2026-09-18T0410Z-intel

Verification & coverage notes

Standard 26-hour window (24 hours since the previous fire, 2026-09-17T0409Z-intel). No closed-source drops this window. No product or supplier watchlist is configured for this deployment, so both sweeps are no-ops (Watchlist: products checked=0, hits=0; suppliers checked=0, hits=0).

Mechanical KEV sweep: tools/kev_window_diff.py --window-hours 26 found zero CISA KEV additions since 2026-09-17; no disposition duty this run. The vulnerability-track research independently cross-checked the live KEV catalog and surfaced one CVE that never appeared in the prior 14-day coverage despite meeting the confirmed-exploited/KEV bar a day earlier than this run's window (CVE-2026-87886, Acronis Backup plugin, KEV-listed 2026-09-16); see the gap-fill note below.

New entries (7):

1. cve-2026-91843-check-point-security-mgmt-stack-overflow (high, vulnerability), unauthenticated stack overflow in Check Point Security/Multi-Domain Security Management and Log Server login process, root RCE, no confirmed exploitation. Included under PD-11(b)'s "otherwise" limb: an anonymous single-request path to root on network-security management infrastructure.
2. cve-2026-87886-acronis-backup-plugin-lpe-cpanel-kev (high, vulnerability), Acronis Backup plugin LPE for cPanel & WHM/Plesk/DirectAdmin, CISA KEV-listed 2026-09-16 on a single-customer-report basis. Gap-fill: disclosure predates this run's 26h window by about a day and was missed by the prior fire's own KEV sweep window; published now per the coverage-backlog philosophy (verified in-window by the fire that surfaces it) rather than deferred further.
3. ntc-swiss-solar-inverter-cybersecurity-assessment (high, research), Swiss NTC finds 50+ vulnerabilities across solar inverters/EMS including unauthenticated grid-feed shutoff; direct cantonal (Bern) procurement nexus. Independently surfaced from both the home-region/sector track (English NTC page) and the research track (German NTC page + SRF); composed once, merging both discovery traces.
4. famoussparrow-sparrowocky-backdoor-latam-gov (notable, threat), ESET documents a new FamousSparrow backdoor with BOF-loading and call-stack spoofing, almost exclusively targeting Latin American governments. techniques[] carries the full 34-id set from ESET's own ATT&CK table (a deep re-read of the primary before composing caught the initial research draft at only 13 ids, see below).
5. moviereaper-torrent-supply-chain-solana-c2 (notable, threat), Kaspersky documents a crimeware framework distributed via a torrent-file-repository supply-chain compromise, using Solana blockchain as a C2 dead-drop; government named among confirmed victim sectors.
6. gyazo-helpfeel-data-breach-image-upload-rce (notable, incident), Helpfeel discloses a Gyazo breach exposing 23.62M user records and 490M image-metadata records; included on PD-11(a) global scale.
7. brevo-cloudflare-worker-clickfix-supply-chain (high, incident), a stolen Cloudflare API key let an attacker inject malware via a CDN-edge Worker into up to 100,000 sites, defeating origin-side integrity checks; included on PD-11(b), a materially novel and transferable supply-chain TTP.

Updates (3), all type: update, all float updated_at:

• 2026-08-04/cve-2026-20079-cisco-secure-fmc-auth-bypass-root-hotfix, Cisco's promised 2026-09-16 hardening release landed on schedule, adding CVE-2026-20324 and CVE-2026-20242 to the same tracked FMC product line; neither reported exploited.
• 2026-09-17/cve-2026-76460-cisco-ise-auth-bypass-root-rce, the same 16 September cycle disclosed a further 21-vulnerability, 13-critical Cisco ISE hardening release; two more CVSS 10.0 CVEs beyond the already-exploited primary; CERT-FR confirms only the original CVE is exploited and flags an unpatchable subset on ISE 3.1/3.2 before their 2027 end of maintenance.
• 2026-09-13/revolut-fake-government-request-kyc-breach, Hudson Rock names the access vector this entry left open: infostealer-compromised Italian Ministry of Interior mailboxes, independently corroborated by Hudson Rock's own database finding of ~300 compromised credentials; the surrounding attacker narrative remains only partly verified.

