single CLEAN verdict, let alone the required two consecutive. Per the master prompt's non-negotiable cap rule, iteration 8 is the hard ceiling and the run publishes now regardless of verdict. Every finding from every iteration was remediated in the same cycle it was raised (see verification.iterations[] above for the full per-iteration detail) except two knowingly-declined items, both documented above with rebuttal: the pre-existing actor:uat-8616 entity-link mismatch on the CVE-2026-46300 entry (predates this run, left for the audit), and the Thomson Reuters entry's PD-11 ground-(a) relevance argument, which three independent cold reads (iterations 5, 6, 8) each flagged as a close call without ever asserting it invalid, a judgment call made once (iteration 5) and left standing through repeated independent re-testing that did not overturn it. verification_residual_count: 5 reflects iteration 8's own truth+editorial total (3+2), all fixed except the two declined items above; the count is intentionally not zeroed, since a NEEDS_FIXES final iteration at the cap is a fail-open publish, not a clean bill of health.

Runaway-duration warning (duration_seconds exceeds the 3 h threshold): this run's own extended verification loop is the cause, not a stall. Each of 7 (going on 8) cold-reader iterations spawned fresh, found genuine new defects (source-date drift, citation-source mismatches, a mis-stated authentication-guard history, missing EPSS values, changelog fields[] gaps), and each round was remediated and re-verified before the next spawn per the non-negotiable verification-loop rule (a first CLEAN requires an independent cold confirmation pass; this run never reached even one CLEAN). No sub-agent stalled or was abandoned; total elapsed time is the sum of 7 full iteration cycles (research + compose + verify + remediate), not idle waiting. This is depth-over-speed working as designed, not an operational failure, see the iteration-by-iteration findings above for what each pass caught.

Coverage window: Standard (gap_hours 24.0, window_hours 26, no catch-up/major-gap disclosure required).

KEV mechanical sweep (v4.8 duty): tools/kev_window_diff.py --window-hours 26 found 1 in-window CISA KEV addition (CVE-2026-85046, Google Chromium V8), already covered by the existing 2026-09-04 entry. No disposition needed.

Declined verifier findings (iterations 4-6), with rebuttal:

• F11 (run-record sub_agents telemetry phrasing, iteration 4): declined as out of scope, those fields structurally describe pipeline mechanics (the block's own keys are S1/S2/S3/S4), unlike the reader/operator-facing coverage-notes prose the style rule targets, where the parallel finding on this same iteration was accepted and fixed.
• F11 (duplicate RHSB-2026-003 URL under two dates on the Dirty Frag entry, iteration 4): declined, 2026-05-09 and 2026-07-03 are independently correct snapshots of the same bulletin as it evolved to add CVE-2026-46300; consolidating would lose that provenance, not fix an error.
• F9 (Manchester Airports Group, "withheld" vs. "190,849 future bookings" tension, iteration 5): declined; both framings are already presented as the threat actor's own unverified claims; the entry asserts neither as confirmed, so no further hedging adds reader value.
• F8 (Thomson Reuters; Montana/Minnesota denying court documents were exposed): iteration 4 declined this pending re-verification (wrong saved source checked); iteration 5 re-confirmed the fact directly in the entry's own cited Hacker News capture and added it. No longer outstanding.
• F7 (Thomson Reuters, breach-gate ground (a) relevance, iterations 5-6): two independent cold reads (iteration 5, iteration 6) each flagged this as a close call without asserting the argument invalid, iteration 6 explicitly noted "the vendor's global profile, the sealed-records category and the extensive multi-outlet coverage are real countervailing factors the AMF entry lacked." The entry is kept: unlike AMF's single-country, single-organization, commodity-SQLi breach, this compromise spans two sovereign jurisdictions and reaches sealed judicial records, which is the scale argument PD-11 ground (a) contemplates. Two independent iterations raising the same "close but not clearly wrong" concern, rather than converging on "clearly fails" (the pattern that dropped AMF), is read as corroborating the judgment call rather than overturning it.
• F11 (CVE-2026-46300 entry, actor:uat-8616 entity-link mismatch, iteration 6): declined as pre-existing, the link traces to an unrelated CVE in the entry's legacy v2-migration "CVE Summary Table," not to anything this run touched; left for the audit.

