2026-09-24T0405Z-intel

Verification & coverage notes

6 new entries, 0 updates, 1 deep dive. This run's mechanical KEV sweep (tools/kev_window_diff.py) found zero in-window CISA KEV additions; a confirmed non-issue this run, not an unswept gap.

Verification note: the loop ran all 8 iterations without reaching a confirmed double-CLEAN. Every iteration from 1 through 8 found at least one genuine, evidenced defect, and every finding was remediated before the next spawn or before commit; no finding was declined without a stated rebuttal. The defects were overwhelmingly citation-precision issues (a clause attached to the citation for an adjacent clause rather than the source that actually states it), concentrated in two multi-source, multi-clause paragraphs (the WordPress deep dive's pearcmd/Docker mechanism paragraph and the OpenAI/Medicare entry's opening sentence) each of which needed a full re-derivation of every clause's citation from scratch (once each) before the remaining residue narrowed to single low-confidence findings. Publication proceeds under the documented iteration-cap fail-open rule, not a confirmed CLEAN; verification.confirmation_waived records the reason.

Deep dive: 2026-09-24/wordpress-cve-2026-87902-page-template-traversal-rce. Selected over CLOSEDQUORUM (Cisco Talos' novel LLM-orchestrated C2 research, published as a full non-deep-dive threat entry) under the deep-dive selection priority order: CVE-2026-87902 clears deep-dive criterion 1 (active in-the-wild exploitation with non-trivial exposure, any internet-facing WordPress install, including Swiss communal/cantonal sites built on WordPress) while CLOSEDQUORUM clears the lower-priority criterion 3 (substantive technical analysis, no confirmed live deployment).

Merged finding: S3 and S4 independently surfaced the same underlying story (ShinyHunters' claimed FBI breach via an unconfirmed Oracle PeopleSoft zero-day) through different source chains (S3 via BleepingComputer/The Hacker News/404 Media/CyberInsider/SC Media; S4 via TechCrunch/CyberScoop/Axios). Composed as one entry (2026-09-24/shinyhunters-fbi-peoplesoft-breach-claim) combining both source sets per the item-granularity rule. S3 also surfaced ShinyHunters' separate hijack of Clop's own Tor leak site (a distinct victim, a rival ransomware gang), not composed as its own entry (no defender-actionable technique or constituency nexus distinct from the FBI story) but mentioned as one sentence of background context in the published entry.

Borderline-drop: GitLab CVE-2026-89078 / CVE-2026-93577 (regex-parser memory corruption, CVSS 9.9), requires authenticated low-privilege access, no confirmed exploitation, no public PoC, technical detail withheld under GitLab's 90-day disclosure embargo. Routine patch-cycle CVE per PD-11(b); does not clear the beyond-normal-cadence bar despite the high CVSS score, and GitLab already carries extensive coverage this month for a distinct vulnerability class.

Borderline-drop: Belgian municipality Machelen, a premature "no personal data leaked" assessment reversed twelve days later. Out-of-nexus EU communal incident (Belgium, not the home region), no named actor, no novel or evolved TTP (a generic phishing vector), no same-actor or imminent-shared-threat basis. Fails all four PD-11 breach-gate limbs for an out-of-nexus incident; the "don't commit publicly to a no-data-theft finding before forensic scope is exhausted" lesson is a communications-process point, not a transferable technical one.

Borderline-drop: Adobe Connect CVE-2026-75682 (SQLi-to-RCE, CVSS 9.9) and Adobe AEM Forms JEE CVE-2026-75745 (unauthenticated RCE, CVSS 9.8), both surfaced fresh via NCSC-NL's 2026-09-23 same-day bundling alongside routine vulnerability bulletins, no exploitation reported, no PoC, no forcing mechanic beyond CVSS established this run. S1 time-boxed the deep-read in favor of the two higher-value vulnerability items already included (WordPress, SolarWinds); insufficient verified technical detail to compose responsibly without further research. Candidate for a future fire if exploitation activity emerges.

Out-of-window, not republished: IBM MQ CVE-2026-10747 and IBM Langflow OSS CVEs, both bundled into an NCSC-NL advisory dated 2026-09-23; the underlying IBM disclosures are 9 to 15+ days old with no fresh exploitation evidence; the NCSC-NL posting is a same-day republication, not new signal. cert-pl's WEBCON BPS IDOR (CVE-2026-92419), low severity (CVSS4.0 5.3), authenticated, does not clear the relevance/actionability gate. ENISA Threat Landscape 2026 annual report, likely just outside the 26h window (published 2026-09-22); no independent annual-report candidate surfaced by S3 this run.

Single-source entries: 2026-09-24/microsoft-entra-id-sspr-enumeration-resetspy (LevelBlue SpiderLabs is the sole technical assessor of this specific finding; the underlying portal behaviour is independently checkable by any reader, but no second party has published its own assessment as of this run).

Entity overlap (deliberate): 2026-09-24/closedquorum-llm-orchestrated-c2-implant shares the product:google-chrome and product:microsoft-edge entity keys with 2026-09-10/cve-2026-87491-chrome-v8-oob-write-seventh-2026-zero-day. This is a distinct finding, not a duplicate or a delta on the earlier entry: the September 10 entry is a Chrome V8 vulnerability, while CLOSEDQUORUM is malware that harvests saved credentials from Chrome and Edge among other targets; the shared entity keys reflect Chrome/Edge being named in both stories, not the same underlying event.

Coverage backlog: all 14 open rows in state/coverage_backlog.md were re-checked on today's facts. Thirteen show no material change (re-confirmed via fresh searches/fetches); one (NovoCure) was skipped per its own row's standing instruction (re-check only on a new concrete Swiss public-sector angle, none sought or found incidentally). No row was struck or published this run.

Watchlist: products checked=0, hits=0; suppliers checked=0, hits=0, no product or supplier watchlist configured this deployment.

Coverage gaps: cisa-directives (bridge cisa page returns only the site navigation shell, a long-documented JS-shell/recipe-gap condition; no evidence any new directive published in-window via other means). mozilla-mfsa (listing page extracted cleanly, 200, but the per-date advisory items under recent headers did not resolve to bulleted links in the trafilatura extraction; no MFSA advisory confirmed in-window this pass, an extraction-completeness gap worth a follow-up direct WebFetch if it recurs, not a transport failure). inside-it-ch (flagged in the prior two fires' fetch-gap tracking with HTTP 429; fetched cleanly, 200, on all three attempts this run, appears recovered, no action needed).

Essential-coverage: all essential-tier sources across all four domains fetched successfully this run (no misses to disclose).