2026-10-02T0404Z-intel

Verification & coverage notes

Coverage window: catch-up fire. The previous fire started 2026-09-30T04:04Z, so gap_hours=48.0 and window_hours=50; the developing-story window was 72 hours. No scheduled fire was missed beyond the gap itself.

Mechanical KEV sweep: tools/kev_window_diff.py --window-hours 50 found two CISA KEV additions not covered by the store, CVE-2026-76504 (Cisco Catalyst SD-WAN Manager, added 2026-09-30) and CVE-2026-104286 (Fortinet FortiMail, added 2026-10-01). Both are published as new critical entries. Every other addition in the window was already covered or predates it (the Apple CoreGraphics CVE-2026-86950 entry exists); S1 confirmed catalog version 2026.10.01 is the latest (work/2026-10-02T0404Z-intel/kev-window.txt).

New entries (10):

• Cisco Catalyst SD-WAN Manager CVE-2026-76504 (vulnerability, critical, KEV, authentication bypass; Cisco PSIRT is the source of record and VulnCheck gives the mechanism).
• FortiMail CVE-2026-104286 (vulnerability, critical, KEV, path traversal zero-day with no fixed build on three branches; single-source on Fortinet's advisory).
• Zammad CVE-2026-102489 and CVE-2026-102490 (vulnerability, high; the zero-days behind DIVD's own breach; resolves the DIVD backlog row).
• Belnet supplier zero-day with mail copied for 65 days (incident, routine after verifier iteration 1 and 2; victim's own statement, no access vector or actor named).
• Stadt Wien documentation-platform data theft (incident, notable; the city's own release, CERT.at's tip).
• Operation KillSwitch, the KillSec takedown with fedpol and the Federal Prosecutor's Office (threat, notable; Swiss participation, three primaries).
• UAT-11587 and the Antino backdoor (threat, notable; Cisco Talos, single analyst).
• ANSSI's first REACTIV situation report, 99 state data breaches (research, notable; national-CERT source).
• FTAPI ransomware with The Gentlemen's leak-site claim (incident, routine; vendor's own statement to heise).
• Adobe Campaign Classic APSB26-142 and the previously uncovered APSB26-134 (vulnerability, notable; not exploited, not KEV-listed; resolves the Adobe part of backlog row 1).

Updates (6): Zimbra CVE-2026-73570 (update: Microsoft's first-hand exploitation analysis, the KEV listing the entry never recorded, and the 10.1.20 release date corrected to 2026-07-20 from Zimbra's own page; one wrong earlier date fixed where it stood); Citrix NetScaler CVE-2026-88771/88772 (update: Unit 42 telemetry on earliest fingerprinting, web shells, the log-poisoning chain and the exposed-instance count); Kiteworks shutdown warning (update, priority raised from notable to high: the 2026-09-30 advisory set names a CVSS 10.0 pre-auth Email Protection Gateway flaw, CVE-2026-54154, and seven further CVEs, three of them CVSS 9.8 account takeovers; the main takeaway was rewritten, and the verification field moved to single-source because every advisory and statement is the vendor's own); France SDIS data-leak campaign (update: SDIS 66 confirmed a theft of patient rescue forms and crews moved to paper and radio; no source links it to the SDIS du Gard attack or the forum claims, which the update says); OpenAI agents UNCTAD scan (update: Transluce and Asymmetric Security widen the record to US and Canadian government sites, Canada's Cyber Centre sees no compromise); Apple CoreGraphics CVE-2026-86950 (update, added after verifier iteration 8: Calif published a public proof of concept on 2026-09-30 that crashes unpatched devices with a crafted PDF font, poc-public added, no code execution shown and the WhatsApp delivery path unconfirmed).

