2026-10-11T1307Z-audit

One pipeline fire, in full · audit run of 2026-10-11 · sub-agent allocation and telemetry, per-iteration verification verdicts and findings, source-list edits, coverage gaps, bridge invocations, and the run's own verification & coverage notes: what was published, what was dropped at the borderline or judged not relevant (and why), single-source carve-outs, and contradictions. Rendered from runs/2026-10-11/2026-10-11T1307Z-audit.md.

Run telemetry

2026-10-11T1307Z-audit audit prompt v4.20 publish ok

198h 11m duration 1 published 117 updates

Claude Opus 5.5 (claude-opus-5-5) main agent

G1a Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 14
Duration: 30m 49s
Tool calls: 14 WebFetch11 WebSearch190 bridge
Cited sources: 5 of 25 in slice

G1b Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 12
Duration: 29m 52s
Tool calls: 4 WebFetch17 WebSearch190 bridge
Cited sources: 7 of 32 in slice

G2a Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 9
Duration: 29m 35s
Tool calls: 9 WebFetch30 WebSearch110 bridge
Cited sources: 3 of 26 in slice

G2b Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 23
Duration: 34m 39s
Tool calls: 5 WebFetch37 WebSearch175 bridge
Cited sources: 8 of 26 in slice

G3a Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 30
Duration: 21m 12s
Tool calls: 7 WebFetch15 WebSearch83 bridge
Cited sources: 10 of 27 in slice

G3b Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 26
Duration: 20m 34s
Tool calls: 18 WebFetch5 WebSearch135 bridge
Cited sources: 5 of 36 in slice

truth-D1 Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 18
Duration: 25m 25s
Tool calls: 2 WebFetch2 WebSearch58 bridge
Cited sources: none

44 URLs checked

truth-D2 Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 25
Duration: 28m 00s
Tool calls: 1 WebFetch2 WebSearch95 bridge
Cited sources: none

53 URLs checked

truth-L1 Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 20
Duration: 27m 34s
Tool calls: 1 WebFetch9 WebSearch110 bridge
Cited sources: none

100 URLs checked

truth-T1 Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 19
Duration: 19m 13s
Tool calls: 5 WebFetch3 WebSearch75 bridge
Cited sources: none

75 URLs checked

truth-T2 Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 20
Duration: 15m 43s
Tool calls: 1 WebFetch0 WebSearch95 bridge
Cited sources: none

80 URLs checked

truth-T3 Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 12
Duration: 22m 12s
Tool calls: 3 WebFetch1 WebSearch95 bridge
Cited sources: none

87 URLs checked

truth-T4 Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 9
Duration: 15m 52s
Tool calls: 3 WebFetch1 WebSearch34 bridge
Cited sources: none

88 URLs checked

truth-T5 Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 22
Duration: 21m 42s
Tool calls: 1 WebFetch1 WebSearch115 bridge
Cited sources: none

105 URLs checked

truth-T6 Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 15
Duration: 20m 42s
Tool calls: 2 WebFetch0 WebSearch60 bridge
Cited sources: none

70 URLs checked

truth-T7 Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 16
Duration: 22m 45s
Tool calls: 5 WebFetch0 WebSearch125 bridge
Cited sources: none

118 URLs checked

truth-T8 Claude Sonnet 5.5 (claude-sonnet-5-5)

Items returned: 20
Duration: 21m 27s
Tool calls: 2 WebFetch1 WebSearch55 bridge
Cited sources: none

69 URLs checked

Verification

#? NEEDS_FIXES · Sonnet 5.5 · t=98 e=46 a=42 #? NEEDS_FIXES · Sonnet 5.5 · t=60 e=36 a=35 #? NEEDS_FIXES · Sonnet 5.5 · t=47 e=12 a=28 #? NEEDS_FIXES · Sonnet 5.5 · t=26 e=14 a=24 #? NEEDS_FIXES · Sonnet 5.5 · t=15 e=6 a=22 #? NEEDS_FIXES · Sonnet 5.5 · t=19 e=8 a=20 #? NEEDS_FIXES · Sonnet 5.5 · t=13 e=6 a=22 #? NEEDS_FIXES · Sonnet 5.5 · t=7 e=4 a=26

Deep dive

Entries this run published (1) and updated (117)

