2026-09-14T0410Z-intel

Verification & coverage notes

Standard window (gap 15.04h since the prior run, 2026-09-13T1307Z-audit); no coverage-window disclosure required. Zero in-window CISA KEV additions (tools/kev_window_diff.py, saved to work/2026-09-14T0410Z-intel/kev-window.txt); no KEV disposition duty this run.

S1, S2 and S4 returned a genuinely quiet window for their domains after full essential-tier + rotation sweeps (all 17 store-wide active essential sources attempted across the four sub-agents). S3's tasked priority verification of the state/coverage_backlog.md GTG-27005 row (a freelance Russia-based team's Claude-Code-engineered autonomous drone-swarm targeting stack, from the same Anthropic report as the already-published GTG-20006 entry) confirmed it as a distinct, in-scope finding; the main agent re-fetched the primary and DroneXL's corroborating piece directly, literal-checked every evidence quote against the saved bodies (one quote required correcting for the source's curly-quote characters, no other discrepancies), and corrected S3's verification: MULTI-SOURCE finding to single-source, DroneXL relays and quotes Anthropic's own investigation rather than independently assessing the underlying activity (classification-policy: one assessor, a second publisher). Published as 2026-09-14/gtg-27005-ai-drone-swarm-weapons-engineering; references[] declares the GTG-20006 entry as a same-report companion finding; techniques[] left empty (no enterprise ATT&CK mapping applies to physical weapons-engineering misuse of a coding assistant, per S3's explicit, evidence-bound analysis, carried forward rather than invented). New entity actor:gtg-27005 registered.

• Single-source: 2026-09-14/gtg-27005-ai-drone-swarm-weapons-engineering, all substantive reporting traces to Anthropic's own investigation of its own platform; DroneXL restates that same report.
• borderline-drop: GTG-84002 (same Anthropic September 2026 report, a UAE-directed influence operation against the Muslim Brotherhood/Sudan-conflict/UN-accountability targets) (flagged by verification iteration 1 as a possible home-region nexus, since the case narrative states the actor "created a front NGO that copied a real Swiss organization's identity." Checked directly against the primary: the report contradicts itself on this exact point) its own "Key findings" bullet for the same case instead says the actor "borrowed the identity of a real Sudanese human rights organization." With the primary internally inconsistent on the one fact that would establish a Swiss nexus, and the case otherwise being a UAE-vs-Muslim-Brotherhood/UN influence operation with no Swiss public-sector target, victim, or actionable defender lesson, this does not clear PD-11 as a new entry. Re-open only if a corrected version of the report or independent reporting resolves which identity was actually spoofed.
• borderline-drop: Regular Labs' 2026-09-13 catalogue-wide Joomla extension security release (nine CVEs across ten extensions, independently corroborated by S1 and S3 as the same story, merged into one candidate), the standout flaw (CVE-2026-85192, PHP code execution via an inline Condition Rule) requires an authenticated content-author-role account, no CVSS score has been assigned yet (all nine ids remain RESERVED), no exploitation or public PoC is reported, and no source states the fix diff makes the technique trivially rediscoverable. Does not clear PD-11(b)'s beyond-the-regular-patch-cycle bar for a vulnerability-kind entry; a routine, if well-documented, vendor patch cycle. Not added to the coverage backlog (this is a relevance-gate decision, not a process/capacity constraint).
• Coverage gaps: tp-link-omada-psirt (404, see fetch_failures[]), ncsc-uk (S1, S2: the reports-advisories listing renders client-side; trafilatura sees only the static nav shell, no recipe currently surfaces current items), tenable-research (S1: RSS returned 0 items via both direct and jina fallback), censys-blog (S1: extract returned only a stale cached landing snippet, metadata dated 2026-05-28), cisa-advisories (S1: the advisory/directives listing pages render as a client-side filter form with no items in extracted markdown; the higher-value CISA KEV structured endpoint was fetched cleanly and separately), inside-it-ch (S2, S3, S4: escalated to a whole-host 429 this run, see fetch_failures[]), venarix (S4: client-rendered listing carries no dates in server-rendered HTML, freshness unassessable), zataz (S2, S4: feed refreshed only to 2026-09-05/09, no in-window items), ransom-isac (S4: feed reachable, latest post 2026-08-27, no in-window items).
• Backlog: eleven open rows re-checked this run (S1: Siemens S7 PLC advisory, VMware VMSA-2026-0007; S2: inside-it.ch Insel Gruppe, Spring Ring/Unit 42; S4: TheGentlemen/Ixa Systems, Krybit/UICC, Kairos/Libercourt, NovoCure, ShinyHunters/Medela, SafePay/reichenau.at, Ville du Tampon), all no-change, dated notes appended. The four PD-11(d) research items row was not re-probed (S3 was tasked on the GTG-27005 priority verification). GTG-27005 struck (published). One new candidate added: ShinyHunters claims Kimberly-Clark (2026-09-13), leak-site-only, no company statement or Admiralty A/B pickup, fails PD-6 as it stands; would clear PD-11(a) on global scale if corroborated. A stale duplicate Open-table row for the already-struck Boston Scientific item was found and removed (it had been correctly resolved in the Struck table by the 2026-09-10 fire but never deleted from Open).
• sources.json: tp-link-omada-psirt note appended and consecutive_fetch_failures bumped to 3 (see sources_changed[]); no promotions due this run (sources.promotion_due empty).