2026-09-07T0411Z-intel

Verification & coverage notes

A standard-cadence fire (gap_hours ≈ 15, window_hours = 24; no catch-up disclosure required). Four new entries published, one existing entry updated through its changelog.

New entries:

• 2026-09-07/cve-2026-86206-86207-86218-n-able-n-central-third-chain (priority: critical, this run's deep dive, category identity-infra), a third, unrelated N-able N-central auth-bypass/RCE chain in five weeks; CVE-2026-86218 confirmed exploited per N-able's own Active Incident dashboard and an on-record staff quote, though the vendor's own HF4 release notes carry a conflicting hedge (both statements carried, weighted per the entry's sourcing_note). References the existing 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited entry (distinct CVEs, same product).
• 2026-09-07/rapid7-ted-backdoor-curlrat-dprk-haproxy (priority: notable), coverage-backlog recovery (row surfaced by the 2026-09-06T1308Z audit, exempt from the recency gate per its own header): a DPRK-nexus actor compiles a custom C2 filter into a victim's own HAProxy source tree. Attribution carried as three only-partially-reconciled evidentiary threads (APT37/C2 infra, Lazarus/delivery model, Kimsuky/initial-access hypothesis) rather than a single confirmed cluster, per the source's own caveat.
• 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse (kind: annual-report, priority: notable), PD-9 periodic-report treatment; another coverage-backlog composition item (row surfaced 2026-09-06T1308Z-audit), composed narrowly around the genuinely actionable tool-stack-reuse-across-CVEs finding rather than the report's vanity-metric headline figures.
• 2026-09-07/chimeraz-aveyron-onrecrute-breach (priority: notable), French departmental (Aveyron) employment-platform breach, actor already tracked for the SDIS fire-and-rescue campaign; genuinely distinct victim type, so a new entry referencing the SDIS entry rather than an update. Access-vector claim single-sourced to one of two independent reviewers and explicitly contradicted by the second; both accounts held and attributed.

Update: 2026-08-30/berlin-landesnetz-rhysida-extortion-phishing-vector, type: update (floats). Full leak scope confirmed to include CI/defense-industrial records (heating/power plants, fuel depots, substations, prisons, Bundeswehr-related material); BSI public warning of elevated phishing and hack-and-leak risk ahead of Berlin's 20 September election; new BSI/BKA/BfV coordination unit and citizen-notification process; an independent expert's "gross negligence" accusation.

Dropped: German homemade-wire-slinging substation sabotage (S2), borderline-drop: physical/kinetic sabotage against German HV substations — no cyber intrusion, no digital access vector, no ATT&CK mapping possible; unlike the BACS-covered Poland grid sabotage (named cyber actor, Static Tundra, and attack infrastructure), no actor or cyber angle is stated here, so it cannot carry the evidence-bound techniques[] mapping check_run.py requires on an incident/threat entry. Out of scope for a cyber-CTI pipeline.

Coverage-backlog dispositions (all six re-checked rows: no change):

• Boston Scientific incident (2026-08-25), still no attacker attribution/vector/mechanism from any party.
• TheGentlemen/Ixa Systems SA listing, still only the original ransomware.live listing, no victim statement or Swiss press pickup.
• Krybit/UICC listing, still only leak-site trackers repeat the claim.
• Kairos/Ville de Libercourt listing, still no commune statement.
• NovoCure incident (2026-09-01), still no attacker attribution/vector/mechanism.
• VMSA-2026-0007/CVE-2026-59346, confirmed scoped to VMware Workstation/Fusion only (no ESXi row), no exploitation reports found; does not clear the recovery bar.

Backlog row struck: AA26-231A Siemens S7 joint-advisory re-read, S1 re-fetched the full PDF; prior updates already captured essentially all quotable substance; the only new detail (ICS-only MITRE ATT&CK for ICS ids T0834/T1694) is not mappable onto the Enterprise-only pinned dataset, so no changelog action follows. No further action needed.

Backlog row opened: ShinyHunters lists Medela AG (Baar, Zug) on its leak site (discovered <3h before this run), bare, uncorroborated claim whose own scope numbers read like a surface-scan result rather than confirmed data theft; fails PD-6 as it stands. Stated deadline 2026-09-08 makes a press pickup or statement plausible within 1-2 fires.

Backlog rows not addressed this run (no tasking): the Zurich District Court verdict row (correctly skipped, not due until 2026-09-10); the Keycloak-entry meta-fact correction (low priority); the Spring Ring Teams-vishing/NTLM-relay watch item; three of the four PD-11(d) research items held below the recovery bar (AWS root-password-spray, Exodus wallet installer, JSCeal deobfuscation); only the Ted backdoor/curlRAT portion of that bundled row was actioned this run.

Candidate sources: two research workers (S1, S4) each independently proposed a "new" candidate source (huntress-blog, cyberattaque-org); both were already tracked in sources/sources.json under existing ids (huntress, cyberattaque-org, the latter active since 2026-08-02); no duplicate added, so this run's one-new-candidate-source slot was not consumed.

Source lifecycle: frenchbreaches promoted candidate → active (promotion_due, 3 contributing runs). ssd-disclosure set to fetch_method: blocked after 10+ consecutive runs unreachable by every transport including the jina reader (confirmed independently by S1 and S3 this run); source_health.py's full 186-source sweep this run reported zero UNSOLVED sources.

Coverage gaps: cisa-directives (JS-shell listing shell persists, 6th+ consecutive occurrence, a recipe gap, not an anti-bot block; needs a structured-feed/API recipe on a future run); inside-it-ch (the Insel Gruppe/ServiceNow-migration backlog article now blocked even via the jina reader for the first time, worse than the prior subscriber-paywall condition, no corroborating outlet found on any transport).