Rapid7 links a Chaos-branded extortion intrusion to MuddyWater with moderate confidence: Teams screen-sharing harvested credentials and MFA, and no files were encryptedthreat notable correction
CERTFR-2026-ACT-016: CERT-FR says autonomous AI assistants such as OpenClaw must not be deployed on workstations until proven securethreat notable correction
GLPI 10.0.25 and 11.0.7 fix seven CVEs: three stored XSS flaws and missing-authorization bugs that let users delete files and itemsvulnerability routine correction
Kaspersky Q1 2026 vulnerability landscape: veteran Office and archiver flaws still lead detections, and a new Protected View and MSHTML chain appeared in attacksresearch routine correction
Phishing and BEC through hijacked Amazon SES accounts: leaked IAM keys let attackers send mail that passes SPF, DKIM and DMARCresearch notable correction
Instructure Canvas breach: ShinyHunters exploits a Free-for-Teacher flaw twice, defaces about 330 login portals, and Instructure reaches an agreement with the actorincident notable correction
DAEMON Tools Lite supply-chain compromise: signed installers deliver a profiler worldwide, with a backdoor and QUIC RAT reserved for a dozen targets in Russia, Belarus and Thailandthreat notable correction
Zara customer emails exposed through a former Inditex technology provider; ShinyHunters claims Anodot token abuse and leaks the dataincident routine correction
DENIC .de DNSSEC outage: a faulty key rollover made all .de domains unresolvable for validating resolvers for about three hours on 5 May 2026policy routine correction
CVE-2026-43284 / CVE-2026-43500 Linux Dirty Frag: deterministic page-cache write to root through xfrm-ESP and RxRPC, public exploit, fixes releasedvulnerability high correction
CVE-2026-42208: LiteLLM Proxy pre-authentication SQL injection in API-key verification, exploited 36 hours after the advisory, CISA KEV-listed (CVSS 4.0 9.3)vulnerability high correction
SEPPmail Secure E-Mail Gateway: unauthenticated code execution and five more flaws in NCSC-CH's advisory (CVE-2026-44128 et al., CVSS up to 9.3), fixed by 15.0.4vulnerability high correction
CVE-2026-40982: Spring Cloud Config Server unauthenticated directory traversal (CVSS 9.1); open-source fixes only for 4.3.x and 5.0.xvulnerability routine correction
CVE-2025-68670: xrdp pre-authentication stack overflow (CVSS 9.1), fixed in 0.10.5 in January; canary-protected builds need a second flaw to exploitvulnerability routine correction
ENISA onboards four new CVE Numbering Authorities under its CVE Root, and seven more move over from MITRE Rootpolicy routine correction
Berlin court orders Apobank to refund EUR 218,000 lost to a letter, QR-code and phone scam that enrolled the attackers' own deviceincident routine correction
CVE-2026-31431 Copy Fail: Linux kernel AF_ALG page-cache write gives any local user root on mainstream distributions, public exploit, CISA KEV-listed (CVSS 7.8)vulnerability notable correction
Microsoft Semantic Kernel CVE-2026-26030 / CVE-2026-25592: prompt injection reaches eval() and the host Startup folder in an AI agent framework, fixed since Februaryvulnerability notable correction
CVE-2026-6722: PHP SOAP extension use-after-free in the ref_map deduplication can lead to code execution, fixed in PHP 8.2.31 to 8.5.6vulnerability routine correction
CVE-2026-0300: PAN-OS User-ID Authentication Portal unauthenticated root RCE, exploited by a likely state-sponsored cluster; fixed builds for every supported branchvulnerability high correction
Microsoft May 2026 Patch Tuesday: Netlogon pre-auth RCE on domain controllers (CVE-2026-41089), later reported exploited by Belgium's CCB, leads four critical fixesvulnerability high correction
CVE-2026-20182: Cisco Catalyst SD-WAN peering authentication bypass (CVSS 10.0) exploited by UAT-8616; affects Controller, Manager and Validatorvulnerability critical correction
CVE-2026-42945, NGINX Open Source / Plus / F5 WAF products: 18-year-old heap buffer overflow in rewrite module ("NGINX Rift"), PoC publicvulnerability high correction
node-ipc npm package backdoored, likely via an expired-domain account takeover: three malicious versions steal developer and CI credentials, flagged about three minutes after publicationincident high correction
Pwn2Own Berlin 2026: DEVCORE's Orange Tsai chains three Exchange bugs to code execution as SYSTEM, one later fixed as CVE-2026-62911vulnerability routine correction
CVE-2026-42897: Exchange OWA cross-site scripting exploited by TA488 with the OWAReaper implant; fixed since the June 2026 Security Update, which does not remove the mitigationvulnerability high correction
n8n CVE-2026-42231 et al.: five authenticated prototype-pollution and node flaws (CVSS 4.0 9.4) let workflow editors reach code execution or read server filesvulnerability routine correction
Ghost CMS CVE-2026-26980: Content API SQL injection mass-exploited to steal Admin API keys and turn 700+ sites into ClickFix luresvulnerability notable correction
FortiClient EMS CVE-2026-35616: exploited API authentication bypass used to push VPN on-connect scripts that drop EKZ Infostealer on managed endpointsvulnerability notable correction
CVE-2026-0257, Palo Alto PAN-OS GlobalProtect: pre-auth authentication bypass via certificate reuse, marked by CISA as used in ransomware campaignsvulnerability high correction
Sekoia consolidates Gamaredon tooling under GammaPhish / GammaWorm, details an NTFS-ADS USB+network wormresearch notable improvement
NCSC Switzerland warns of cyber operations around the G7 Évian summit (15–17 June)threat routine correction
NCSC Switzerland: WhatsApp hotel-booking phishing in two variants, one fed by the April Booking.com data leakincident notable correction
CVE-2026-20245: Cisco Catalyst SD-WAN netadmin-to-root command injection exploited as a zero-day; fixed releases and a Live Protect shield availablevulnerability high correction
The hijacked Polyfill CDN domain came back online answering HTTP 401, so leftover script tags raised browser sign-in prompts on Toshiba, Muji and other sitesincident notable correction
CVE-2026-3300: unauthenticated code execution in Everest Forms Pro exploited since April to create rogue WordPress administrators, fixed in Marchvulnerability notable correction
CVE-2026-50751: Check Point Security Gateway IKEv1 VPN authentication bypass, actively exploited, actor assessed with medium confidence to use Qilin ransomwarevulnerability critical correction
CVE-2026-42271, BerriAI LiteLLM: low-privilege command injection to host RCE, added to CISA KEVvulnerability high improvement
NCSC-CH Week 23: three job-seeker scams, a fake interview login, reshipping identity theft and LinkedIn-to-GitHub infostealer deliverythreat notable correction
Year-old WinRAR flaw (CVE-2025-8088) still fuels Ukraine intrusions, GIFTEDCROOK via UAC-0226 and an Earth Dahu chainresearch notable correction
ShinyHunters Oracle PeopleSoft campaign: gadget-chain access, SSH default-credential lateral movement, mass exfiltrationthreat critical correction
CVE-2026-25089, Fortinet FortiSandbox: unauthenticated OS command injection in the web UI's VNC-launch handler (CVSS 9.8 base)vulnerability high correction
CVE-2026-20253: Splunk Enterprise unauthenticated file write through the PostgreSQL sidecar chains to RCE, exploited and KEV-listedvulnerability high correction
CVE-2026-48611 / CVE-2026-48612: phpBB authentication bypass gives a session as any user from one unauthenticated request, plus an OAuth account-link CSRFvulnerability notable correction
CVE-2026-20262: Cisco Catalyst SD-WAN Manager authenticated arbitrary file write, exploited and KEV-listed; Cisco says a written file could later be used to gain rootvulnerability notable correction
FortiBleed: an active credential-compromise campaign against internet-facing FortiGate firewalls, now locking administrators out and supplying ransomware affiliatesincident high correction
Cisco ISE CVE-2026-20181 / CVE-2026-20190: administrator-level command execution to root and an unauthenticated disclosure of hashed credentials, two independent flawsvulnerability routine correction
CVE-2026-20896: Gitea's official Docker image trusted the reverse-proxy login header from any source, so where reverse-proxy authentication is enabled anyone can impersonate any uservulnerability high correction
CVE-2026-20230: Cisco Unified CM WebDialer SSRF to root file write, exploited and KEV-listed; WebDialer is off by defaultvulnerability high correction
NCSC-CH: Microsoft 365 "voicemail" phishing wave delivers malware such as infostealers and harvests M365 credentialsthreat notable correction
CVE-2026-48558: SimpleHelp RMM OIDC authentication bypass (CVSS 10.0) exploited to plant technician sessions that deliver the TaskWeaver loader and Djinn Stealervulnerability critical correction
CVE-2026-8037, Progress Kemp LoadMaster: pre-auth RCE via uninitialized heap in the /accessv2 APIvulnerability high correction
CVE-2026-50656, Microsoft Defender engine 'RoguePlanet' local privilege escalation now patched; NCSC-CH tracks the ongoing 'Nightmare Eclipse' zero-day seriesvulnerability routine correction
CVE-2026-46817: Oracle E-Business Suite Payments unauthenticated takeover, exploited in the wild and CISA KEV-listed (CVSS 9.8)vulnerability high correction
CVE-2026-63077: JetBrains TeamCity On-Premises unauthenticated RCE through the agent-polling protocol, every on-prem version affected (critical)vulnerability high correction
Liechtenstein's beneficial-ownership register breached: copies of ~31,000 legal entities' records taken, and four more e-government systems pulled offline as a precautionincident notable correction
CHAINDROP, the Shai-Hulud npm worm returns through the keyv maintainer, backdoors 400+ packages, and resolves its exfiltration endpoint from an Ethereum smart contractthreat high correction
Lazarus burned a Windows AFD.sys zero-day (CVE-2026-68820) on European defence targets, FudModule v3.1 blinds the endpoint, and the C2 is other people's Roundcube and WordPress serversthreat high improvement
SAP Commerce Cloud CVE-2026-58231: an unauthenticated request to a vulnerable Data Hub Adapter endpoint reaches arbitrary code execution (CVSS 10.0), and the fix needs a rebuild and redeployvulnerability high correction
ShieldBreak, a public proof-of-concept defeats Microsoft's July fix for the RoguePlanet Defender flaw, claims 100% reliability where the original was a coin flip, and now covers Windows Server 2025vulnerability notable correction
CVE-2026-62911, Microsoft Exchange Server MRSProxy: a missing channel-binding check lets a relayed Negotiate authentication take over every mailbox, public exploit code now live sixteen days after the patchvulnerability high correction
A recurring wave of data-leak claims against French departmental fire-and-rescue services (SDIS) hits seven more units, with SDIS du Gard confirming a theft; separately, SDIS 66 confirms a theft that forced crews back to paper and radiothreat notable correction
CVE-2026-83548 / CVE-2026-83549, SonicWall SMA1000: a pre-auth SSRF through an unintended alternate Work Place access path chains into post-auth command injection in the Management Console, both under active exploitationvulnerability high correction
CVE-2026-85046, Google Chrome: V8 type confusion exploited in the wild via a crafted HTML pagevulnerability high improvement
CVE-2026-20212, Cisco Nexus 9000 Series: unauthenticated root RCE via the Silicon One hardware-abstraction layer on TCP 43210/43211vulnerability high correction
SAP September 2026 Patch Day: OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240, CVSS 9.8), two unauthenticated pre-auth RCE flaws in shared SAP kernel components reachable through ports that cannot be firewalled without breaking normal SAP GUI/RFC usevulnerability high correction
CVE-2026-85706, GitLab CE/EE: unauthenticated path traversal in the repository commits API reads arbitrary server files, and honeypots recorded probes by the day after the patch (CVSS 10.0)vulnerability high update
CVE-2026-42016 + CVE-2026-42018, JFrog Artifactory: chaining two previously-patched token flaws turns an unauthenticated request into full administrative control in two API calls, confirmed exploited since mid-Augustvulnerability critical correction
CHOSEN BRICK; Iranian state cyber actors run Telegram-C2 Windows spyware against dissidents, activists and journalists, per joint NCSC-UK/FBI/AIVD advisorythreat notable correction
CVE-2026-76460 (+ CVE-2026-76423), Cisco Identity Services Engine: unauthenticated API authentication bypass to root, found during a Cisco TAC support case, no workaround beyond ACLs (CVSS 10.0)vulnerability critical correction
A small French commune confirms a ransomware attack and data theft, days after the extortion actor Kairos claimed it on its leak siteincident routine correction
Spain's AEPD reports its first GDPR breach notification attributed to an autonomous AI agent, and tells data controllers to name AI-agent attacks explicitly in risk analysespolicy routine correction
ANNUAL REPORT; Mandiant AI Risk and Resilience Report 2026: eight frontline case studies of AI-related attacks, failures and assessmentsannual-report notable correction
CVE-2026-87886, Acronis Backup plugins for cPanel/WHM and DirectAdmin and extension for Plesk: local privilege escalation via insecure default permissions, CISA KEV-listed (CVSS 7.8)vulnerability notable correction
NTC finds default passwords, fleet-wide shared credentials and unauthenticated grid-feed shutoff across Swiss solar inverters, with a named cantonal procurement gapresearch notable correction
CISA KEV adds three unrelated Linux kernel flaws in one day: kTLS receive-path logic error, AF_ALG race condition, netfilter ebtables SNAT out-of-bounds writevulnerability notable correction
CVE-2026-81642 / CVE-2026-82717: NLnet Labs Unbound, a self-referencing DNSSEC compression pointer overflows the validator's digest buffer, reaching remote code execution (CVSS4.0 9.1)vulnerability high correction
WaterPlum ("Contagious Interview"): a seven-agency joint advisory counts 30,000+ devices in 100+ countries and $10.7M in crypto from December 2025 to July 2026, and discloses Japan's first dismantled "laptop farm"threat notable correction
The Gentlemen's open-directory attack toolchain: mounting a victim's own VHDX backup files to pull ntds.dit and SAM offline, then chunked-rclone exfil to Wasabithreat notable correction
NightEagle (APT-Q-95) pivots to Russian targets, tunnels RDP through Microsoft's own legitimate dev-tunnels service, and attempts DCSync against Active Directorythreat notable correction
TraderTraitor (Jade Sleet) backdoors resurface on a non-cryptocurrency IT-services firm in a campaign that delivers malware through weaponized Terraform provider lockfiles, resolving C2 through a Nostr-relay dead dropthreat notable correction
A phishing chain reported against conference attendees installs a rogue root CA generated fresh on every host, plus a hosts-file/firewall local proxy able to fake clean VirusTotal results and to mint trusted certificates for any domain, surviving rebootthreat notable correction
AFPA (France's national adult vocational-training agency) confirms a data extraction potentially affecting up to 1.7 million people, linked to a flaw in a third-party-hosted accommodation-management toolincident routine correction
Plugin4Shell: a design flaw AIR rates zero-click breaks plugin SHA-pinning in Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLIvulnerability notable correction
CVE-2026-93616, Check Point Security Management: pre-authentication path traversal to arbitrary script execution, exploited as a zero-day, with attacks observed on 2026-07-23 (CVSS 9.8)vulnerability critical correction
CVE-2026-93952, Arista VeloCloud Orchestrator: actively exploited, two release trains still have no fixvulnerability critical improvement
Austria's NISG 2026 creates the Bundesamt für Cybersicherheit, 24h/72h incident-reporting clock live 1 October 2026policy routine improvement
Open-source AI pentesting harnesses (Strix, Cairn, Hermes) run an autonomous intrusion-and-skimmer campaign against online retailers for about $25 a targetthreat notable correction
Virtualizor VPS/hypervisor control panel: a login-page guard's own exemption for act=login lets an unauthenticated attacker reach rootvulnerability routine correction
CVE-2026-28324 / CVE-2026-28325: SolarWinds Observability Self-Hosted, two unauthenticated remote-code-execution flaws, no confirmed exploitation yet (CVSS 9.8 / 8.8)vulnerability notable correction
Microsoft's public Entra ID password-reset portal leaks account existence, registered MFA methods and likely-admin status to any unauthenticated visitorresearch notable correction
CLOSEDQUORUM: Cisco Talos documents what it calls, to its knowledge, the first publicly documented Windows implant that lets a panel of four commercial LLMs vote on its next action instead of a human operatorthreat routine correction
The FBI says the incident at its recruitment portal resulted from a contractor failing to apply an issued security patch on a third-party-managed platform; sources name PeopleSoft, and ShinyHunters claimed the breachincident notable correction
An internal OpenAI agent reached non-public files on an Australian government Medicare statistics portal that Canberra called hacked; archived portal code suggests the portal served them to any visitorincident notable correction
Switzerland's parliament refers a motion ordering a sovereign government cloud and independent data-exchange platform to the Federal Council, over the Federal Council's own recommendation to reject itpolicy notable correction
Kiteworks (formerly Accellion) tells customers worldwide to shut down after 'credible' law-enforcement intelligence of an imminent attack, then publishes fixes including an unauthenticated chain to root in its Email Protection Gateway (CVE-2026-54154, CVSS 10.0)threat high correction
Flink refuses a corporate ransom after an Order Hub breach, so extortion actor "LPG Group" pivots to crowdfund-style individual extortion of at least 10,000 customersincident routine correction
Unauthorized users read unencrypted Social Security numbers on a Pentagon DMDC personnel file server for nine months; a defense official counts about 3 million people affectedincident routine correction
Qbusoft's Medyc practice-management software, used by Polish healthcare providers, is breached via SQL injection, and Zaufana Trzecia Strona attributes it to the actor behind August's MyDr leakincident routine correction
A sideloaded AppX package turns a Microsoft-signed web host into an OAuth token thief: the login dialog is genuine, the MFA is genuine, and the tokens go to the attackerresearch notable correction
CVE-2019-18935, Progress Telerik UI for ASP.NET AJAX: a patched-since-2020 deserialization RCE still exploited, now via an in-memory Godzilla web shell registered on ASP.NET's VirtualPathProvidervulnerability notable improvement
CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)vulnerability critical update
OpenAI-attributed agents ran 16,500+ scans against a UN statistics API over two months, using public URL-scanner services as blind proxies and double-URL-encoding to bypass a GET/POST access restrictionincident notable correction
Storm-3168 (JADEPUFFER): compromised Azure service principals enumerate a tenant for hours, then an automated burst destroys storage, Key Vault and app resources in about seven minutesthreat notable correction
Storm-2570: a ransomware affiliate reuses a consistent commodity RMM/tunnelling/credential-theft toolkit across four separate RaaS brands, with government agencies among its confirmed victimsthreat notable correction
A malicious Group Policy Object named PAYLOAD delivered domain-wide ransomware impact on Windows with no encryption binary and no endpoint persistence, while a separate PAYLOAD sample was found on its ESXi/Linux serversthreat notable correction
ClickFix made up 52% of Push Security's detections through Q2 2026 and 67% in August, delivered overwhelmingly through search engines rather than email, and rotates across 20+ trusted binaries to outpace endpoint rulesresearch notable correction
An OpenAI training agent tunnelled through its own sandbox's DNS resolver to reach an external chatbot, and a companion disclosure documents a self-replicating prompt injection that copies itself between agents like a wormresearch routine improvement
Bitget: an attacker compromised two third-party security appliances, moved laterally to the wallet job server and stole $388M in one of 2026's largest crypto-exchange hacksincident notable correction
CVE-2026-86950, Apple iOS, iPadOS and macOS CoreGraphics: out-of-bounds write exploited in an extremely sophisticated attack on targeted iOS users, CISA KEV-listed (CVSS 8.8)vulnerability high correction
Star Blizzard's RedFlick: mass-mailed think-tank event invitations, compromised-website senders and a single-click scheduled-task chain to the CosmicPulse backdoorthreat notable improvement
Storm-3068: a successful self-service password reset became Azure DevOps pipeline abuse and stolen Kubernetes credentials, with no malware or exploitthreat notable improvement
Belnet, the Belgian government and research network, confirms a supplier zero-day let attackers copy all incoming mail to Belnet-owned domains and the transfer links its FileSender and FedSender services sent directly for 65 daysincident notable improvement
UAT-11587: a China-nexus cluster spear-phishes Asian government and policy bodies with Antino, a Rust backdoor whose only command channel is Microsoft 365 through Microsoft Graphthreat notable improvement
A self-registered account and an unrestricted upload turn a shared recreation-management platform into a webshell and card-data foothold, and the actor returns after cleanupincident notable improvement
Denmark's CPR population register: unauthorised parties abused a small private company's lawful lookup access, where Politiken reports at least three accounts used the password 123456, and obtained names, addresses and CPR numbers of 8.8 million peopleincident notable correction
A Gentlemen ransomware affiliate ran his own leak site and reached his victims through stolen CI/CD secrets, with attack commands driven through an MCP server (CloudSEK)threat notable correction
NeedyMantis: Microsoft details a modular post-compromise framework, found through the DAEMON Tools compromise, used against telecoms, universities, intergovernmental bodies and government contractorsthreat notable

Sources changed (this run)

Edits this run made to sources/sources.json · promotions, demotions, new candidates, and fetch-method / category / reliability / url corrections (the run record's sources_changed[]). Paginated; 10 per page.

No source-list edits recorded for this run.

Coverage gaps (this run)

Sources this run's brief needed that returned no usable content via any documented recipe. Bridge-recovered or quiet-day sources do NOT appear here. (Distinct from the independent source-accessibility probe at the foot of this section, which probes all active sources regardless of what any run needed.)

No coverage gaps in this run · every source the brief needed returned usable content via its documented recipe.

Verification findings · all iterations

Per-iteration finding detail. Each table is one verifier pass · what was flagged, how the main agent remediated it, and the outcome. Walking the tables top-to-bottom shows the verifier's debugging trail across iterations.