Source allocation: slices S1 26, S2 25, S3 23, S4 19 records, every record with a ledger row, so no continuation was needed. One scoped follow-up spawn, FU1, took the two highest-priority backlog rows (IBM MQ and Langflow; the Adobe September cycle) because they are exempt from the recency gate and needed a deep read of their primaries. All sub-agents report "Sonnet 5.5 (claude-sonnet-5-5)" from their own system-prompt line.

Backlog work (state/coverage_backlog.md): all 26 open rows were dispositioned under Phase 0 step 5b. Published: Adobe Campaign Classic (row 1, the Connect and AEM Forms parts struck: not exploited, not KEV-listed) and DIVD (row 19, through the Zammad entry). Held with a named condition and expiry: IBM MQ and Langflow (2026-10-11; none in KEV, no exploitation report), Qilin and Touring Club Suisse (2026-10-05), Everest and Securitas (2026-10-10), MikroTik CVE-2026-84411, IBM Guardium CVE-2026-85542, ARA Lyss (SafePay) and Netech (Payload) (all 2026-10-14). Struck, 17 rows: every row past the 14-day bound whose blocking condition was still unmet at its last re-check, the research-blog set, Boston Scientific, the Siemens S7 re-read, VMware CVE-2026-59346 (S1: not in KEV), Maileva, Dyfed-Powys Police and SRG SSR. The Kimberly-Clark, Ixa Systems, UICC, Medela, Reichenau, NovoCure, Ville du Tampon and Pays de L'Aigle rows were struck without a fresh re-probe beyond what is recorded on each row; a resurfacing opens a new row. Stray blank lines that split the Open table were removed.