Dedup catches this run: the "Dirty Frag/Fragnesia" Linux kernel LPE candidate and the Toy Ghouls MQTT/Matrix-backdoor candidate both initially read as new findings but matched covered ground, the former via the store-wide CVE index (state/cves_seen.json; CVE-2026-43284/43500/46300 are all covered by entries from 2026-05-09 and 2026-05-15, outside the 14-day prior-coverage window and therefore invisible to the in-context dedup read), the latter via an entity-key match (actor:toy-ghouls, malware:genielocker) to a 2026-07-31 entry likewise outside the 14-day window and carrying no CVEs to trip the store-wide index at all. Both became changelog records instead of new entries; the Toy Ghouls case in particular is a reminder that CVE-less findings on an older, previously-covered actor/malware pairing are not caught by any mechanical check, only a direct grep of entries/ for the entity name surfaced it.

Single-source items (standard, no carve-out): GeoNetwork RCE chain (GeoNetwork's own GHSA advisories + independent Ethiack research, treated as multi-source, credibility 2, given both are the primary discovery/fix event rather than independent secondary corroboration); Thomson Reuters C-Track breach (multi-source: C-Track/West Publishing's own notice, Ontario's Chief Justices' joint statement, plus three independent news outlets).

Dropped by verification (iteration 4): AMF France SQL-injection/plaintext-password breach, a French national mayors'-association breach with no home-region nexus. Iterations 1 and 3 both attempted to ground its inclusion in a primary-sector or "shared target profile" reading of PD-11(c); iteration 4's cold read tested that argument directly against the four out-of-nexus breach-gate grounds (PD-11) and found none of them clears: no global-scale significance, no new or materially evolved TTP (a UNION-based SQL injection is decades-old, commodity tradecraft), no same-actor read onto the profiled constituency (the actor "Alduin" is a single-incident handle with no established track record), and no imminent shared threat. Three independent cold passes converging on the same substantive gap, with each attempted rewording addressing only the phrasing and not the underlying fact pattern, is a stronger signal than any single verifier's assessment; the entry is dropped rather than defended a fourth time. The registered entities actor:alduin and incident:amf-france-sql-injection-breach-2026-09 were removed from entities/registry.yaml as orphaned. No CVEs were associated with this entry, so state/cves_seen.json is unaffected.

Borderline drops:

• VMware Workstation & Fusion guest-to-host escape (CVE-2026-59346/CVE-2026-59347), a genuine guest-to-host VM escape (CVSS 9.3/8.1) but requires local administrative privileges already inside the guest VM, no confirmed exploitation, desktop-virtualization deployment context (not the enterprise ESX/vCenter estate already covered by the July VMSA-2026-0006 bulletin at a materially higher bar, pre-auth, network-reachable, no workaround). Does not clear PD-11(b)'s beyond-regular-patch-cycle bar on its own mechanics; a routine vendor patch-cycle item.

Coverage backlog (state/coverage_backlog.md): one row struck, Thomson Reuters C-Track court-records breach, published this run as 2026-09-05/thomson-reuters-ctrack-court-records-breach (the story was reached via a different transport this run: The Record, Tech Times, The Hacker News, plus the C-Track/West Publishing notice and Ontario's Chief Justices' statement directly). Five further open rows re-checked with dated notes, all "no change" (Boston Scientific; TheGentlemen/Ixa Systems SA; Krybit/UICC; IDScan.net, substantial forensic detail accumulated over the past two days but still no named access vector; Kairos/Ville de Libercourt). Two low-priority rows (Siemens S7 joint-advisory re-read; the Keycloak VEX-revision-date meta-fact) were not re-probed this run per their own carry-forward notes; the Zurich District Court verdict row is not due until 2026-09-10.

Coverage gaps: ssd-disclosure (7th consecutive anti-bot block, both direct and jina); cisa-advisories (unfiltered facet page / 403 / jina-key timeout, CISA KEV JSON feed unaffected and separately confirmed via tools/kev_window_diff.py).

Pre-existing warning not fixed this run: check_run.py flags two evidence[] records on entries/2026-05-09/cve-2026-43284-cve-2026-43500-linux-dirty-frag-deterministic.md (publisher ctipilot v2 brief (migrated)) as unbound to any sources[].publisher. Both predate this run's edit and are narrative remnants of the original v2-to-v3 migration rather than verbatim page quotes; relabelling the publisher would not make them genuine verbatim evidence, so this is left for the audit to resolve properly (rewrite as real verbatim excerpts from the cited Wiz/Microsoft posts, or drop the evidence[] records if no clean quote is recoverable) rather than papered over here.

Deep dive: none this run. GeoNetwork's chain is well-documented and actionable but its category (web-app-rce) was used within the last 7 days (2026-08-29, PaperCut) and no confirmed in-the-wild exploitation independently overrides the rotation demotion (the EUVD exploited flag is disputed and unconfirmed by any other source). No other candidate approached the deep-dive bar this run.