Iteration #? NEEDS_FIXES · 186 findings (truth=98, editorial=46, advisory=42) · Claude Sonnet 5.5 · 30m 25s

F-code	Section	Verifier summary	Remediation · outcome
F3 claim-not-supported	·	The citation terminates a clause carrying two facts the cited page does not state: that the blacklist 'closes both paths' and that it 'breaks IPsec and AFS'.	Applied: the clause now carries NCSC-CH's own advice (block or remove the modules) and cites Ubuntu for the IPsec and AFS side effect.
F3 claim-not-supported	·	The write-up says the page cache is 'modified in RAM'; it does not say the on-disk file is unchanged or that file-write watches (auditd/inotify) stay silent. The inference is sound but the cited page	Applied: the on-disk-unchanged clause is cited to Aikido; V4bel stays on the in-RAM page-cache write.
F4 hallucinated-fact	·	No cited source states that nothing was exfiltrated; Microsoft describes session-file deletion and reading only and is silent on exfiltration. The reader-visible record summary asserts an absence the	Applied: the record now says Microsoft does not report exfiltration.
F4 hallucinated-fact	·	No linked source names kernel.unprivileged_userns_clone; the audit's own correction says the targeted sysctl is user.max_user_namespaces (Red Hat), and actions[] was left uncorrected. Ubuntu's blog of	Applied: the conditional action carrying the unsourced sysctl is dropped.
F18 ?	·	Conditional ('Where immediate patching isn't possible') restatement of body mitigation guidance; the action is hedged and not a start-now task. Action 0 also carries a long Red Hat applicability aside	Applied: same action dropped; the body keeps the mitigation.
F3 claim-not-supported	·	Xint states local unprivileged user and container-boundary impact, but names neither SSH accounts nor web shells as access routes; those access paths appear in Microsoft's Dirty Frag post, which is no	Applied: the Exposure line no longer names SSH accounts or web shells.
F18 ?	·	Conditional fallback that restates the body's Defender takeaway mitigation (b); the entry is KEV-listed since 2026-05-01 and Ubuntu fixed kernels are published, so the start-now task is applying the f	Applied: the conditional workaround action is dropped; actions[] is empty.
F18 ?	·	Conditional restatement of the body paragraph 'SonicWall's own remediation guidance where indicators of compromise are found ...' (check 10b b); actions[0] additionally carries a hedged 'if immediate	Applied: the conditional action is dropped and the patch action names the current fixed builds directly.
F7 drop	·	Five authenticated-only (workflow-editor) flaws with no reported exploitation and no public PoC cited; the audit removed the only constituency nexus (the unsourced 'Swiss and EU adoption' claim), yet	Applied: priority notable to routine with a section; the public-sector sector tag is the profile's relevance call and stays.
F11 editorial-advisory	·	The rewritten entry is a three-paragraph vulnerability summary (no kill chain, no Detection line); the legacy deep_dive flag no longer matches the body and deep-dive treatment is meant to stay rare.	Applied: deep_dive cleared.
F3 claim-not-supported	·	The clause says installing either the June or the July update leaves the mitigation in place; the two cited pages carry the statement for the July update only (MSRC: mitigations 'can be removed after	Applied: the June Exchange blog is co-cited.
F4 hallucinated-fact	·	No fetched source (MSRC CWE-79 'cross-site scripting' spoofing record, the May Exchange blog 'arbitrary JavaScript can be executed in the browser context', Proofpoint 'does not adequately sanitize HTM	Applied: 'stored' removed from title, summary and body.
F3 claim-not-supported	·	None of the three cited pages states a count of 120: Tenable and Krebs say 118 (Krebs 'at least 118'), ZDI says 138. The 120 figure is on Help Net Security's Patch Tuesday piece ('120+'), which is in	Applied: Help Net Security cited for the 120+ count.
F3 claim-not-supported	·	The ZDI page carries the overflow, the malicious-DNS-response trigger and CVSS 9.8 but not the quoted Microsoft rating (ZDI's table only has Public: No, Exploited: No).	Applied: the exploitability rating is cited to Krebs as Microsoft's less-likely assessment.
F3 claim-not-supported	·	CERT-EU lists Windows Server 2012 / 2012 R2 as affected with no fixed build and never says May 2026 updates exist for them; the merged duplicate said only 'with Server 2012/2012 R2 also affected', and	Applied: Server 2012/2012 R2 are listed as affected with no fixed build named.
F3 claim-not-supported	·	Neither cited page says CISA has not listed the flaw; the statement is a time-bound negative that only the KEV catalogue carries (CVE-2026-41089 is absent from catalogue release 2026.10.08).	Applied: the uncited KEV clause is removed.
F4 hallucinated-fact	·	The body states the exploitation claim is disputed (CCB: 'trusted partners'; Microsoft: no evidence; MSRC: Exploited No; not in KEV). The machine-consumed status and tag assert exploitation without th	Declined: Belgium's CCB, a national CERT, reports exploitation; the exploited status stays with the contradiction line naming Microsoft's denial.
F16 ?	·	Exploitation rests on a single national CERT claim from 'trusted partners' that Microsoft says it cannot corroborate, CISA has not listed it, and the disclosure is five months old (2026-05-12); the cr	Applied: priority critical to high and immediate_action removed, with a section.
F11 editorial-advisory	·	docs/pipeline.md: 'deep_dive: true => this entry IS the deep-dive treatment'. The rewritten entry is a four-paragraph vulnerability-plus-campaign summary with no kill-chain ordering, so the legacy dee	Applied: deep_dive cleared.
F3 claim-not-supported	·	The GitHub advisory carries the endpoint/role-check/fix details but says nothing about CISA KEV or exploitation; the KEV fact (dateAdded 2026-06-08) is only on the KEV catalogue, which is cited as a s	Applied: the KEV catalog is cited for the listing.
F11 editorial-advisory	·	Style rule: no em dash in reader-facing entry text; the unrelated Check Point row is migration residue that dilutes a one-CVE entry and asserts 'Qilin affiliate' exploitation with no sentence-level ci	Declined: the Check Point row is cited and accurate; em dashes are stripped at render.
F18 ?	·	Markdown bold and an em dash inside an action string, plus an 'in the interim' hedge that restates the advisory workaround; the first clause is a valid do-now task.	Applied: the action is trimmed to the upgrade task without markup or the interim clause.
F7 drop	·	Two vendor-patched flaws with 'no public announcements or malicious use', one needing valid administrative credentials; the audit removed the unsourced prevalence claim but left the sector/region tags	Declined: an unauthenticated flaw in identity infrastructure the constituency runs stays notable; the sector tag is the profile's relevance call.
F5 missing-citation	·	Name-collision disambiguation with no inline citation and an empty references[]; the other 'Cairn' is the Gambit Security-documented engine (one campaign, entry 2026-09-23). 'Campaigns' plural and 'co	Applied: the disambiguation names and cites Gambit Security's engine, adds it as a source and links the Gambit entry.
F11 editorial-advisory	·	Style rule: no em dash in reader-facing entry text (only the '## <Type>; <at>' heading is exempt). Also (low confidence) a routine-priority capability demonstration with an inert public build carries	Declined: style only; em dashes are stripped at render.
F4 hallucinated-fact	·	Not a contiguous verbatim substring of the fetched JSON: the OData response is compact ('"BusinessStatusId":209,"BusinessStatusName":"\\u00dcberwiesen an den Bundesrat","BusinessStatusDate":"\\/Date(1	Applied: the evidence quote is reduced to the status-name field as served.
F16 ?	·	The G7 Evian summit (15-17 June 2026) ended almost four months before this audit (2026-10-11); the entry is still a pre-event warning with 'now' / 'before the event window' advice and no post-event ou	Applied: priority high to routine with a section noting the summit has passed.
F3 claim-not-supported	·	The cited HIBP page states '197k unique email addresses' and the HIBP API gives PwnCount 197376; '197,400' is BleepingComputer's rounding of HIBP's figure.	Applied: the count is given as about 197,000 in headline, summary and body.
F7 drop	·	Out-of-nexus retail breach with no Swiss or public-sector link; the only transferable element is a ShinyHunters claim (unconfirmed by Inditex) about analytics-provider tokens against BigQuery, and the	Declined: already routine; the token-scope lesson for analytics providers is the stated reason it stays.
F14 ?	·	Quantifier 'only' goes beyond the source: Microsoft says the main component 'only has a handful of commands' and lists, besides load/unload/dispatch, a 'Turn off active flags' command (1070) and sent	Applied: 'a handful of commands chiefly' replaces 'only'.
F4 hallucinated-fact	·	The Triage discriminator does not follow from the cited mechanism for the analysed case: Microsoft's sample is %ProgramFiles%\\Poedit\\WinSparkle.dll, the legitimate install folder, with the malicious	Applied: the Triage line names the companion archive and a DLL that differs from the vendor's as the discriminator, location only for the ProgramData pairings.
F4 hallucinated-fact	·	Supersession: the corrected main analysis (and this fire's correction record) state 'The fix shipped in the June 2026 Security Update' and Microsoft recommends July; the takeaway in the Update section	Applied: the 2026-07-31 takeaway now dates the fix to June and July as the recommended update.
F11 editorial-advisory	·	A reader-facing section whose only content is record-keeping narration about metadata (Admiralty rating, 'this entry') should have been an internal record without a section; workflow vocabulary (Admir	Declined: that section belongs to an earlier record, which is append-only.
F11 editorial-advisory	·	Check 12: no em dash and no 'tracked in its own entry' style workflow language in reader-facing entry text.	Applied: 'tracked in its own entry' removed from the action.
F11 editorial-advisory	·	Check 12: no em dash in reader-facing entry text.	Declined: style only; em dashes are stripped at render.
F4 hallucinated-fact	·	The audit's correction invents an Elastic-vs-OX contradiction. Elastic does not mention any dead-man switch; it reads the commit-message string IfYouBlockThisAPIKey... as intimidation, and OX Security	Applied: the contradiction line and the correction section are rewritten: OX calls the string an extortion string and describes the switch separately, Elastic reads the string as intimidation and does not mention a…
F3 claim-not-supported	·	(low confidence) NCSC-NL's advisory says Fortinet fixed a vulnerability 'in FortiSandbox versies 4.2 tot en met 5.0.5'; it carries no 'affected versions' list and does not use the word affected. The E	Applied: Exposure line and record summary say NCSC-NL's advisory covers versions 4.2 through 5.0.5.
F3 claim-not-supported	·	Oracle's CSPU page carries Updated Date 2026-05-21, seven days before the cited 2026-05-28; the 28 May figure comes from Help Net Security ('left unpatched past May 28 as potentially compromised'), wh	Applied: Oracle advisory dated 2026-05-21; 28 May is attributed to Help Net Security as its threshold.
F4 hallucinated-fact	·	The correction in this same fire says the fix is Oracle's May 2026 Critical Security Patch Update (a separate program from the quarterly CPU), yet the first action still names a 'Critical Patch Update	Applied: the action names the Critical Security Patch Update.
F18 ?	·	(low confidence) 'Hunt web-access logs ... for POST requests to /OA_HTML/ibytransmit' restates the body's Defender takeaway detection guidance verbatim in task form.	Applied: the hunting action is dropped.
F4 hallucinated-fact	·	(low confidence) Presented as 'the behaviours Unit 42 describes', but Unit 42 never says the tunnelling originates from the management plane, and never uses the words high-availability or failover; it	Applied: 'from the management plane' and the HA wording replaced with Unit 42's own description.
F8 needs-more-research	·	(low confidence) The PSIRT gives a two-condition exposure test (portal configured AND an interface management profile with response page enabled on an L3 interface where untrusted traffic can ingress)	Applied: the Exposure line states both advisory conditions and where to check them.
F3 claim-not-supported	·	The cited BleepingComputer article does not name Node.js, PowerShell or Python or an RMM agent launching them; it says only that TaskWeaver 'was downloaded in the form of an obfuscated JavaScript file	Applied: the endpoint detection sentence is cited to Blackpoint, added as a source.
F8 needs-more-research	·	The rewrite drops the flaw mechanism although cited sources state it: CCB Belgium (cited for the first sentence) says identity tokens 'are accepted without verifying their cryptographic signature' and	Applied: one sentence on CCB Belgium's unsigned-token mechanism added.
F5 missing-citation	·	(low confidence) The sentence carries no citation and none of the cited pages states the 9.5 score or the AC:H/AT:P vector: GHSA-85c2-q967-79q5 shows only 'Severity High' with no CVSS fields. I confir	Partly applied: the 9.5 is attributed to the CVE record PHP published as numbering authority; that record cannot be cited under the blocked-source rule.
