2026-09-16T0409Z-intel

Verification & coverage notes

Standard window (gap_hours=24, window_hours=26). All four research passes returned within the 45-minute cap; no closed-source intake this run (no intel/ drops). CHOSEN BRICK (the joint NCSC UK/FBI/AIVD Iranian-spyware advisory) was independently surfaced by three of the four research passes (the active-threats/vulns pass, the home-region/sector pass, and the research/investigative-reporting pass), composed once as a single entry from the converged findings, citing NCSC UK as the primary (single-source-national-cert carve-out; FBI and AIVD co-authored the same joint publication rather than three independent assessments).

Two new entries: CHOSEN BRICK (threat, notable) and BambooToken (threat, notable, Lumen Black Lotus Labs' previously-undocumented MQTT-C2 malware framework). Two changelog updates: the GitLab CVE-2026-85706 entry (NCSC Switzerland's posting confirmed the sibling CVE-2026-87719 now exploited and linked a public PoC for the original flaw) and the Revolut KYC-breach entry (an extortion/ransom-demand escalation, sourced to an aggregator relay after the originating outlet, Computing.co.uk, 403'd on every transport).

No deep-dive this run: CHOSEN BRICK's apt-campaign category was demoted one rank per the 7-day category-rotation rule (GTG-20006 published 2026-09-13 already used that category), and neither new item independently clears criterion 1 (no active exploitation/vulnerability involved in either).

borderline-drop: Delinea Secret Server three new PAM CVEs (CVE-2026-15638/15639/15640, CVSS 9.1-9.5), no confirmed exploitation, no public PoC, and two of the three require CVSS4 attack-complexity High/attack-requirements Present rather than a trivial pre-auth path; does not clear PD-11(b)'s out-of-band bar (routine patch cycle applies).

borderline-drop: CenterPoint Energy (US electric/gas utility) customer-data breach via unthrottled public-API sequential-ID enumeration, ~7.49M records claimed, out-of-nexus (US utility, no Swiss/EU angle), and the access technique (unrated public API without rate-limiting/WAF) is a well-known, not novel or evolved, class; does not independently clear the breach-gate's (a)-(d) criteria.

borderline-drop (added to coverage backlog, not dropped outright): AFPA (French national vocational-training agency) ~971,000-record leak-site claim, single C-reliability tracker, no victim confirmation, no Admiralty A/B journalism; added as a new open row to re-check on a later fire.

Coverage-backlog rows re-checked this run: Kimberly-Clark/ShinyHunters, Ixa Systems/TheGentlemen, UICC/Krybit, Ville de Libercourt/Kairos, Medela/ShinyHunters, reichenau.at/SafePay, the AA26-231A Siemens S7 PLC re-read, and the inside-it.ch Insel Gruppe article (17th+ consecutive fire blocked on the same host-level rate limit), no change on any. Ville du Tampon (La Réunion), no change, still no named mechanism/actor. Familea (French municipal family-services SaaS), material scope-expansion delta (now confirmed across five communes in four departments, not just Bruguières) recorded on the open row, but still no named mechanism, actor or data-theft claim, so it stays below the publish bar under the same precedent as Ville du Tampon/Boston Scientific/NovoCure.

Single-source: 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware, single-source-national-cert (NCSC UK, with FBI/AIVD as joint co-authors of the same publication, not independent assessments; The Record's reporting relays the same advisory). 2026-09-16/bambootoken-mqtt-c2-tendyron-sideload, single-source (BleepingComputer's article relays Lumen Black Lotus Labs' own findings rather than independently assessing them). 2026-09-13/revolut-fake-government-request-kyc-breach's 2026-09-16 update, single-source-other equivalent via aggregator: the originating outlet (Computing.co.uk) 403'd on every transport tried; sourced to DataBreaches.net's direct relay, confidence lowered to medium for the entry as a whole.

Mechanical KEV sweep (tools/kev_window_diff.py --window-hours 26): 0 CISA KEV additions since 2026-09-15; no disposition needed this run.

Essential-coverage: all essential-tier sources attempted across the active-threats/vulns and home-region/sector passes with no misses; the research and incidents passes' essential slice (heise-sec, inside-it-ch) both attempted and returned RSS content with no in-window relevant item.

Declined verifier finding: the verifier's iteration-5 pass flagged a Neuchâtel-based Swiss Bitcoin Pay breach disclosure (dailyhodl.com, 2026-09-15) as an apparently-unconsidered candidate. Declined as a false positive; this incident is already published as 2026-09-15/swiss-bitcoin-pay-neuchatel-internal-systems-breach by the prior day's fire and already carried in this run's dedup index; the flagged article is same-day reporting on that same already-covered disclosure, not a fresh delta.

Coverage gaps: tp-link-omada-psirt (5th consecutive 404; vendor Nuxt SPA support portal appears to have moved its advisory-index route; needs a recipe review); zdi, watchtowr, shadowserver, hadrian-labs, vulncheck, sonatype, jpcert, esentire, sansec-research, socket-dev-blog, snyk-research, trail-of-bits (all fetched cleanly, no in-window item, active-threats/vulns pass); cert-at, ccb-belgium (404 on the specific advisory/news path attempted, home-region/sector pass); unit42, akamai-sirt, dfirreport, crowdstrike, elastic-seclabs, vulncheck, eset, esentire, csa-labs, gambit-security, paradigm-shift-research (JS shell, no listing), sygnia, trellix (JS shell, no listing), all fetched, no in-window item, research pass; helpnetsecurity (JS-rendered homepage, no listing), ico-uk (raw HTML only, not reviewed this run), incidents pass.