2026-09-13T0409Z-intel

Verification & coverage notes

Standard window (gap since the previous run about 24.0 hours, 26-hour recency window); today (2026-09-13) is a Sunday and the general threat-research publishing landscape was genuinely quiet in-window across the home-region/sector, research and incident domains, most sources' newest items clustered 2026-09-09 through 2026-09-11, confirmed by broad supplementary searches, not a fetch-tooling failure. No closed-source intake drops this run. No product/supplier watchlist configured in this deployment; the sector lens and general relevance discipline were applied throughout.

Two updates recover apparent gaps from the last three daily fires, disclosed transparently. A sweep of NCSC Switzerland's Cyber Security Hub surfaced two in-window (2026-09-11/2026-09-12) NCSC-CH advisories whose own cited primaries (Cisco Talos, Volexity) were dated 2026-09-09, a day or two outside the strict 26-hour window on their own. Given the NCSC-CH advisories themselves are in-window, the underlying material is a material development on two already-critical/high-severity, actively-exploited entries already carried here (the Cisco Secure FMC auth-bypass chain and the BlueMoon exploit kit) rather than a new, isolated finding, and leaving a verified, high-severity gap unrecovered when it is already in hand would be a blind spot on critical/high signal, both were composed as update records rather than held. A third update (GitLab CVE-2026-87719 / CVE-2026-88765) closes a narrower gap: CVE-2026-87719 was already named in the existing entry's own analysis but had never carried its own CVE record, and CVE-2026-88765 is a genuinely new same-release finding, both independently confirmed by NCSC Switzerland (for the former) and GitLab's own release notes.

One new entry rides the wider window this pipeline allows for an actively developing story, disclosed for the same reason. Anthropic's own GTG-20006 threat-intelligence report (published 2026-09-10, with edits as late as 19:29Z the same day) sits inside that wider window but outside the strict 26-hour one; it was fully verified against Anthropic's own primary plus two independent secondaries (The Hacker News, 2026-09-11; UNITED24 Media, 2026-09-12), confirming continued press attention through 2026-09-12 as the in-window hook. This is a globally significant, fully-verified nation-state AI-misuse campaign (Russia-linked, Midnight Blizzard overlap, 20+ government/military/diplomatic/drone-supply-chain targets) with no existing coverage here, and was selected as today's deep dive (category: apt-campaign) given its technical depth and defender-relevance to any organization's AI-agentic threat model.

• borderline-drop: Peter Gutmann's heise online interview naming "stunt cryptography" (CVE disclosures engineered for academic/media visibility over real exploitability), a genuinely interesting, single-source commentary/analysis piece on the CVE-disclosure ecosystem itself, not a technical vulnerability or threat-actor finding; it does not clear the relevance gate as tradecraft or detection-relevant analysis, and the quality-over-quantity bar resolves this doubt toward drop.
• Coverage-backlog: all twelve open rows re-checked this run at the standing low/cheap-recheck budget (Siemens S7 PLC advisory, Insel Gruppe/ServiceNow, Ixa Systems/TheGentlemen, UICC/Krybit, Kairos/Ville de Libercourt, VMware VMSA-2026-0007, Spring Ring, three residual research items, NovoCure, Medela/ShinyHunters, SafePay/reichenau.at, Ville du Tampon); no row cleared its blocking condition this run. One new row opened: GTG-27005 (same Anthropic report as today's deep dive, a freelance Russia-based team's autonomous drone-swarm targeting software), noted but not yet verified to full primary-source depth.
• Essential-coverage: missed=cisa-directives (persistent recipe gap, every transport tried returns only the site's filter-facet shell; no structured CISA directives feed exists yet).
• Aggregator-only sourcing (acknowledged, not fixed): the Revolut entry cites TechCrunch and Security Affairs only. The entry's actual primary is Revolut's own customer notification and spokesperson statement, quoted independently by both outlets; Revolut has published no reachable newsroom statement of its own (checked: revolut.com/newsroom/ 404s). This is the established single-source-victim carve-out; the entry already carries the corresponding verification value and a sourcing note naming the gap; not re-pivoted or dropped.
• Coverage gaps: reliaquest (client-rendered blog, the reader fallback resolved to an unrelated ad-tracker pixel); ssd-disclosure (individual advisory pages returned a browser-challenge page this run, though the listing itself was readable); tp-link-omada-psirt (URL now 404s, needs a canonical-URL probe); fortiguard.com FG-IR-26-164 through -174 (anti-bot challenge on every transport; CERT-FR's own advisory confirms the CVE list but carries no CVSS or exploitation-status detail).