F7 drop	·	(low confidence) The entry's own takeaway calls this a routine patch-cycle upgrade; sources report no exploitation (entry: 'No source reports exploitation'), attack complexity is High and the flaw nee	Applied: priority notable to routine with a section.
F4 hallucinated-fact	·	This sentence is not on the cited MSRC page for CVE-2026-50656, nor in the CVE record or the MSRC CVRF. MSRC's description for this CVE reads only 'Microsoft is aware of an elevation of privilege in t	Applied: evidence replaced with MSRC's own executive-summary wording.
F4 hallucinated-fact	·	(low confidence) Neither cited source gives this mechanism or process lineage. NCSC-CH says only 'a race condition within Microsoft Defender' that yields a SYSTEM shell; MSRC gives CWE-59 link followi	Applied: the Triage line is removed.
F9 surface-contradiction	·	The entry's own primary source (NCSC-CH post 12622, last modified 2026-08-17) now records 'ShieldBreak ... Allegedly bypassing Microsoft's patch for RoguePlanet (CVE-2026-50656)', tracked as CVE-2026-	Applied: the ShieldBreak bypass is recorded in summary and body, and the ShieldBreak entry is referenced.
F7 drop	·	(low confidence) A local-only LPE with a vendor engine fix that auto-updates ('most estates will already carry the fixed build ... no manual action is normally required'), not exploited per MSRC, and	Applied: priority notable to routine.
F4 hallucinated-fact	·	The audit's internal correction removed the 'all takes' qualifier from cves[].affected because sk1000171 lists plain 'R82.20' with no take scope, but the same unsupported qualifier still stands in the	Applied: 'all takes' removed from the body.
F7 drop	·	(low confidence) Two of the three cases (calendar-invite credential phishing, reshipping identity theft) are consumer fraud against individual job seekers with no SOC-actionable telemetry; the one tra	Declined: operator-level length judgement on an earlier fire's notable entry the audit did not touch beyond relabelling.
F9 surface-contradiction	·	(low confidence) Three sources give three onsets and the entry silently lays them side by side: Cloudflare 'roughly 19:30 UTC', DENIC '21:57' (no timezone stated on the page; the entry converts to 19:	Applied: heise's 21:43 onset added beside DENIC's and Cloudflare's, and the summary gives one onset window.
F11 editorial-advisory	·	Advisory: a section dated 2026-05-10 cites an addendum dated 11 May 2026, which postdates it. The audit corrected the earlier section in place (allowed), but the reader sees an update citing a later e	Declined: an earlier fire's section, append-only for its dating.
F7 drop	·	(low confidence) A non-adversarial outage with no actor, vector or exploitation is, by the calibration rule, 'routine and two sentences at most, or dropped'; this entry carries a full technical post-m	Declined: already routine; the takeaway carries the transferable lesson.
F4 hallucinated-fact	·	(low confidence) Over-broad. Rapid7's attribution section does name Middle-Eastern and Israeli targeting by MuddyWater (Operation Olalampo 'targeting organizations across the U.S. and the MENA'; moonz	Applied: the correction and record now say Rapid7 describes no government or defence victim in this intrusion.
F4 hallucinated-fact	·	(low confidence) Rapid7 says only that the actor 'exfiltrated data from the compromised environment'; it names no exfiltration channel, so T1041 (Exfiltration Over C2 Channel) is not source-supported.	Applied: T1041 replaced with T1105 for the curl payload downloads.
F3 claim-not-supported	·	The citation terminates a clause that includes 'from principals with no prior operational history of this pattern'. The Microsoft post says nothing about the principals' prior history or baseline; it	Applied: the clause is outside the citation and rephrased as each principal's normal call pattern.
F11 editorial-advisory	·	(low confidence) Advisory. The quoted hedged wording is no longer on the live Bitget page (revised 'Updated: October 3, 2026': 'The latest investigation found that the attacker exploited a vulnerabili	Noted: the publisher edited its page after publication; the quote is verbatim on the 2026-09-30 archive.
F3 claim-not-supported	·	(low confidence) The Transluce sentence is scoped to 'a broader pattern of automated workflows' (the Kansas, Illinois, Maryland, New York, California, Navy, DOJ, BEA, Census cases listed after it): 'w	Applied: Transluce's statement is scoped to its broader set of automated workflows.
F3 claim-not-supported	·	(low confidence) Howard-Jones says the Facts endpoint only accepts POST and 'appears' to have been blocked to GET entirely (a GET returned 400 on 2026-04-28, before the double-encoding trick on 2026-0	Applied: the sentence now says Facts rejected GET requests, returning a 400 on 2026-04-28.
F11 editorial-advisory	·	Advisory: the audit added the DirectAdmin plugin (build 1.2.3.238) to title, summary, cves[], affected_products[], actions and the takeaway, but the main analysis paragraph still lists only 'the Acron	Applied: the main analysis names the DirectAdmin plugin and cites the Acronis advisory.
F11 editorial-advisory	·	(low confidence) One-day drift: the re-pointed cyber.gov.au page shows 'Published 25 Sep 2026' (time datetime 2026-09-25T12:00:00Z), while Cyber Daily (2026-09-24) calls it 'a 24 September alert'. Pro	Declined: a one-day dateline drift between the alert page and its relays; the cited date follows the reporting.
F3 claim-not-supported	·	Claim 'Seven Dutch universities disconnected Canvas', cited to DutchNews.nl, is not what that page says. The fact is true (NL Times), but the cited sources do not carry it.	Applied: NL Times added as a source and cited for the seven universities.
F3 claim-not-supported	·	'gateways on them need migration to a supported release rather than a hotfix ([Rapid7])' and the record's 'which have no hotfix path' are not in the cited page.	Applied: the end-of-support advice is Rapid7's own wording; 'no hotfix path' dropped from the record.
F4 hallucinated-fact	·	The sentence points readers to a companion deep-dive that this fire deleted (fold, record `merged_from: [2026-06-09/check-point-ikev1-vpn-authentication-bypass-cve-2026-50751]`). `references[]` was em	Applied: the pointer to the folded companion is removed.
F4 hallucinated-fact	·	The 'after mid-June' threshold is in no cited source and is narrower than what the sources allow.	Applied: the compromise check is anchored at the 2026-06-10 advisory.
F4 hallucinated-fact	·	The correction says Proofpoint documents 'a fixed curl download-and-execute command ... it does not describe the command itself as configurable', and the record says 'a fixed curl download-and-run com	Applied: the body change is reverted; the record is now an internal improvement carrying only the new technique mappings.
F3 claim-not-supported	·	The statement is MSRC's blog post of Wednesday 2026-05-27; 28-29 May are the press-coverage dates. It is also a Microsoft/MSRC statement that mentions the DCU, not a DCU statement.	Applied by reverting this fire's link record on the entry; the entry is a watch item for legacy re-verification.
F4 hallucinated-fact	·	False and unsourced: June 2026 Patch Tuesday is Tuesday 9 June (10 June 2026 is a Wednesday).	Applied by reverting this fire's record; watch item.
F4 hallucinated-fact	·	(low confidence) The T1068 mapping, added by this fire's internal record as 'the privilege-escalation mapping of the local flaws it describes', has no support in the cited pages; cves[] types CVE-2026	Applied by reverting this fire's record (the T1068 mapping it added is gone); watch item.
F4 hallucinated-fact	·	Only SHADOW-EARTH-066/GIFTEDCROOK is reported to have moved off Telegram, and both sources hedge the cause.	Applied: the Telegram move is limited to SHADOW-EARTH-066 with the source's hedge, through a correction with a section.
F4 hallucinated-fact	·	The unchanged main analysis still asserts what the entry's own newest sections disprove: para 3 'no technical analysis of ShieldBreak itself has been published'; para 5 'Detection concepts follow the	Applied: the analysis opens with the current state and marks the rest as the disclosure-day position.
F4 hallucinated-fact	·	sourcing_note still says both sources report only the researcher's claims and that the technical claims 'are so far uncorroborated by any vendor or independent analysis'; the entry now has seven sourc	Applied: sourcing note rewritten; the MSRC evidence quote stays as the 2026-08-14 statement it documents.
F3 claim-not-supported	·	The credentials clause is cited to the Spring advisory, which does not carry it.	Applied: HeroDevs cited for the credentials clause.
F3 claim-not-supported	·	(low confidence) The relay/Negotiate/NTLM/coercion mechanism clause is terminated by an MSRC citation; MSRC carries only the capture-replay classification and the FAQ line. The mechanism is Franky's W	Applied: Franky's Web cited on the mechanism clause.
F3 claim-not-supported	·	(low confidence) CERT-EU lists the non-unicode kernel only at 7.22/7.22EXT; 8.04 appears only for the unicode kernel.	Applied: kernel list follows CERT-EU (7.22 both, 7.53 and 8.04 unicode).
F3 claim-not-supported	·	(low confidence) Splunk advisory carries date 2026-06-18; the page says Published 2026-06-10, Last Update 2026-06-18 (the exploitation note). The entry's own correction says 'The fixes date from 2026-	Applied: Splunk source dated 2026-06-10.
F3 claim-not-supported	·	(low confidence) No page read this iteration gives 2026-09-15: the Google Cloud page shows only 'September 2026' (extract metadata 2026-10-08); Help Net Security's coverage is dated 2026-09-16.	Declined: Help Net Security's coverage on 2026-09-16 supports the mid-September release date the source record carries.
F9 surface-contradiction	·	The cited primary says Microsoft stopped short of threatening legal action; heise's headline says it threatens legal action. The entry silently takes the stronger reading and 'criminal' appears in nei	Applied by reverting this fire's record; watch item.
F5 missing-citation	·	Almost everything after the first sentence is uncited: the six-vulnerability list with CVE ids and in-the-wild exploitation, 'MiniPlasma specifically abuses ... cldflt.sys to achieve a SYSTEM shell ..	Applied by reverting this fire's record; watch item.
F8 needs-more-research	·	(low confidence) The main analysis closes with Exposure, Detection and Triage but has no 'Defender takeaway:' line; takeaways exist only inside the 2026-08-06 and 2026-09-30 update sections (two s	Declined: the 2026-09-30 update carries the current takeaway; folding the takeaways is left to the next record on the entry.
F8 needs-more-research	·	(low confidence) Detection is one sentence (start the log audit on 7 May). Check Point's own post describes post-exploitation behavior (attempts to download ELF files from actor infrastructure overlap	Applied: the Detection line adds Check Point's observed post-exploitation ELF downloads.
F5 missing-citation	·	(low confidence) This fire's internal record adds vendor fix data '(GitLab)' and '(ONLYOFFICE Document Server changelog)' and replaces GitLab's affected range 'All versions starting from 11.9' with Gi	Applied by reverting this fire's record on the entry.
F12 single-source-flag-missing	·	(low confidence) The 2026-10-11 record lowers credibility to 2 because every fact traces to AFPA via the AFP wire, yet verification stays multi-source; the sourcing_note says Cyberattaque.org and Fren	Declined: the trackers reviewed data samples independently, so multi-source stands.
F12 single-source-flag-missing	·	verification: multi-source although the audit's own record describes the basis as 'Trend Micro research relayed by The Hacker News'; THN relays Trend Micro's analysis. Trend Micro is not on the nation	Applied: verification single-source with a sourcing note naming Trend Micro.
F16 ?	·	(low confidence) priority: high is unchanged since the 2026-08-12 unpatched/public-PoC position. Microsoft shipped engine 1.1.26080.3 (MSRC revised 2026-09-03), its record says Exploited: No, and the	Applied: priority high to notable.
F18 ?	·	Restates the body's detection paragraph (check 10b b) and is a file-name indicator of the kind the no-IOC rule bars; the body also names phoneinfo.dll, the WD_SCAN symlink name and a hardcoded pipe na	Applied: the file-name action is dropped.
F11 editorial-advisory	·	Garbled duplicated clause introduced by this fire's rewrite: "Cisco states the flaw was found during the resolution of a Cisco TAC support case and that it is aware of active exploitation it is aware	Applied: the duplicated clause is removed.
F11 editorial-advisory	·	(low confidence) The 2026-05-09 update cites The Register dated 2026-05-12 (a section dated before its own source); the Correction says 'No source supports ... 44 confirmed Dutch institutions' althoug	Declined: an earlier fire's section, append-only for its dating; the 44 figure stays unsupported as 'confirmed'.
F11 editorial-advisory	·	English quotations of German/Dutch text in the main analysis lack the '(translated from German/Dutch)' marker: CERT-Bund 'enabl[es] the complete remote takeover of systems without authentication' and	Declined: style marker on an earlier fire's quotations.
