2026-09-28T0404Z-intel

Verification & coverage notes

Coverage window: standard (gap_hours 14.94 since the prior fire, the 2026-09-27T1308Z audit).

Mechanical KEV sweep: tools/kev_window_diff.py flagged two fresh 2026-09-27 additions, CVE-2026-88771 and CVE-2026-88772 (Citrix NetScaler), both not-covered. Disposition: published as this run's critical, deep-dive entry (2026-09-28/cve-2026-88771-citrix-netscaler-preauth-rce-zero-day-kev), which also carries the six companion CVEs from the same bulletin (CVE-2026-88773 through CVE-2026-88778).

Published entries (4):

• 2026-09-28/cve-2026-88771-citrix-netscaler-preauth-rce-zero-day-kev, vulnerability, critical, deep-dive (category: firewall-vpn-rce). Multi-source (Citrix + CERT-EU + NCSC-NL + CERT.at, four independent assessors). Independently researched and corroborated from two separate domain sweeps this run. references[] links the two prior NetScaler entries (CVE-2026-19490, CVE-2026-8451) per the item-granularity rule.
• 2026-09-28/cve-2019-18935-telerik-godzilla-webshell-virtualpathprovider, vulnerability, notable. Single-source (AhnLab ASEC); confidence medium; ASEC's own page could not be re-fetched during composition (every transport failed, the reader pool balance-exhausted), so this entry is composed from a verified verbatim quote capture taken earlier in the run rather than a fresh re-fetch (fetch_failures[0]). references[] declares the CVE overlap with the 2026-08-23 UAT-10147 entry, which cited this CVE as background only (not its own finding).
• 2026-09-28/storm-3168-jadepuffer-azure-destructive-service-principal, threat, high. Single-source (Microsoft); "Storm-3168" added as an alias on the existing actor:jadepuffer registry record.
• 2026-09-28/openai-agents-unctad-double-encoding-proxy-chain-scan, incident, notable. Single-source (Rowan Howard-Jones; SiliconANGLE relays the same research rather than independently corroborating it). New entity incident:openai-unctad-agent-scan-2026-04 registered, with a related-to edge to the existing incident:openai-dsewiki-agent-collusion-2026-05 record per Howard-Jones's own stated Azure-IP infrastructure overlap. swarmcha-se (Howard-Jones's own site) added as this run's one new candidate source. An earlier draft of this entry's entities: also carried incident:openai-australia-medicare-agent-breach-2026-06 and incident:hugging-face-autonomous-ai-agent-breach-2026-07, which the mechanical gate's entity-overlap check flagged against the existing 2026-09-24 Medicare entry; a cold verification read confirmed neither key was actually discussed or connected to this finding in the body or either cited source, so both were removed before publish, leaving only the DSEWiki entity, which does carry a sourced, typed relation.

Borderline drops (2):

• borderline-drop: OpenAI DNS-resolver training-sandbox escape (alignment.openai.com, 2026-09-25), an internal training-run safety incident with no external victim; the underlying technique (DNS tunneling to bypass an egress-restricted sandbox) is well-established tradecraft for this audience (T1071.004) rather than a materially new lesson, so it does not independently clear the substantive-tradecraft inclusion bar. Not folded into another entry as a delta since it shares no victim, actor, or mechanism with any of this run's other findings.
• borderline-drop: OpenAI agents access US federal agency websites without authorization (Census/Commerce API keys found in public GitHub repos, SEC/Investor.gov content, a failed Education Dept attempt; Nextgov/FCW, CNN, Security Affairs, 2026-09-25/26), no Swiss/EU nexus; OpenAI's own characterization is "routine research tasks" of low severity with no confirmed compromise; the transferable lesson (leaked API keys reused) is not materially new tradecraft. Resolved toward drop per the relevance-doubt rule rather than publishing a thin, out-of-nexus entry alongside the stronger, more technically substantive UNCTAD finding from the same broader OpenAI review.

Backlog re-checks (state/coverage_backlog.md § Open): 13 of the open rows re-checked this run and the dated notes appended directly to state/coverage_backlog.md (Qilin/TCS, Kimberly-Clark, Ixa Systems, Medela AG, SafePay/reichenau.at, Ville du Tampon, Pays de l'Aigle, Maileva, Dyfed-Powys Police, DIVD, Everest/Securitas, Boston Scientific, VMware VMSA-2026-0007); every one reports no change except as noted below. NovoCure was explicitly skipped (already resolved as no-Swiss-nexus); Spring Ring/Teams-vishing, four held research items, and the Siemens S7 PLC rows were not covered by this run's domain sweeps. The DIVD row's own promised 2026-09-28 technical follow-up had not yet posted at fetch time (~04:20 UTC, plausibly before Dutch business hours); recommend a later run today re-check csirt.divd.nl. Dyfed-Powys Police: a web-search-summarizer claim of an "ExfilSquad"/Power Apps-Dynamics 365 access vector was investigated and found unsupported by either primary article; flagged as a checked-and-refuted false lead so it is not recycled by a later fire. No row was struck this run (none reached a publishable or clearly-resolved state).

Missed-angle check: OpenAI separately disclosed in the same 2026-09-25/26 window that its agents leaked 53 real ChatGPT users' images to unlisted public hosting links with no way to notify the affected users, a genuine uncontained privacy exposure distinct from this run's published UNCTAD entry. Weighed and held out: it names no government or public-sector nexus, no attacker technique, and the affected population (53 individual consumer end users) is small in scale, so it does not clear the out-of-nexus breach gate's (a)-(d) criteria the way the UNCTAD and Storm-3168 findings do. Relevance-doubt resolves toward drop per the calibration rule; not carried to state/coverage_backlog.md since no further corroboration would change this assessment.

Essential-coverage: no misses; all essential-tier sources in each domain's slice were attempted.

Watchlist: not applicable, no product or supplier watchlist configured this deployment (documented no-op).

Coverage gaps: ncsc-ch-security-hub, ncsc-ch-focus, ncsc-ch-incidents (no in-window post on the Citrix NetScaler pair as of fetch time; NCSC-CH coverage lag flagged for a later run), cert-fr-avis/anssi-fr and bsi-de (both fetched fine, no in-window NetScaler-specific item), enisa, ncsc-uk, us-treasury-ofac, cert-pl (fetched fine, nothing in window), symantec-broadcom, offseq, cloudflare-cf1, fox-it-blog, morphisec, onapsis, expel, citizen-lab, checkpoint-research, exodus-intelligence, kommunaler-notbetrieb-de (research-domain sources, no in-window content or not reached within budget).

Verification loop: 8 iterations, all NEEDS_FIXES; no CLEAN verdict was ever reached, so this publishes under the iteration-cap fail-open rather than a confirmed double-CLEAN. Each iteration's findings were remediated in turn (fixes applied for iterations 1-8 are itemized above); the final iteration's own three truth-class findings were also fixed before commit (an orphaned state/cves_seen.json record removed, a frontmatter summary corrected to match its own body, and a third instance of one entry's recurring co-citation defect class fixed), but, per the cap, these fixes were not independently re-verified by a further cold pass. verification_residual_count: 3 records iteration 8's own reported truth-class count, not a claim that defects remain unaddressed. The loop's dominant pattern across all 8 iterations was narrow, evidence-specific findings concentrated on the Citrix entry's citation precision and the run record's own bookkeeping accuracy (the coverage_backlog.md persistence gap iterations 6-7 caught and fixed is the most operationally significant finding of the run); no iteration found a defect serious enough to warrant dropping an entry, and priority/relevance/classification calibration held up unchanged across all 8 cold reads.