2026-09-23T0405Z-intel

Verification & coverage notes

8 new entries, 2 updates, 1 deep dive. All three CISA KEV additions this run's mechanical sweep found without existing coverage (CVE-2026-93616, CVE-2026-93952, CVE-2026-94127) were published as new critical entries; a fourth in-window KEV addition, CVE-2026-85102, was already covered and shipped as an update record elevating that entry to critical. One parallel research task's first attempt was terminated mid-flight by a content-safety classifier reacting to raw advisory text (a known false-positive pattern); a retry with clearer defensive framing succeeded cleanly.

Duration note: this run's total elapsed time (~3.2 h) exceeds the usual range. The cause is the verification loop itself, not a stall: eight successive verification passes each found genuine, fixable defects (an inconsistent attribution hedge, an uncited detail, an overstated exploit-availability claim, unlinked entity references, a missing CISA KEV cross-reference, among others) and every finding across all eight iterations was remediated in place before the next pass or before publish; none was left unfixed. The loop reached its 8-iteration cap without achieving the double-CLEAN confirmation and published fail-open per the cap rule; verification_residual_count (2) is the capped final iteration's own truth+editorial tally at the moment it ran, logged for the audit trail as the rules require; it is not a count of unresolved content, since that iteration's findings were also fixed before this commit.

Correction: 2026-09-06/mikrotik-routeros-mikrotrick-ssh-auth-bypass-privesc-chain; CERT Polska's own 2026-09-22 technical write-up states plainly that CVE-2026-67276 was wrongly associated with the actively-exploited MikroTrick chain in earlier reporting (including this entry's own original text, which quoted CERT Polska's 2026-09-05 post describing it as the signature-forgery entry point). The real entry point is CVE-2026-67279 (SSH rekey-during-authentication state confusion). Corrected title, summary, both CVEs' exploitation status, and the body's mechanism description; does not float the entry (a correction, not a new development).

Deep dive: 2026-09-23/gambit-ai-agent-retail-skimmer-campaign-strix-cairn-hermes. Selected over the three same-day critical CVEs, which are single-flaw vendor disclosures already carrying full vendor-supplied detection guidance and did not need extended kill-chain treatment; this finding instead offered a substantive, fully-reconstructed multi-stage attack chain. Two claims from the corroborating secondary outlet were excluded from the entry because they do not appear in the primary research: a claim naming an additional AI model in the harness stack, and a payment-processor fraud-flag statistic. Specific attacker domains, a file hash and IP addresses present in the primary research were not reproduced, consistent with this pipeline's no-IOC policy.

Note on CVE-2026-93952 (Arista VeloCloud Orchestrator): the vendor advisory's indicator-of-compromise section (file paths, a file hash, two IP addresses) was not reproduced, consistent with the no-IOC policy.

Contradiction: Gambit Security's own primary research states two different counts for how many websites carried a live skimmer ("five" in its opening summary and "19 of 27" in its dedicated results section) without reconciling them. The retail-skimmer campaign entry uses the larger, more precise, dedicated-section figure (19 of 27), which a second outlet's reporting also uses independently.

Coverage backlog (the queue of previously-surfaced items awaiting corroboration): all 9 open items were re-checked; no material change on 8 of them. One item (a Bern hospital group's ServiceNow migration delay, sourced to a single paywalled article) is recommended for closure as unresolvable: over 20 consecutive daily checks since 2026-08-30 have hit the identical access block with zero independent corroboration found anywhere; it can be reopened if the article or a corroborating source becomes reachable.

Dropped as out of scope: a Bavarian university's disclosure of a roughly 52,000-record data exfiltration, no Swiss nexus, and no source names a mechanism or actor, so the finding could not carry an evidence-bound technique mapping; noted for awareness only, since several structurally identical items are already in the backlog. Also dropped: a leak-site defacement in an inter-gang extortion feud, genuinely fresh, but with no victim-facing technique, no constituency nexus and no detection lever.

Single-source entries: 2026-09-23/ncsc-ch-google-recovery-oauth-app-password-persistence (the national-CERT carve-out, NCSC Switzerland's own weekly advisory). 2026-09-23/gambit-ai-agent-retail-skimmer-campaign-strix-cairn-hermes (the research vendor is the sole technical assessor; the corroborating outlet reports on those findings rather than independently assessing the campaign). 2026-09-23/virtualizor-billing-hook-unauth-root-rce (the discovering researcher is also the CVE-assigning authority; no independent second analysis has been published yet).

Fetch gap: F5's own advisory (my.f5.com K000162605) is a client-rendered SPA unreachable via extract or jina (loading-shell only on both transports); covered via CERT-EU's Security Advisory 2026-013 (national-CERT-class primary quoting F5 directly) plus two independent secondaries quoting the same text.

Watchlist: products checked=0, hits=0; suppliers checked=0, hits=0, no product or supplier watchlist configured this deployment.

Coverage gaps: cert-at (403 on both attempted URLs, no working alternate found this run); dcod-ch (homepage is a static dashboard, not an article listing); csa-labs and paradigm-shift-research (both republish disclosures 3–7 days old under a fresh display date; recommend future runs treat their displayed date as a republish timestamp, not a recency signal, and always verify against the linked primary).