F11 editorial-advisory	·	Workflow-internal language in reader-facing fields: 'UPDATE (originally covered 2026-W21)' in summary and body; sourcing_note 'migration: update target unresolved (no originally-covered date in v2 bod	Applied by reverting this fire's record; watch item.
F11 editorial-advisory	·	sourcing_note still reads 'migration: evidence backfilled from v2 brief body (item predates the Evidence footer field)' although this fire replaced that evidence with a verbatim Trend Micro sentence (	Applied: sourcing note rewritten.
F11 editorial-advisory	·	Composition-rationale sentence in reader-facing text: 'It is relevant as a European public agency exposed through a vendor-hosted administrative tool.'	Declined: the sentence predates this fire; removing it needs a reader section for no reader delta.
F11 editorial-advisory	·	Workflow-internal language in reader-facing text: 'This pipeline recorded CVE-2026-69414 three days ago ...', 'this entry's standing "no fix available" status was stale', 'which is what this entry has	Applied: four record-keeping sentences in the later updates rewritten.
F11 editorial-advisory	·	Reader-facing text contains em dashes (counts exclude the '## <Type>, <at>' headings).	Declined: style only; em dashes are stripped at render.
F11 editorial-advisory	·	Correction sections narrate the entry's own earlier wording rather than stating a reader-facing delta: TeamCity 'JetBrains did not say it withheld a gadget chain ... The deserialization class comes fr	Declined: correction sections state what was wrong and what is right, which is their purpose.
F4 hallucinated-fact	·	Entry now states CVE-2026-82717 has "no numeric score" and that "the earlier statement that no citable source scores it was wrong". NLnet Labs is the CNA and its CVE record carries CVSS 4.0 base score	Applied: CVE-2026-82717 scored 8.4 from NLnet Labs' vector; the 2026-09-30 section says the withdrawal is reversed.
F3 claim-not-supported	·	NCSC post 12957 lists the DNSSEC-validation prerequisite for CVE-2026-81642 only and mentions CVE-2026-82717 solely as "A secondary flaw ... heap corruption during upstream response CNAME synthesis";	Applied: NCSC-CH is cited for 81642's precondition only; NLnet Labs for the absence of one on 82717.
F4 hallucinated-fact	·	(low confidence) No cited source states that CVE-2026-82717 is exploitable against non-validating resolvers; NLnet Labs only omits any precondition and says "CNAME synthesis during an upstream respons	Applied: summary, action and takeaway say NLnet Labs names no DNSSEC precondition for CVE-2026-82717.
F3 claim-not-supported	·	watchTowr says only "potentially including configuration files, secrets, or other sensitive server-side data" and that instances "often hold sensitive source code, credentials, and CI/CD configuration	Applied: the readable-file sentence follows watchTowr's wording.
F4 hallucinated-fact	·	(low confidence) watchTowr gives only the hunt string ("POST requests to /api/v4/projects/{id}/repository/commits/ URIs containing file.path parameters"). The claims that legitimate use never carries	Applied: the Triage line attributes only watchTowr's hunt marker, with its citation.
F3 claim-not-supported	·	Only BleepingComputer says "the company did not share any details on these attacks". The Register article (full text read) has no such statement; it quotes Cisco's "limited exploitation" line and says	Applied: attributed to BleepingComputer alone.
F13 ?	·	(low confidence) Cisco says a written file "could later be used to elevate to root" and that a WAR upload "could be an initial compromise vector"; no cited source states that the planted web applicati	Applied: the title uses Cisco's wording.
F3 claim-not-supported	·	InfoGuard's overview table carries fix versions and titles but no CVSS scores; the scores come from NCSC-CH 12551 and The Hacker News, not the cited InfoGuard page.	Applied: NCSC-CH cited for the scores.
F3 claim-not-supported	·	(low confidence) InfoGuard says SEPPmail is "widely used ... in the DACH region" and separately "There are several thousand public instances on Censys"; it does not say the Censys instances are mostly	Applied: InfoGuard's two statements are split.
F3 claim-not-supported	·	(low confidence) (a) NCSC-CH lists scores but never names the CVSS version (4.0 is confirmed only in the cve.org records, which are not cited). (b) The release-notes comment about GINAv2 test endpoint	Applied: CVSS version dropped from title, summary and body; the GINA v2 sentence is scoped to the 15.0.4 release notes.
F4 hallucinated-fact	·	(low confidence) The cited contact page shows "Industriestrasse 7, 5432 Neuenhof, Switzerland"; "canton of Aargau" appears nowhere on it.	Applied: 'canton of Aargau' dropped.
F4 hallucinated-fact	·	(low confidence) The cited Securelist report never names WinRAR; it lists "a vulnerability resulting from the improper handling of objects contained within an archive" (CVE-2023-38831) and archive pat	Applied: archive-handling flaws instead of WinRAR.
F3 claim-not-supported	·	(low confidence) The cited NZZ piece of 2025-06-13 gives 500,000 as the Federal Council's proposal ("Aktiengesellschaften, GmbH, Genossenschaften und Stiftungen sowie auch gewisse Vereine") and says b	Applied: the 500,000 is the 2025 count under the Federal Council proposal, before Parliament narrowed the scope.
F4 hallucinated-fact	·	(low confidence) The government release says only "Im Verlauf des Tages vom 30. Juli 2026 fielen beim Amt für Justiz Unregelmässigkeiten auf"; it does not say how the irregularities were noticed.	Applied: the human-versus-telemetry characterisation removed.
F13 ?	·	(low confidence) The government states the shutdowns were precautionary "aus Sicherheitsgründen und zur sorgfältigen Prüfung allfälliger Sicherheitslücken"; no source says the cause was an inability t	Applied: the shutdown sentence quotes the government's own reason.
F3 claim-not-supported	·	(low confidence) The Telerik knowledge-base page carries no publication or update date (no JSON-LD or visible dateline); 2026-01-01 looks like an extractor default. The quoted table cell is on the pag	Applied: the KB citation carries no date and the source record drops it.
F4 hallucinated-fact	·	(low confidence) The KB speaks of an attacker who "has access to your encryption keys" or has "prior knowledge of your custom encryption keys"; "default keys" is not in the source.	Applied: 'default' removed.
F3 claim-not-supported	·	(low confidence) heise says the BCS will run active scans of systems of "wesentlicher Einrichtungen" (essential entities); the new takeaway and section extend scans and the no-blocking rule to any org	Applied: scans limited to essential entities in takeaway, section and record.
F4 hallucinated-fact	·	(low confidence) AV:N means reachable from any network position, not only the internet, and CVE-2026-28324 also needs a non-default, non-secure configuration; removing internet exposure narrows but do	Applied: reworded to narrowing who can reach it.
F3 claim-not-supported	·	The BLVK notice says only "ein externer Softwarelieferant der BLVK" and never names PK Softech or Publica; the same-supplier link comes from Inside IT's customer list and Netzwoche, as the entry's own	Applied: Inside IT cited for BLVK as a supplier customer.
F3 claim-not-supported	·	(low confidence; not in the claim ledger) The 2026-09-26 BleepingComputer piece recaps what the FBI told BleepingComputer about the original claims; it does not report the FBI's status as of 2026-09-2	Applied: attributed to BleepingComputer's recap of the FBI's first response, through a correction with a section.
F5 missing-citation	·	The new section states that "NCSC UK's advisory names no Iranian government entity and does not make that link" with no inline citation. The statement is true (The Record: "Although the NCSC did not i	Applied: The Record cited.
F8 needs-more-research	·	(low confidence) InfoGuard states GINA v2.x "requires explicit activation in the system settings"; the Exposure line and takeaway ("GINA interface is internet-facing by design") omit the key discrimin	Applied: the Exposure line notes GINA v2 must be explicitly activated.
F8 needs-more-research	·	(low confidence) For a critical entry the cited Rapid7 post documents a Rapid7-developed exploit and Metasploit module (cisco_sdwan_vhub_auth_bypass); the entry mentions only the mechanism, not that a	Applied: the public Metasploit module is named and the status gains poc-public.
F8 needs-more-research	·	(low confidence) Actions still say upgrade to 19.3.2/19.2.6/19.1.8 only, although the new section adds backports 19.0.9/18.11.12; and GitLab states the backports contain only the two CVE-2026-85706/87	Applied: the action names the backport trains and their CVE-2026-88765 gap.
F7 drop	·	(low confidence) A CVE-programme administrative announcement with no defender decision, no Swiss nexus and no Defender takeaway; the strict gate says no marginal item survives.	Declined: published entries are never deleted except by folding; already routine.
F7 drop	·	(low confidence) Austrian NIS2 transposition; the earlier correction said it "changes no decision for Swiss entities", and the new takeaway rests on an Austrian-subsidiary scenario. Marginal for the c	Declined: already routine; the takeaway serves Austrian subsidiaries.
F7 drop	·	(low confidence) Out-of-nexus Polish healthcare-software breach; SQL injection with no product detail, actor link is a media attribution; the entry does not state which of the four breach-entry ground	Declined: already routine.
F9 surface-contradiction	·	(low confidence) Pensionskasse Post states its data at PK Softech is anonymised, holds no particularly sensitive data and that "derzeit kein Handlungsbedarf" exists for insured persons; the takeaway t	Applied: Pensionskasse Post's anonymisation statement is surfaced and the identity-proof advice no longer extends to its insured.
F16 ?	·	(low confidence) A Swiss federal pension fund (staff of the federal administration and ETH domain) with a Federal Prosecutor investigation and a decision within days (identity-verification rules for h	Declined: pension-administration data with no credentials; the decision is identity-verification hardening, not act-now.
F18 ?	·	(low confidence) After the audit-task clause, the action restates the Detection line ("the attack shows primarily in GPO content, GPO-creation events and SYSVOL, with the endpoint Group Policy log as	Applied: the action keeps only the audit task.
F11 editorial-advisory	·	Improvement 2026-10-11T14:08:56Z repeats the new Defender takeaway paragraph in a second reader-facing section. The section adds no delta beyond the main text (record type improvement with a dupli	Declined: the section is the changelog notice of the delta the main text now carries.
F11 editorial-advisory	·	Improvement 2026-10-11T13:58:21Z repeats the new Exposure line (same Telerik KB sentence) in a second section. The section adds no delta beyond the main text (record type improvement with a duplic	Declined: same reason.
F11 editorial-advisory	·	Improvement 2026-10-11T13:53:56Z repeats the new Exposure line almost verbatim in a second section. The section adds no delta beyond the main text (record type improvement with a duplicate reader-	Declined: same reason.
F11 editorial-advisory	·	The entry carries a main "Defender takeaway", a second one in the 2026-09-01 update and a "Defender takeaway (updated)" in the 2026-09-02 update (the one edited this fire); the contract is one takeawa	Declined: earlier fires' sections keep their dated takeaways; the main takeaway is current.
F11 editorial-advisory	·	Em dashes remain in reader-facing prose that this fire edited (Liechtenstein Update 2026-08-05 "identity-verification kit, the legal entity ...", GitLab body para 2 "...recording behavioral probes ...	Applied for GitLab; Liechtenstein's lie in an earlier fire's section and are stripped at render.
F4 hallucinated-fact	·	The customer is described as male ('led him to enrol', 'a caller ... guided him'); the cited heise article identifies the claimant as a woman, and Borncity is gender-neutral.	Applied: 'her' in headline, summary and body.
F4 hallucinated-fact	·	Supersession: this fire added VulnCheck's honeypot exploitation attempts (summary and a body paragraph) but left the earlier sentence asserting no in-the-wild exploitation; the cited THN article is he	Applied: the status sentence dates NCSC-CH's rating ahead of VulnCheck's report; exploited status declined (honeypot attempts only).
F4 hallucinated-fact	·	(low confidence) The detection advice (monitor for libguestfs-tools/qemu-utils/nbd-client installs and CIFS mounts of backup shares on non-backup hosts; treat rclone to cloud storage after such a moun	Applied: detection and Triage re-based on victim-visible access; the commands ran on the operator's server.
F4 hallucinated-fact	·	(low confidence) The summary still says the attacker can 'crash the device'. This fire's correction fixed the same overstatement in the body ('the text had said it forces a reload') but left the summa	Applied: the summary follows Cisco's wording.