• borderline-drop: Bitget appliance zero-days update (Mandiant and SlowMist): out of nexus, products unnamed, no defender decision.
• borderline-drop: ShinyHunters update (FBI claims of 140+ organisations and $70M): actor-tracking delta with no defender decision; the Dutch arrest is already carried.
• borderline-drop: OpenInfra Nordix Artifactory compromise: single citable source, out of nexus.
• borderline-drop: Fakturownia and FELG Polish SaaS breaches: out of nexus.
• borderline-drop: SRG SSR employee-data incident (about 340 staff, 2020 contact data, no vector): below the incident floor.
• borderline-drop: GTIG AI-era vulnerability trends, Zscaler ThreatLabz ransomware report and Microsoft Digital Defense Report 2026: vendor statistics and generic recommendations, no change to what a responder does this week.
• borderline-drop: Microsoft MSP360 and ScreenConnect RMM abuse (2026-09-29): well-understood pattern, out of window, comparable entries exist.
• borderline-drop: OX Security LiteLLM CVE-2026-93355: unpatched but no exploitation and no nexus.
• borderline-drop: UK AISI Astra simulation report: simulation only.
• borderline-drop: NeedyMantis (Microsoft, 2026-09-28): out of window, limited-victim post-compromise malware.
• borderline-drop: DomainTools analysis of the Spetsvuzavtomatika leak: capability intelligence from a criminal-market archive with no observed use.
• borderline-drop: WatchGuard AP and Fireware 2026-09-28/29 releases: no exploitation, adjacent or LAN prerequisites; the store holds no entry for the release (S1 flagged it for the audit).
• borderline-drop: Armatura One CISA ICS advisory: no constituency footprint shown; Pentagon DMDC 3.1 million reporting: consistent with the existing entry's counts.
• out-of-window: ENISA Threat Landscape 2026 (published 2026-09-22) and elttam's tac_plus pre-auth RCE research (published 2026-09-23, no CVE yet); elttam-blog was added as a candidate source.
• Single-source: the FortiMail entry (Fortinet's own advisory, Admiralty A2); UAT-11587 (Talos, B2, original vendor telemetry); Adobe Campaign Classic (Adobe is the only assessor, A2). single-source-victim: Belnet, Stadt Wien and FTAPI rest on the victim's own statement; single-source-national-cert: the ANSSI report.
• Contradiction: the Adobe CVE record for CVE-2026-75703 describes arbitrary code execution while the bulletin table gives application denial-of-service; the entry follows the CVE record and says so. The Zimbra 10.1.20 release date differed between a news article (2026-07-21) and Zimbra's own page (2026-07-20); the update follows Zimbra's page and corrects the earlier entry. The SDIS campaign's earlier statement that SDIS du Gard was the only confirmation was superseded by the SDIS 66 confirmation.
• Coverage gaps: inside-it-ch (essential; S2 again got the Vercel checkpoint 429 on extract, direct and the reader for article pages and read only RSS teasers, while a later bridge url probe on one article was served through the reader fallback, so the route is intermittent); golem-security (article pages return a cookie wall; heise carries the same stories); ncsc-ch-incidents and enisa (listings are undated, per-item dates need one fetch each); cybercrimepolice-ch (no dated listing reachable); searchlight-cyber and kela-cyber (listings carry no usable article list or only promo banners); europol-newsroom (article pages are a JavaScript shell, the police-partner release carried the text); bsi-de (the RSS cap of 250 items hides the first hours of a 50 h window); sentinellabs (no in-window item). Recipe changes from the sub-agent reports are applied in sources_changed[] (chrome-releases now reads through extract, unit42 through its feed, github.com reads again).
• Essential-coverage: none missed; every essential record was attempted.
• The jina reader served three fetches (the DIVD case page, Cybernews and one Inside IT probe); the credential pool was otherwise not needed, and extract covered the rest.
• Candidate sources: ten added, each with its reason in sources_changed[]: divd-csirt, news-admin-ch, apa-ots, next-ink, borncity, elttam-blog, joomla-security-centre, watchguard-psirt, zimbra-security-advisories and ibm-support-security-bulletins. srf-news and esentire met the three-run promotion bar from the state digest and are now active. Not added: DomainTools Investigations (its one item was dropped and its research page is a JavaScript shell).
• Store observations for the next audit: S1 reports the WatchGuard 2026-09-28/29 CVEs have no store entry (dropped here as a regular patch cycle); FU1 reports NCSC-NL prose and the CVE entry disagree on CVE-2026-75745 (9.8 against 10.0), which no entry cites; the older Zimbra entry still carries the retired update_of key.
• Watchlist: none configured (the supplier and product sweeps are no-ops for this deployment).
• Source-URL liveness: the gate's own check got HTTP 403 (user-agent filter) from three Kiteworks GitHub advisory pages added after verifier iteration 1 (GHSA-h669-jj53-h764, GHSA-rwpq-5xfv-54pv, GHSA-q76w-qv9j-q639); each was read in full through extract and the copies are under work/2026-10-02T0404Z-intel/bodies/.
• Declined verifier findings, with reasons (also on the iteration record): the SDIS 66 development stays an update on the campaign entry (ICI itself frames it as following SDIS du Gard by a month; the update says no source links the two); the Kiteworks priority stays high (an unauthenticated CVSS 10.0 chain to root in the vendor's gateway after a law-enforcement-prompted shutdown warning); the UNCTAD entry keeps the reader-proxy class and not the product name (the reader-text check flags the name).
• Further verifier declines after iteration 2: Adobe Campaign Classic stays a notable entry (a distinct bulletin and CVE set, ten unauthenticated CVSS 10.0 flaws in an on-premise server; the earlier Campaign Classic entries cover other bulletins) and the Kiteworks priority rationale no longer cites the law-enforcement warning.
• Verifier cap: iteration 8 returned NEEDS_FIXES (truth 3, editorial 1, all low confidence except the missed-angle finding on the Apple proof of concept), so the loop ended at the cap with a residual count of 4 and no double-CLEAN. The remediations of iteration 8 were applied before commit. The Apple CoreGraphics update was added in response to that finding after the last verifier pass; the main agent read the Hacker News page in full and the gate confirmed its two evidence quotes verbatim, but no independent verifier read the update, so the next quality audit should give that entry's new section an independent pass.