Dropped (borderline-drop):

• borderline-drop: OpenAI model-misalignment reporting framework + context-compaction self-injection finding — genuinely novel AI-safety research (a model injecting jailbreak-style text into its own training-time context-compaction summaries), but describes model self-behavior during training rather than an external attacker technique, with no SOC-actionable detect/hunt/harden lesson; the rolling window already carries extensive AI-agent-misalignment coverage (yesterday's Mandiant deep dive, GTG-20006/27005, Hugging Face, Anthropic eval-escape entries). Quality-over-quantity (v4.2) resolves toward drop.

Deep re-read of every primary before composing (10 items): re-fetched all 10 primaries in full and confirmed every pre-existing evidence quote verbatim. Corrections folded into composition before publish: (a) FamousSparrow/SparroWocky's techniques[] expanded from a 13-id draft to ESET's own complete 34-id ATT&CK table; (b) the Brevo incident-window framing corrected to Brevo's own two-window disclosure (15:01-20:30 UTC overall impact; 16:07 UTC specifically for the customer-embedded-script compromise) rather than BleepingComputer's compressed single figure; (c) the Cisco FMC update's draft claim that Cisco Security Cloud Control is unaffected by CVE-2026-20242 was dropped, that advisory's own "Products Confirmed Not Vulnerable" list names only ASA/FTD, not SCC; (d) the Acronis entry's exploitation framing narrowed to state plainly that Acronis's own assessment rests on a single customer's report, not a broad campaign, and CISA's KEV description omits DirectAdmin even though NVD/ENISA (mirroring Acronis's own CVE text) list it as a third affected product; (e) MovieReaper's victim-country list corrected to cite Kaspersky's own more-specific "Victims" section rather than its shorter introduction-paragraph enumeration.

Coverage-backlog re-checks this run (state/coverage_backlog.md § Open), all "no change" except one new row opened:

• ShinyHunters/Kimberly-Clark, TheGentlemen/Ixa Systems SA, Krybit/UICC, ShinyHunters/Medela AG, SafePay/reichenau.at, Ville du Tampon, Familea, AFPA, all re-checked, no change on any; still only leak-site trackers or unresolved victim statements, no Admiralty A/B journalism or evidence-bound mechanism clearing the relevant gate.
• inside-it.ch's Insel Gruppe article, still blocked (a persistent "Security Checkpoint" HTTP 429 on every transport, a 19th+ consecutive fire); the day's NTC solar-inverter story was independently reached through the RSS listing and a web search pivot, bypassing the blocked article entirely. Recommend closing or re-scoping this row if the next 2-3 fires also find nothing.
• Siemens S7 PLC advisory, VMware VMSA-2026-0007, Spring Ring Teams-vishing NTLM relay, and the three remaining PD-11(d) research items (AWS root-password spraying, Exodus wallet installer RAT, Check Point JSCeal deobfuscation), all re-checked, no material development on any; remain below their respective recovery bars.
• NovoCure; not re-probed this run (no spare capacity); low priority, carried forward.
• New row opened: Communauté de communes des Pays de L'Aigle (France) confirms a mail-server intrusion the night of 14-15 September 2026; no mechanism, actor or data-theft claim named by any party, so it does not yet clear the breach gate's ATT&CK-mapping requirement. Same blocking condition as the existing Ville du Tampon/Familea rows.

Deep-dive selection: no deep dive this run. Two candidates considered (FamousSparrow/SparroWocky (category apt-campaign, used 5 days ago for GTG-20006; MovieReaper) category supply-chain, used 6 days ago for JFrog Artifactory); both demoted by the 7-day category-rotation rule, and neither independently clears criterion 1 (no confirmed exploitation against an exposed constituency) to override the demotion.

Verification: six iterations, each a fresh cold read with no memory of the prior pass. The first four each found a substantial batch of genuine defects (citation misattributions, a hallucinated product claim, spliced evidence quotes, unsupported quantifiers) that were remediated in place; the fifth and sixth found progressively fewer, concentrated on one recurring clause (a solar-inverter entry's remediation-status wording, corrected three times before it tracked the primary source's exact claim). The sixth iteration's residual, truth 1 plus editorial 1 with no broken-URL or hallucinated-fact finding, cleared the early-exit bar: both were fixed and the run published without a further confirmation pass. One advisory-only finding on the same iteration (an over-attributed interpretive gloss) was also fixed. No entry was dropped by verification.

Sources: tp-link-omada-psirt's listing URL recipe fixed (see sources_changed). All 187 tracked sources probed clean by tools/source_health.py this run (92 direct-ok, 95 bridge-ok, 0 unsolved), no repair duty.