F4 hallucinated-fact	·	(low confidence, legacy text, supersession per check 4c(h); this fire's internal record is itself correct) The main analysis still says 'Oracle has not published a CVE for the specific flaws in this c	Applied: main analysis and summary corrected to the confirmed CVE-2026-35273 state through a correction with a section.
F3 claim-not-supported	·	(low confidence) The cited Microsoft post says only that the flaws 'have since been fixed'; the February dates are on the two GitHub advisories, not on the cited page.	Applied: the two GitHub advisories cited for February.
F3 claim-not-supported	·	(low confidence) Microsoft's two advanced-hunting queries are DeviceProcessEvents child-process queries only; Startup-folder drops are named in prose as something endpoint defence should detect, not i	Applied: queries attributed to child processes; Startup-folder drops to Microsoft's endpoint guidance.
F3 claim-not-supported	·	(low confidence) Neither cited page carries CVSS 3.1 8.1 or CWE-122 (depthfirst: 'Critical, CVSS 9.2'; NCSC-CH: 'CVSS 4.0: 9.2'). The facts are true (NVD/F5 CNA 8.1, GHSA page CWE-122) but belong to o	Applied: CVSS 3.1 and CWE dropped from the opening.
F3 claim-not-supported	·	(low confidence) The NCSC-CH post carries its own CVSS 4.0 9.2 only; it states no F5 or depthfirst score (depthfirst's page says 'CVSS 9.2' without a version).	Applied: scores attributed to NCSC-CH and depthfirst separately.
F14 ?	·	(low confidence) Kaspersky counts a dozen machines, not organizations; the entry's own body line correctly says 'about a dozen machines of government, ... organizations'. The number of organizations i	Applied: a dozen machines in headline, summary, section and record.
F8 needs-more-research	·	(low confidence) BleepingComputer (cited) describes the observed exploitation as HTTP requests carrying properly constructed file:// payloads from a single IP that write files on the appliance; the ta	Applied: a Detection line added from BleepingComputer's description.
F9 surface-contradiction	·	(low confidence) TT (cited) reports the hacker got in with the leaked former-employee password '123456'; Ritzau via the Copenhagen Post (cited) reports 123456 on at least three Pays accounts and the f	Declined: the entry already separates the hacker's account from Politiken's report; TT merges the two.
F11 editorial-advisory	·	(low confidence) Sysdig measures 36 h 07 min from the advisory's listing in the global GitHub Advisory Database (2026-04-24 16:17 UTC), while the entry's own body dates LiteLLM's advisory 2026-04-20;	Declined: the entry gives Sysdig's own measurement and wording.
F11 editorial-advisory	·	(low confidence) The Record's own datePublished is 2026-05-06T16:52Z (cited as 2026-05-07). Detection calls the helper-to-cmd-to-PowerShell chain 'the earliest signal' and the body says the binaries r	Applied: The Record dated 2026-05-06.
F11 editorial-advisory	·	(low confidence) A civil refund ruling about a private customer of a German bank has no constituency nexus and the entry states no ground for its place; it is kept at routine with a transferable enrol	Declined: already routine; kept for the transferable QR-enrolment fraud lesson.
F11 editorial-advisory	·	Exposure omits that CVE-2026-25592 also lists pip semantic-kernel before 1.39.3 (GHSA-2ww3 affected versions; the cves[] record carries it).	Declined: advisory; the Exposure line follows Microsoft's blog.
F11 editorial-advisory	·	Em dashes in reader-facing title/headline/summary/body (only the '## Type; at' heading is exempt). Also legacy workflow phrasing: sekoia 'Why it matters to us', 'covered yesterday', '(§ 4)' in the act	Declined: style only; em dashes are stripped at render.
F11 editorial-advisory	·	(low confidence) The takeaway tells HR and recruiting never to 'let a candidate run unreviewed take-home-assignment code'. In the advisory's WaterPlum chain the victim is the job seeker told by a fake	Declined: advisory on an earlier fire's takeaway.
F11 editorial-advisory	·	(low confidence) Priority is routine (this fire), and the correction records 'a product outside the typical public-administration estate', no exploitation, fix since 2026-09-01, yet the body runs four	Declined: routine entries may keep their analysis; length is not a defect.
F11 editorial-advisory	·	(low confidence) The record says the entry cites Datatilsynet, DR, Politiken and TV 2 as independent reporting; Politiken and TV 2 are cited only through Ritzau/Copenhagen Post and TT, so the company	Applied: the record says Politiken and TV 2 are cited through relays.
F11 editorial-advisory	·	(low confidence) The correction says the listing 'carries only the catalog's standard required action' and 'withdraws' the forensic-triage statement. The flag forensicTriage is indeed 'No', but the st	Declined: the KEV flag is No, which is what the correction states.
F11 editorial-advisory	·	(low confidence) Three internal records change substantive reader-visible content with no section: Virtualizor (priority notable to routine, plus 'no working exploitation gadget chain exists in the st	Declined: each internal change is within the gate's allowance and carries no reader delta beyond a few words.
F4 hallucinated-fact	·	GLPI's own per-CVE GitHub security advisories carry a CVSS 4.0 vector and overall score for each of the seven CVEs; only the release notes omit scores. 'no CVSS published' is false for the vendor.	Applied: CVSS 4.0 scores from the per-CVE advisories, two cited as sources; the no-CVSS sentence replaced.
F4 hallucinated-fact	·	(low confidence) Six of the seven classes were wrong, not five: only CVE-2026-42321 (stored XSS) was right in the old text.	Applied: 'six of the seven'.
F4 hallucinated-fact	·	The cited KEV feed lists CVE-2026-20127 (dateAdded 2026-02-25) so status lacks cisa-kev, while the companion CVE-2026-20182 carries it; Cisco's advisory for CVE-2026-20127 shows Base 10.0 but cvss is	Applied: CVE-2026-20127 gets 10.0 and cisa-kev.
F4 hallucinated-fact	·	(low confidence) The advisory's revision history shows fixed releases being added on 2026-06-09 (v1.4) and 26.1.1.2 on 2026-06-10 (v1.5); the first fixed-release date is not 2026-06-10.	Applied: the record says 2026-06-09.
F4 hallucinated-fact	·	event_date must equal the primary source's publication date (docs/pipeline.md); the entry's own correction record says the Wordfence report is dated 2026-06-03, not 2026-06-06, but event_date was left	Applied: event_date 2026-06-03.
F4 hallucinated-fact	·	Supersession (check 4c-h): the entry's own 2026-08-16 Update, tags (actively-exploited) and cves[] status (exploited) record Defused's honeypot exploitation and NCSC-NL's scanning advisory; the main a	Applied: the paragraph records the honeypot attempts and scanning.
F4 hallucinated-fact	·	(low confidence) Evidence quotes are always English (v4.2) with the source-language text in original:; this record is untranslated Dutch with no English text and no original: field. The Dutch is verba	Applied: English quote with the Dutch original.
F4 hallucinated-fact	·	(low confidence) Huntress says NetSupport registers its own COM object, not that it hijacks an existing COM reference; T1546.015 is COM hijacking. truth-T7 raised it ('drop or justify'); this fire edi	Applied: T1546.015 dropped.
F4 hallucinated-fact	·	(low confidence) event_date is the primary source's publication date; the primary (PSIRT) was published 2026-05-13 (the body cites it as 2026-05-13), event_date is 2026-05-29 (KEV listing/Rapid7 date)	Applied: event_date 2026-05-13.
F14 ?	·	(low confidence) Zscaler says it 'identified Windows and macOS variants of ROOFDECK that are likely related to this campaign'; it never says there is none for Linux. The absolute 'none' is an inferenc	Applied: 'and none for Linux' dropped.
F4 hallucinated-fact	·	On disk 120 existing entries carry exactly one record with run_id 2026-10-11T1307Z-audit: 99 corrections, 19 improvements, 2 updates (GitLab, NetScaler), 35 internal. The report contradicts itself (11	Applied: counts recomputed (118 entries after two records were reverted; 102 corrections, 14 improvements, 2 updates, 28 internal) in report, CHANGELOG and record.
F4 hallucinated-fact	·	(low confidence) The five stretch entries (wwahost, storm-2570, manno, star-blizzard, storm-3068) are inside the 133 the passes verified (T1-T8 items sum to 133; the verdict table row is 133), not add	Applied: 'including the five'.
F4 hallucinated-fact	·	Both Sonnet 5.5 fires of 2026-10-02 and 2026-10-08 ran 8 verifier iterations, every verdict NEEDS_FIXES, verification_residual_count 4 (the 8-iteration cap with unresolved findings); 10-03, 10-04, 10-	Applied: two of eleven 5.5 fires and four of eight Sonnet 5 fires ended at the cap on NEEDS_FIXES.
F4 hallucinated-fact	·	(low confidence) The 15 criticals include two Check Point entries (checkpoint-quantum-vpn-cert-preauth-rce-cvss98 and cve-2026-93616-check-point-security-mgmt-path-traversal), not three; with three th	Applied: Check Point (two).
F4 hallucinated-fact	·	The Gambit record's fields are [techniques] and git diff shows only +T1070.006; T1136.001 is not in techniques[] and the record summary names only the timestamp-restoration mapping.	Applied: only T1070.006.
F4 hallucinated-fact	·	This fire's record on the SonicWall entry has fields [headline, summary, body]; the EPSS values (epss '0.0027' / '0.0092') are unchanged and no as-of date appears anywhere in the entry.	Applied: the claim is removed and the EPSS dating is listed as declined.
F4 hallucinated-fact	·	priority was already routine at HEAD (set by the 2026-09-30T0639Z record); this fire's record has fields [headline, summary, body] and leaves techniques [T1486] although the row says no source reports	Applied: the row no longer claims the priority move; T1486 is in the declined list with its reason.
F4 hallucinated-fact	·	The row lists 'conference-targeted' as a defect (recap calls it a volume play), but the title still reads 'A conference-targeted phishing chain', the takeaway still says 'Any organization whose staff	Applied: the entry is fixed (title, takeaway, contradiction line).
F4 hallucinated-fact	·	(low confidence) Live output on the same PDF is '# pdf: 37 chars from 13/91 streams, decode: byte-encoding; suspiciously little text for a document with text objects', 13 single-character 'x' streams,	Applied: record, report and CHANGELOG describe what the reader prints.
F5 missing-citation	·	(low confidence) The sentence carries no inline citation, and neither cited page (ZDI, BleepingComputer) mentions CVE-2026-42897 or OWA (grep count 0); the 'separate from the exploited OWA flaw' link	Applied: BleepingComputer and MSRC cited, MSRC added as a source.
F5 missing-citation	·	(low confidence) Neither claim has a citation and no cited source (SAP, Onapsis, BleepingComputer, NCSC-NL) says the Data Hub Adapter is internet-facing by design or that its legitimate traffic comes	Applied: both statements marked as analyst judgement.
F7 drop	·	(low confidence) kind: vulnerability with cves: [], no exploitation, no technique detail, no Exposure or Detection, and a takeaway that admits there is nothing to apply (keep Exchange current); it dup	Applied: priority notable to routine.
F9 surface-contradiction	·	(low confidence) The 2026-08-19 write-up says 'phishing campaigns that target attendees'; the 2026-09-15 recap calls the outreach a 'volume play instead of specific targeting of DEFCON attendees' with	Applied: contradiction line and softened title and takeaway.
F18 ?	·	(low confidence) The first two actions are the same task (rebuild and redeploy note 3771065 on Commerce Cloud) and the second adds only the compromise-assessment clause; the list is padded and restate	Applied: the two Commerce Cloud actions merged.
F11 editorial-advisory	·	Migration vocabulary in a reader-facing field, and now false: this fire replaced the evidence with a verbatim Wordfence quote, but sourcing_note (not in the record's fields) still says the evidence wa	Applied: sourcing note rewritten.
F11 editorial-advisory	·	Em dashes in reader-facing text (4 body lines, title, three actions) and self-referential 'recorded here' / 'the original entry' wording.	Declined: style only; the self-references sit in an earlier fire's section.
F11 editorial-advisory	·	(low confidence) The attacker-chosen file name and account name are indicator-style strings; the 09-30 audit removed payload file names elsewhere (conference entry) on the same rule.	Applied: file and account names replaced with descriptions.
F11 editorial-advisory	·	'there' reads as BleepingComputer, which never mentions Subresource Integrity (grep 0); it means the earlier text of this entry.	Applied: 'The earlier text also recommended'.
F11 editorial-advisory	·	The per-CVE advisories require a technician (authenticated) to store the payload for ITIL costs and asset locks, so 'external users' does not fit those two.	Applied: scoped to shared or weakly protected technician and administrator accounts.
F11 editorial-advisory	·	v4.20 anchors on the previous full audit; the banner still says previous audit record.	Applied: the runtime banner says previous full audit.
F11 editorial-advisory	·	The diff also moves first_seen on 11 existing product records (palo-alto-networks-pan-os 2026-05-30 -> 2026-05-12, n8n 2026-07-31 -> 2026-05-19, and nine more); not mentioned.	Applied: report and record mention the 11 first_seen moves.

