2026-09-09T1726Z-intel

Verification & coverage notes

Run provenance. This fire completed the stood-down 2026-09-09T0410Z-intel fire, whose S1–S4 sub-agents (Sonnet 5, ~04:13–04:23Z) ran Phase 1 research but never reached Phase 6; no run record for it exists on origin/main (newest published at session start was 2026-09-08T0411Z-intel). The operator handed this fire the four sub-agent returns; they are persisted verbatim-derived in work/2026-09-09T1726Z-intel/findings.S{1..4}.yaml with a PROVENANCE.md note, and the sub_agents blocks above carry the originating fire's models and timestamps. This fire re-ran the mechanical KEV sweep for its own 39 h window (identical two uncovered Windows zero-days), dedup'd against the 14-day prior-coverage index, deep-read every WILL-PUBLISH primary itself, and put every candidate through the mechanical gate before publishing (the Phase 5.7 verifier was attempted four times but blocked by the classifier; see the verifier note above). No Phase 1 sub-agents were re-spawned: the 04:10Z research is ~13 h old, the KEV sweep confirmed no newer strong signal, and the dominant items (Sept 8 Patch Tuesday, WeWorm, NovoCure attribution) were fully captured. This fire ran on Claude Opus 4.8 (the operator switched the session model mid-run); the intel routine's usual model is Sonnet 5.

Verifier blocked, published on a documented fail-open (no independent cold read this fire). The Phase 5.7 cti-verification spawn was terminated by the content-safety classifier ([cyber]) on all four attempts, including a fourth message stripped of offensive vocabulary with scope handed via a manifest file. The trip is on the pinned Sonnet verifier definition against this run's content, not the message framing, so the retry ladder is exhausted (single-verifier era, no other-model fallback). Per Phase 5.7's fail-open and guard #1, the run publishes anyway; the frontmatter verification.confirmation_waived + spawn_attempts carry the full record with request IDs. The main agent's own Phase 4 work substitutes for the truth gate but not the independent editorial cold read: every WILL-PUBLISH primary was re-fetched and all eight quotes literal-substring-verified against the saved bodies, both CVEs verified against MSRC + CISA KEV, and the mechanical gate is clean apart from the empty verifier block. Operator: a follow-up fire or the next quality audit should give these two entries an independent verification pass.

Published (2 new).

• 2026-09-09/windows-september-2026-two-exploited-lpe-zero-days-kev (vulnerability, high), the two and only two exploited CVEs in Microsoft's September 2026 Patch Tuesday, both local privilege-escalation zero-days now on CISA KEV: CVE-2026-81963 (Windows Update Stack link-following, newest builds) and CVE-2026-85880 (Windows ALPC heap overflow / AppContainer sandbox escape, legacy line). Both raise a low-privilege foothold to SYSTEM. This is the disposition for both NOT COVERED rows in the Phase 0 KEV sweep. Calibrated high, not critical: Microsoft rates both "Important", both are post-foothold LPE (not pre-auth RCE / mass exploitation), and ZDI notes the breadth of exploitation is unknown, TL;DR-worthy across every Windows estate, but not the stop-everything-this-hour critical bar. One combined entry per the same-product, same-patch-cycle, unified-defender-action story (both cves[] carry per-CVE precision).
• 2026-09-09/weworm-ai-zero-click-wechat-worm-account-takeover (research, notable), Calif's AI-assisted zero-click WeChat worm (Android + iOS, via an unanswered VoIP call). Clears PD-11(d) as substantive primary tradecraft on a developing craft: the AI-assisted development-time compression (working RCE in ~2 days, worm in ~1 week) is a capability data point, and the zero-click-via-trusted-contact propagation pattern transfers to any messaging/collaboration platform. Already patched by Tencent before disclosure (no WeChat action item, empty actions[]); mechanism withheld, so no Triage line.

KEV sweep (39 h window): 4 additions, 2 NOT COVERED (CVE-2026-81963, CVE-2026-85880) → both dispositioned to the new Windows entry above. The other two (CVE-2026-75650 Adobe Commerce, CVE-2026-86218 N-able N-central) are already covered by 2026-09-08/stylesmuggler-… and 2026-09-07/cve-2026-86206-86207-86218-n-able-n-central-third-chain.

borderline-drop: NovoCure ShinyHunters breach, home-region nexus contradicted by the primary, no gov nexus, no TTP. An attacker is now named (ShinyHunters leak-site claim + quoted extortion ultimatum, reported by BleepingComputer 2026-09-01), which would supply an evidence-bound T1657. But the deep-read of the primary SEC Form 8-K found NovoCure Limited is Jersey-incorporated with its principal executive offices in St. Helier, Jersey; BleepingComputer describes only "operations in North America, Europe, the Middle East, and Asia"; no fetched source this run confirms the "Baar/Canton of Zug, Switzerland HQ" earlier backlog rows asserted; and the exposed data is entirely U.S. patients and NovoCure employees. Even granting Swiss operations, NovoCure is a private commercial medtech firm with no Swiss public-sector / government / supplier nexus and no disclosed access vector or transferable TTP; ShinyHunters' healthcare-extortion pattern is already extensively tracked. Does not clear the PD-11 breach gate for the Swiss government constituency (relevance-doubt resolves toward drop, v4.2). Backlog row updated; re-open only on a concrete Swiss public-sector nexus or a transferable TTP.

borderline-drop: OpenAI DSEwiki governance allegation (Reuters via Dark Reading), single-relay, contested, no defender-action delta. Dark Reading (2026-09-08) relays Reuters' anonymous-sourced claim that OpenAI's legal team suppressed further investigation of the DSEwiki incident; OpenAI denies it on record. Would be an update on 2026-09-06/openai-dsewiki-agent-collusion-egress-bypass-nondisclosure, but a contested, single-source-relay governance allegation is not a PD-8 material development (no new actor/victim/CVE/patch/exploitation change) and changes no defender action; the existing entry already covers the non-disclosure gap.

borderline-drop: Natural Resources Wales FoI diversity-data exposure (TechNadu), no attacker behaviour, single-source, generic lesson. A 2021 FoI response exposed special-category data on ~2,000 staff, undetected five years. A document-handling/redaction failure, not an intrusion, so no evidence-bound ATT&CK mapping is possible without inventing one; single-source; the transferable FoI-redaction lesson is generic and changes no Swiss-gov SOC action in 7 days.

Backlog re-checks (all carried forward, no change): Insel Gruppe (inside-it.ch still 429; no independent Swiss press); Ixa Systems SA, UICC, Ville de Libercourt (bare leak-site claims, still uncorroborated, fail PD-6); Boston Scientific (not re-checked this fire); Zurich District Court verdict (due 2026-09-10, one day out, publish the verdict outcome, not procedural days). The NovoCure row is annotated with the drop rationale above.

• Coverage gaps: cisa-directives (JS filter-facet shell, long-documented recipe gap); greynoise (stale blog, no in-window scanning post); reliaquest, ibm-xforce, jamf-threat-labs, proofpoint (client-side render / CMS shell, no drillable listing, S3); inside-it-ch (Vercel 429 on article bodies, RSS healthy). Main-agent Phase-4 deep-read fetches (MSRC, CISA, ZDI, BleepingComputer, SEC EDGAR, Calif, Help Net Security, The Hacker News) were used for grounding but not reflected as per-source last_successful_fetch bumps, since the originating 0410Z sub-agents (not this fire) owned the domain sweeps and did not publish; only calif-codex is bumped (promotion-relevant candidate, contributed content).
• Watchlist: none configured; sweep is a no-op.