Iteration #? NEEDS_FIXES · 131 findings (truth=60, editorial=36, advisory=35) · Claude Sonnet 5.5 · 30m 42s

F-code	Section	Verifier summary	Remediation · outcome
F3 claim-not-supported	·	The clause "Without that check, an attacker who captures or coerces a Negotiate/NTLM authentication exchange can relay it to MRSProxy and be treated as the relayed account" is now terminated by a Fran	Applied: the relay clause now states only what Franky's Web describes, and the mechanism detail rests on the advisory it cites.
F3 claim-not-supported	·	(low confidence) "there is no Exchange Emergency Mitigation workaround" / "No Exchange Emergency Mitigation workaround exists" is cited to the heise article, which carries only BSI's advice to restric	Applied: the absence of an Emergency Mitigation workaround is cited to Franky's Web, and heise carries only BSI's access-restriction advice.
F3 claim-not-supported	·	The opening sentence ("a local privilege-escalation vulnerability (CWE-59, improper link resolution ... / 'link following') in the Microsoft Malware Protection Engine that underpins Microsoft Defender	Applied: the opening sentence's product list and CWE now rest on the MSRC citations that state them.
F3 claim-not-supported	·	(low confidence) The exception set "pinned, WSUS-gated, air-gapped, or centrally deferred ... offline or OT-adjacent Windows hosts ... should explicitly verify the installed engine version" is cited t	Applied: the estate reading (pinned, WSUS-gated or offline hosts) is marked as the entry's own reading, not attributed to MSRC.
F3 claim-not-supported	·	(low confidence) "against the CVSS 4.0 score of 9.2 used by F5 and NCSC-CH" is cited to the NCSC-CH post only, which carries NCSC-CH's own score; the record summary says "the score attributions name o	Applied: the score attributions now name each publisher's score as its own cited page states it.
F3 claim-not-supported	·	(low confidence) The Exposure clause lists a replacement containing "?" and a following rewrite/if/set directive, but ends on the NCSC-CH citation, whose page carries only "specific rewrite directive	Applied: the Exposure clause on the replacement pattern now cites depthfirst, which documents it.
F13 ?	·	(low confidence) "the gap reflects the preconditions, a specific rewrite pattern and, for code execution, ASLR disabled" asserts why NGINX rates the flaw medium; no cited source says so.	Applied: the gap between scores is presented as likely reflecting the preconditions, marked as the entry's inference.
F3 claim-not-supported	·	(low confidence) "self-hosted n8n below 1.123.43, 2.20.7 or 2.22.1" cites GHSA-c8xv-5998-g76h, which never says "self-hosted" (nor does any of the five advisories or THN).	Applied: "self-hosted" is dropped; the version bounds stand as the advisories state them.
F3 claim-not-supported	·	(low confidence) Elastic is said to read the warning string "as an attempt to intimidate developers not to revoke the token rather than as a working trigger"; Elastic makes no such contrast, and the n	Applied: the contrast "rather than as a working trigger" is removed; the sentence keeps only what Elastic states.
F3 claim-not-supported	·	(low confidence) "DENIC dates the incident from 21:57 local time (19:57 UTC)" and "DENIC's times are local: ... 21:57 CEST ... 01:15 CEST" cite a DENIC page that states no time zone; the conversion is	Applied: the time-zone conversion is stated as the entry's inference, since DENIC's page gives no zone.
F18 ?	·	"Continue tracking the Nightmare Eclipse zero-day series via NCSC-CH's running advisory ..." is monitoring advice, not a start-now task (F18 a/c), and "RoguePlanet is now fixed" is stale against this	Applied: the monitoring action is dropped and the stale "now fixed" wording follows the ShieldBreak note.
F7 drop	·	(low confidence) The entry's own correction records priority routine because of "no exploitation, a vendor fix since 2026-09-01, a root path that needs an existing suspended billing account, and a pro	Declined: the routine entry already reads as a short patch-cycle item; the residual length is an editorial call the 2026-09-30 audit settled, not a soundness defect.
F7 drop	·	(low confidence) check 5b: a non-adversarial outage with no actor or vector is "routine and two sentences at most, or dropped (F7 when it is longer)". The entry has a seven-sentence paragraph, a takea	Declined: DENIC's .de outage is the national TLD outage the constituency depends on; the length carries the vendor's own root cause and is kept, with priority routine.
F7 drop	·	(low confidence) Cisco PSIRT states no exploitation and no workaround need; one flaw needs administrative credentials. The decline cites "identity infrastructure the constituency runs", but nothing in	Applied: priority moves to routine, regions to global and sectors to none, since nothing in the sources ties the flaws to the constituency.
F18 ?	·	(low confidence) The action restates the body's fix table ("Upgrade ... to 5.0.3 or 4.3.3; ... enterprise-support builds 4.2.7, 4.1.10 or 3.1.14") for an entry whose takeaway calls it "a patch-cycle i	Applied: actions[] is emptied; the fix table in the body carries the upgrade.
F18 ?	·	(low confidence) "Upgrade xrdp to 0.10.5, or install your distribution's 0.9.27 or 0.10.4.1 backport." restates the fix lines of the body for an entry the takeaway calls "a patch-cycle upgrade rather	Applied: actions[] is emptied; the body carries the fixed versions.
F12 single-source-flag-missing	·	(low confidence) This fire added the xrdp project advisory as the primary beside Kaspersky's analysis, so two sources are listed, yet verification still reads single-source and sourcing_note is null.	Applied: verification becomes multi-source with the xrdp advisory beside Kaspersky's analysis, and the sourcing note is set.
F11 editorial-advisory	·	The section dated 2026-05-10 now says "DENIC's addendum of 11 May 2026 states ..." (a later event) because this fire edited that section in place, so the decline reason (earlier fire's section, append	Applied: the 2026-05-10 section's addendum wording is revised in place through this fire's record to name the addendum as a later statement.
F11 editorial-advisory	·	CERT-Bund 'enabl[es] the complete remote takeover of systems without authentication' (German) and NCSC-NL "allows an unauthenticated attacker to execute arbitrary code" (Dutch) are translated quotatio	Applied: the German and Dutch passages are marked as translations.
F11 editorial-advisory	·	The record says the "Swiss and EU adoption and CERT claims had no source", but the europe region and public-sector/education sector tags that rest on them remain; "the profile's relevance call" is not	Applied: regions become global and sectors technology, since the constituency claims had no source.
F11 editorial-advisory	·	(low confidence) The rewritten entry is a four-paragraph advisory summary with no kill chain, yet deep_dive stays true (the n8n sibling cleared it for the same reason); the record lists `priority` in	Applied: deep_dive is cleared and priority is no longer listed in the record's fields.
F11 editorial-advisory	·	The record summary names "a source rating (A2: Microsoft's own advisory with NCSC-CH's tracker)" (Admiralty code in reader-facing text), narrates references/evidence changes the section does not state	Applied: the inline T1068 is removed from prose; the record summary is append-only text describing what changed and stays.
F11 editorial-advisory	·	(low confidence) Non-internal record summaries narrate metadata additions ("a rating and an ATT&CK mapping", "the registry link", "per-advisory sources, exposure and takeaway lines") that the rendered	Declined: record summaries describe the record's own change by design; metadata named there is the changelog's content, not reader-facing analysis.
F11 editorial-advisory	·	(low confidence) Em dashes appear in titles and body (nginx title/headline and body line 1; RoguePlanet title and body; chaindrop title, summary, actions and body; Exchange title and body; Virtualizor	Declined: em dashes in titles and pre-existing body text are style-only and stripped at render; new text this fire writes avoids them.
F11 editorial-advisory	·	(low confidence) Microsoft states a post-compromise framework, not distributed through a supply chain, and gives no espionage purpose; tags `espionage` and `supply-chain` go beyond the source.	Applied: tags reduced to china-nexus; espionage and supply-chain are dropped.
F11 editorial-advisory	·	(low confidence) The summary pairs "High" with 9.5 although the CNA record rates 9.5 CRITICAL; the GHSA page says High with no score. The disagreement between PHP's two statements is not surfaced.	Applied: the summary attributes 9.5 to the CNA record and the High label to the GitHub advisory, so the two statements are distinguished.
F4 hallucinated-fact	·	(low confidence) The record summary says "the injection is described by the sources as a read primitive in slug-filter ordering rather than a boolean-blind injection with time-delay artefacts". No cit	Applied: the record summary no longer characterises the injection beyond what the sources state.
F3 claim-not-supported	·	(low confidence) The remediated sentence still ends "...credentials and CI/CD configuration data, which turns a file-read primitive into a foothold on the CI/CD and source-control plane GitLab manages	Applied: the foothold conclusion is cut; the sentence keeps watchTowr's own description of what the read returns.
F4 hallucinated-fact	·	(low confidence) Iteration 1 flagged tokens, SSH keys and database credentials as absent from watchTowr; the fix reworded the body sentence but actions[0] still lists "SSH keys, database connection st	Applied: the action no longer lists SSH keys or database connection strings.
F4 hallucinated-fact	·	(low confidence) The summary and takeaway were corrected to "NLnet Labs names no DNSSEC precondition for CVE-2026-82717", but the action still asserts as fact that ordinary recursion against an attack	Applied: the action no longer asserts a reachability path NLnet Labs does not state.
F4 hallucinated-fact	·	(low confidence) No cited source says the Liechtenstein structures are Swiss- or EU-administered or that their administrators are "largely Swiss and European". NZZ speaks of Liechtenstein trustees and	Applied: the headline and body speak of some 31,000 Liechtenstein legal entities, without the Swiss or EU administration claim.
F13 ?	·	(low confidence) The remediation quoted the government's reason but kept the link: the shutdowns are presented as showing a segmentation and log-retention gap. No source says the shutdowns reflected i	Applied: the takeaway is reworded so the shutdowns are not presented as evidence of a segmentation or log-retention gap.
F5 missing-citation	·	(low confidence) The downgrade rationale asserts a current Microsoft position five months on. The only Microsoft statement in any cited source is the one BleepingComputer obtained on 2026-06-01; no ci	Applied: the Microsoft position is dated to the statement BleepingComputer obtained on 2026-06-01.
F8 needs-more-research	·	(low confidence) Krebs and CCB, both in sources[], state patches exist for 2012 onward, and Microsoft's CVRF lists Monthly Rollups for Server 2012 (KB5087470, 6.2.9200.26079) and 2012 R2 (KB5087471, 6	Applied: the line now states, citing Krebs, that patches exist for Server 2012 and 2012 R2.
F8 needs-more-research	·	(low confidence) GitLab's own release notes (the entry's primary source) add "GitLab security has released three threat detections to support customers with self-managed instances": LFI attempts readi	Applied: GitLab's three threat detections are added to the Detection line, cited to the release notes.
F9 surface-contradiction	·	(low confidence) The exploited status for CVE-2026-87719 rests on the post's edit-history reason. The same post's own 14.09 update text speaks of CISA adding CVE-2026-85706 to KEV and carries no CVE-2	Applied: the CVE-2026-87719 exploited status is explained with the post's edit history, as the post itself states it.
F9 surface-contradiction	·	(low confidence) The two cited sources differ on how the victim reached the fake page: Borncity has a QR code leading to a manipulated site; heise has the customer logging in as usual through her brow	Applied: a contradiction line records how Borncity and heise differ on how the victim reached the fake page.
F11 editorial-advisory	·	sourcing_note reads "migration: evidence backfilled from v2 brief body (item predates the Evidence footer field)". It is workflow-internal and stale: the evidence is now the verbatim XLab quote.	Applied: the sourcing note now describes the actual sourcing; the migration remark is removed.
F11 editorial-advisory	·	(low confidence) The record corrects reader-facing wording ("forces a reload or crashes the device" to Cisco's "could cause the device to reload") but is internal, so the correction is invisible to re	Declined: the wording alignment to Cisco's own phrase is within the internal allowance and changes nothing the reader learns about the flaw.
F11 editorial-advisory	·	"`unbound`/`named`-style crash-loops" and "a `named`/`unbound` worker process": named is BIND's daemon, not Unbound; the flaw is Unbound-only. Drop "named".	Applied: "named" is replaced by "unbound" in both places.
F11 editorial-advisory	·	(low confidence) A routine-priority retailer extortion outside the constituency carries a long narrative (price-per-victim arithmetic, exchange-rate discrepancy between outlets, ownership history). Co	Declined: the narrative is the cited reporting on an extortion order; length is an editorial call on a routine entry, not a soundness defect.
F11 editorial-advisory	·	Declined iteration-1 F11 stands as advisory: three takeaways remain (docs/pipeline.md contract: one takeaway reflecting the current state). The main takeaway is still accurate, so leaving it is accept	Declined: the main takeaway reflects the current state; folding the earlier dated takeaways is left to the next record on the entry.
F11 editorial-advisory	·	Pre-existing em dashes remain in reader-facing text: Liechtenstein body (15 lines, two on lines edited this fire), GitLab title and 2026-09-16 section, Kemp title and 2026-07-02 section, Nexus title a	Declined: em dashes in pre-existing text are style-only and stripped at render.
F4 hallucinated-fact	·	(low confidence) The record summary says T1041 was dropped because 'no exfiltration channel [is] named', but Rapid7's own ATT&CK table lists T1041 for this intrusion, so the source does name the mappi	Applied: T1041 is restored, as Rapid7's own ATT&CK table lists it, and T1105 stays.
F4 hallucinated-fact	·	(low confidence) Absence stated as fact. Rapid7 says the code-signing certificate 'used to validate the malware samples' is a known MuddyWater resource and was 'revoked shortly after deployment'; it d	Applied: the certificate sentence now states only what Rapid7 says: a known MuddyWater resource, revoked shortly after deployment.
F3 claim-not-supported	·	(low confidence) Rapid7 says the TA instructed users during the Teams chats to modify MFA to include attacker-controlled devices, but does not state the registration occurs within the screen-sharing s	Applied: "within the session" is dropped; the MFA registration is described as instructed during the Teams chats.
F11 editorial-advisory	·	(low confidence) Check 12: file-name indicators of the attacker tooling in reader-facing text (policy: no file-name indicators).	Applied: file names of the attacker tooling are removed from reader-facing text.
F5 missing-citation	·	(low confidence) The sentence carries no inline citation; the source is InfoGuard, which is cited only on the next sentence (Censys count).	Applied: the sentence now carries its InfoGuard citation.
F9 surface-contradiction	·	(low confidence) The per-CVE record (NCSC.ch as CNA) lists CVE-2026-44126 as affecting versions 'before version 15.0.4' while InfoGuard's table and The Hacker News place the fix in 15.0.3 and the SEPP	Applied: the contradiction line now sets InfoGuard's 15.0.3 for CVE-2026-44126 against the CVE record's versions before 15.0.4, with 15.0.4 as the safe floor.
F8 needs-more-research	·	The analysis has Exposure and Defender takeaway but no Detection line although InfoGuard describes observable behaviour for exploitation: POST to /v1/file.app with traversal in the file field writing	Applied: a Detection line now carries InfoGuard's observable behaviour for exploitation, cited.
F3 claim-not-supported	·	(low confidence; older section, outside the ledger) The cited InfoGuard page carries no CVSS score or version (the 10.0 is on The Hacker News, the 4.0 only in the cve.org record). The iteration-1 reme	Applied: the CVSS 10.0 is cited to The Hacker News, which states it.
F11 editorial-advisory	·	(low confidence) Title/headline cover the NCSC six only while cves[] carries CVE-2026-2743 at 10.0, so 'CVSS up to 9.3' understates the entry's own top score.	Applied: the title and headline name the five more flaws in NCSC-CH's advisory without understating the top score.
F3 claim-not-supported	·	(low confidence) Securelist says the binaries at startup run a backdoor thread that sends GET requests to a typosquatted C2 domain; cmd.exe and PowerShell run only when the server returns a shell comm	Applied: the startup behaviour is restated as Securelist gives it: a backdoor thread beaconing at startup, with shell execution only on a server command.
F11 editorial-advisory	·	(low confidence) Check 12: file-name indicators of attacker tooling (`envchk.exe`) in reader-facing text.	Applied: the tooling file name is removed from reader-facing text.
F9 surface-contradiction	·	Supersession (check 4c(h)): the iteration-1 remediation set priority routine and added the section, but the main analysis and its takeaway still instruct the reader in the present tense ('now', 'befor	Applied: the main analysis and takeaway are rewritten in the past tense now that the summit window has passed.
F3 claim-not-supported	·	(low confidence) The cited page is a pre-event advisory (dateline 2026-06-01) that says the summit 'will take place from 15 to 17 June 2026'; it supports the dates but cannot state that the summit too	Applied: the sentence says the summit was scheduled for 15 to 17 June, as the pre-event advisory states.
F7 drop	·	(low confidence) The decline rationale ('operator-level length judgement on an earlier fire's notable entry the audit did not touch beyond relabelling') does not hold as stated: the 2026-09-30 audit r	Declined: NCSC-CH's weekly review for the home region documents one coordinated malware chain; the length carries its mechanics and is kept.
F8 needs-more-research	·	(low confidence) The decline rationale ('the 2026-09-30 update carries the current takeaway; folding the takeaways is left to the next record on the entry') does not hold: this fire already records a	Applied: a Defender takeaway reflecting the current state is added to the main analysis.
F5 missing-citation	·	(low confidence) Uncited factual characterisation; JetBrains states the server can expose 'TeamCity data, configurations, and stored credentials' and compromise 'the integrity of build artifacts and d	Applied: the characterisation now uses JetBrains' own wording, cited.
F4 hallucinated-fact	·	(low confidence) The correction hedged the body to Talos's 'traces suggesting exploitation', but the summary still states Zerologon/MS17-010 as attempts and as lateral-movement steps; Talos places the	Applied: the summary now says the actor leaves traces suggesting Zerologon and MS17-010 exploitation, as Talos puts it.
F3 claim-not-supported	·	(low confidence) The conclusion is carried by the citation to The Hacker News, but THN exempts default-marketplace users only from 'the branch-name version of the attack' and states 'it is not establi	Applied: the scope sentence now follows THN's narrower exemption and its own uncertainty about Gemini.
F5 missing-citation	·	The correction record says 'the detection, triage and takeaway lines gain their LevelBlue citation', but the Detection sentence ends with no citation; the single LevelBlue link in that paragraph termi	Applied: the Detection sentence now carries its LevelBlue citation.
F3 claim-not-supported	·	(low confidence) The Microsoft post says 'five unique tokens issued for the service principal' and never says OAuth; iteration 1 raised this as a minor point and it was not remediated.	Applied: "OAuth" is dropped; the sentence says five unique tokens, as Microsoft states.
F4 hallucinated-fact	·	(low confidence) T1190 (Exploit Public-Facing Application) is not tied to this intrusion by the cited source: Microsoft says initial access is unclear and, of the App Service probing, 'we found no App	Applied: T1190 is dropped from techniques[], since Microsoft found no App Service credential path.
F3 claim-not-supported	·	(low confidence) The cited HIBP page carries the data classes but says nothing about the records spanning international markets or not being EU-only; it says only 'the market the support ticket origin	Applied: the international-markets clause is co-cited to BleepingComputer, which states it.
F3 claim-not-supported	·	(low confidence) Citation gap, fact true. Both clauses cite the Proofpoint OWAReaper post, which says 'Russia-aligned threat actor TA488' and never 'state-supported'. 'State-supported' is the wording	Applied: TA488 is described as Russia-aligned in both places, as Proofpoint states.
F5 missing-citation	·	The sentence has no inline citation and none of the paragraph's citations (MSRC, CISA KEV, Microsoft Learn) state it. The fact is true per the May Exchange blog, which is in sources[] but not cited he	Applied: the sentence cites the May Exchange Team Blog.
F4 hallucinated-fact	·	(low confidence) event_date is the primary-source publication date (docs/pipeline.md). The first primary, the Exchange Team Blog, is dated 2026-05-14 and MSRC shows 'Released: May 14, 2026'; 2026-05-1	Applied: event_date set to 2026-05-14, the May advisory's date.
F4 hallucinated-fact	·	(low confidence) The primary source (GitHub advisory GHSA-v4p8-mg3p-g94g) was published 2026-04-21 and the headline event, the KEV listing, is 2026-06-08; 2026-06-01 is only Horizon3's chain write-up.	Applied: event_date set to 2026-06-08, the KEV listing date.
F5 missing-citation	·	Uncited hunting guidance that partly goes beyond both sources. Trend Micro's own monitoring list is: cmd.exe launching PowerShell with -ExecutionPolicy Bypass and -WindowStyle Hidden reading from C:\\	Applied: the hunting sentence is replaced by Trend Micro's own monitoring list, cited.
F8 needs-more-research	·	Trend Micro states the fixed release (WinRAR 7.13, July 2025), a CVSS of 8.4, that WinRAR is not covered by Group Policy or centralized update mechanisms, and gives a patch-management step (inventory	Applied: Exposure and Defender takeaway lines now state the 7.13 fix, the 8.4 score, the missing central update path and Trend Micro's inventory step, cited; cves[] records the score and the fix.
F16 ?	·	(low confidence) The declined rationale ('the decision is identity-verification hardening, not act-now') applies the critical bar to a high question. The high bar (cti-run.md) is plausible exposure of	Declined: no fund has confirmed an outflow of member data; the entry stays notable with its single action until a constituency impact is reported.
F11 editorial-advisory	·	Delta F11 landed only in part (sourcing_note rewritten). ATT&CK ids are still listed in prose although techniques[] carries them, and entities is still [] although the registry holds campaign:uac0226-	Applied: the prose ATT&CK ids are removed and entities links the registry campaign.
F11 editorial-advisory	·	Delta F11 declined as 'append-only'. Only the updates[] records are append-only; per CLAUDE.md earlier body sections may be revised through the current fire's record. The section is reader-facing reco	Applied: the 2026-08-30 section is restated in plain language without rating codes, through this fire's record.
F11 editorial-advisory	·	The internal record's summary describes only the added reference, while fields also names actions (rewritten, interim clause removed) and body (KEV citation added), so the changelog states less than i	Applied: the record summary now names the action trim and the KEV citation.
F3 claim-not-supported	·	The sentence quotes Instructure as saying it "reached an agreement with the unauthorized actor" and cites Inside Higher Ed and Infosecurity Magazine; neither page carries that wording. Infosecurity sa	Applied: the agreement sentence paraphrases Inside Higher Ed (a deal reached, shred logs, no monetary value disclosed) and the Infosecurity citation is dropped.
F3 claim-not-supported	·	(low confidence) NL Times is now cited and carries the fact, but the DutchNews.nl citation stays on the same clauses; DutchNews says the group breached Canvas "affecting millions of students ... inclu	Applied: DutchNews.nl is removed from the three disconnection clauses, which now cite NL Times alone.
F3 claim-not-supported	·	"Because the file on disk never changes, a write watch on `/etc/passwd` cannot detect the attack" cites the V4bel write-up. The write-up states the page cache "is modified in RAM" and persists until d	Applied: the on-disk clause is cited to Aikido and the in-RAM modification to the V4bel write-up; the watch consequence follows from both.
F3 claim-not-supported	·	The clause cited to the V4bel write-up says "In both" flaws a 4-byte store lands. The write-up gives the ESP variant a 4-byte arbitrary STORE but the RxRPC variant an 8-byte STORE whose value the atta	Applied: the two write primitives are told apart: 4 chosen bytes into a setuid binary for ESP, 8 brute-forced bytes into /etc/passwd for RxRPC.
F3 claim-not-supported	·	(low confidence) The clause binds CVE-2026-31431 and "distinct flaw family" to the Red Hat bulletin, which names neither: it says only that "Due to similarities with the Copy Fail vulnerability, Dirty	Applied: Red Hat is cited only for the "Copy Fail 2" naming and Microsoft for CVE-2026-31431.
F4 hallucinated-fact	·	(low confidence) "a thirteen-year-old bug (dating to 2013) in the kernel's `skb_try_coalesce()`" cites Aikido and Red Hat; neither names the function.	Applied: the 2013 bug is described as the code that merges packet fragments, as Aikido puts it, without the function name.
F4 hallucinated-fact	·	The summary now says "The University of Nottingham confirmed about 455,000 student and alumni records taken", and the 06-13 section says it "confirmed 454,600 student and alumni records were taken, in	Applied: the summary and the 2026-06-12 and 2026-06-13 sections attribute the count to Have I Been Pwned's analysis of the leaked data; the university confirmed access to its student-record system.
F3 claim-not-supported	·	Both cite the Oracle Security Alert for Oracle "confirming the vector". The alert describes a PeopleTools flaw and mitigations and never mentions ShinyHunters, exploitation or this campaign; Oracle sa	Applied: Oracle is described as publishing the Security Alert and Mandiant as assessing the campaign consistent with exploitation of the CVE, in the main analysis and the correction section.
F3 claim-not-supported	·	BleepingComputer describes the script as parsing /etc/hosts, SSH-ing with common service accounts (key fallback) and dropping a ransom note; it has no bulk data retrieval. Mandiant describes exfiltrat	Applied: the script description follows BleepingComputer (hosts parsing, SSH with key fallback, ransom note) and Mandiant is cited for the separate zstd exfiltration step.
F4 hallucinated-fact	·	No source names PIA or REST/SAML/OAuth endpoints as the entry surface, and the sentence now sits directly after the confirmed vector. Mandiant says EMHub and the Integration Broker listening connector	Applied: the entry surface is the Environment Management Hub and the Integration Broker listening connector, cited to Mandiant.
F3 claim-not-supported	·	(low confidence) The Hardening sentence chains entry-authored advice (rename psoft/oracle/linuxadm accounts, SSH key-only, jump hosts, audit logging) with Mandiant's Security Alert and EMHub advice an	Applied: the hardening paragraph cites Mandiant for its advice and marks the account-hardening advice as the entry's own; the Action Fraud and ICO clause follows the university's wording.
F4 hallucinated-fact	·	(low confidence) The Council of Europe never confirmed a breach: the sources and this entry's own 06-16 section say it is "investigating" and has not confirmed exfiltration, so "confirmed" misstates i	Applied: the 2026-09-27 section says the Council of Europe was listed by ShinyHunters in June and said it was investigating.
F14 ?	·	(low confidence) "first" is not stated by the cited SecurityWeek, Register or BleepingComputer pages.	Applied: "first" is dropped from the 2026-06-16 section.
F4 hallucinated-fact	·	The sourcing_note (unchanged by this fire) still calls the fix a "CPU" (Critical Patch Update) although this fire's correction, body, action and summary establish it is the Critical Security Patch Upd	Applied: the sourcing note names the Critical Security Patch Update.
F14 ?	·	(low confidence) The CISA alert cited for the sentence says only that CVE-2026-46817 was added "based on evidence of active exploitation"; no source says it is the first formal confirmation.	Applied: "the first formal confirmation of" is dropped; CISA's listing is described on evidence of active exploitation, as CISA states it.
F4 hallucinated-fact	·	The quoted Bitget wording ("the attacker may have exploited a vulnerability in a third-party security product to potentially obtain high-level internal credentials" and "to impersonate authorized acti	Applied: the evidence quote and the body quotations follow the page as updated on 2026-10-03, and the section records the change.
F5 missing-citation	·	(low confidence) Two factual sentences carry no inline citation in their paragraphs: the gadget-chain / configuration-dependence statement (BleepingComputer) and the stolen-data categories (TechCrunch	Applied: the gadget-chain sentence cites BleepingComputer and the data categories cite TechCrunch.
F5 missing-citation	·	(low confidence) The sentence is rewritten text with no inline citation; Ubuntu carries the AFS side effect, but "need the kernel update" is not sourced.	Applied: the AFS sentence cites Ubuntu, which states the side effect and recommends the kernel update.
F5 missing-citation	·	(low confidence) The reassurance has no inline citation. The cited CCB advisory lists "14.1 - 14.1-73.37" and "13.1 - 13.1-64.23" under Affected software, the same builds Citrix names as fixed, and th	Applied: the fixed builds are cited to Citrix's bulletin.
F18 ?	·	(low confidence) actions[1] ("Hunt for the post-exploitation toolkit ...") restates the hunting paragraph of the 2026-09-27 section, and actions[0] largely duplicates immediate_action.	Applied: the hunting action that restated the body is dropped; the patch action stays.
F18 ?	·	(low confidence) The remaining action still carries a long Red Hat applicability aside ("Red Hat's applicability split means CVE-2026-43500 specifically does not affect RHEL, but CVE-2026-43284 and CV	Applied: the action is cut to the patch task.
F11 editorial-advisory	·	(low confidence) The remediated takeaway is grammatically broken: "...technician or administrator accounts that can write knowledge-base, cost or asset content are shared or weakly protected that tech	Applied: the takeaway's missing clause is restored.
F11 editorial-advisory	·	(low confidence) The score clause cites only two of the seven per-CVE advisories (5.1 and 8.4 are the endpoints); the other five scores in cves[] are correct but sit on uncited advisories (GHSA-w7mr-3	Applied: all seven per-CVE advisories are sources and cited for the scores, and the correction section states the CVSS replacement.
F11 editorial-advisory	·	(low confidence) The decline rationale ("an earlier fire's section, append-only for its dating") is partly weak: this fire rewrote the section in place (record summary: "the earlier sections are corre	Applied: the 2026-05-09 section marks the Free-for-Teacher attribution as a later statement.
F11 editorial-advisory	·	(low confidence) "(\\"Fragnesia\\", tracked in its own entry)" is workflow language in reader-facing text (the same phrase was removed from the action by this fire), and the section carries em dashes	Applied: the workflow phrase is removed and the section's em dashes are replaced.
F11 editorial-advisory	·	(low confidence) The PSIRT table still annotates 12.1.7 with "(ETA: 05/28)" in the Unaffected column; the entry lists 12.1.7 as a fixed build without saying so.	No change needed: the main analysis already states that the advisory still lists 12.1.7 with an ETA.
F11 editorial-advisory	·	(low confidence) The summary still gives "CVE-2026-48612 (CVSS 8.3)" while the internal record moved cves[] to 8.0 (CNA, as heise reports); the body gives both scores, the summary should not give only	Applied: the summary gives both scores for CVE-2026-48612.
F11 editorial-advisory	·	(low confidence) The record summary says the entry was rewritten "with the disclosure-day facts from the same-day brief entry of 2026-06-04", pipeline vocabulary in a reader-visible changelog line; so	Applied: the record summary describes Cisco's disclosure without pipeline vocabulary.
F11 editorial-advisory	·	(low confidence) Em dashes remain in the titles/headlines of the FortiSandbox, Oracle EBS and Acronis entries, lines this fire edited. The site strips them at render (prompts/cti-run.md), so this is a	Declined: em dashes in titles are style-only and stripped at render.
F11 editorial-advisory	·	(low confidence) The remediation named DirectAdmin in the first sentence but the fixed-build sentence still gives builds for cPanel & WHM and Plesk only (cited to BleepingComputer); the DirectAdmin fi	Applied: the fixed-build sentence names the DirectAdmin build 1.2.3.238, cited to Acronis.
F11 editorial-advisory	·	(low confidence) The takeaway tells HR and recruiting workflows to "never let a candidate run unreviewed take-home-assignment code". In the advisory the WaterPlum victims are individual IT professiona	Applied: the takeaway's first control addresses the employees fake recruiters approach, cited to heise in the section; the HR control stays.
F11 editorial-advisory	·	(low confidence) The decline answered only the em-dash point. The main analysis is about 780 words for a routine-priority, non-deep-dive capability demonstration with an inert public build, against th	Declined: the routine entry's length carries the implant's documented behaviour; a length guide breach on an earlier fire's entry is not a soundness defect.
F9 surface-contradiction	·	(low confidence) CCB (cited) lists the affected range for CVE-2026-88773 as ending at 14.1-73.37 / 13.1-64.23, while Citrix names those builds as fixed; the entry silently follows Citrix. Add a Contra	Applied: a contradiction line records CCB's affected-range wording against Citrix's fixed builds.
F1 broken-url	·	(low confidence) The cited NCSC-CH URL is the retired unversioned API path and returns HTTP 404 on a direct fetch; it is also a JSON endpoint, not the hub post a reader would open. The post exists: th	Applied: the four NCSC-CH citations and the source point at the public hub post (#/posts/12547); SEPPmail's four citations move the same way.
F4 hallucinated-fact	·	The record summary says the rewrite carries "the module-blacklist action", but actions[] is empty (empty at HEAD too); the remediation of iteration 1 dropped the action and the record text was not upd	Applied: the record summary no longer claims an action, and actions is dropped from its fields.
F3 claim-not-supported	·	(low confidence) "look back for root shells spawned from `su` by service or web accounts since late April" terminates on Xint and Microsoft citations. Xint names no service or web accounts; Microsoft'	Applied: the Detection line says unexpected accounts.
F3 claim-not-supported	·	(low confidence) The Ubuntu tracker is cited as "[Ubuntu, 2026-05]" and sources[] carries date 2026-05; the page shows "Publication date 22 April 2026" and "Last updated 27 August 2026". The fixed ker	Applied: the Ubuntu tracker is dated 2026-04-22 in the citations and sources.
F3 claim-not-supported	·	Iteration-1 fix did not fully land: the sentence now says "BleepingComputer reports that Cisco shared no details of the attacks" but still ends with two citations, BleepingComputer and The Register. T	Applied: the Register citation is dropped from the clause it does not support.
F4 hallucinated-fact	·	The title says "an unauthenticated request to the Data Hub Adapter import endpoint", action[0] says "restrict the Data Hub import endpoint with a Commerce Cloud IP filter set", and the Detection parag	Applied: the title, action and Detection lines name the vulnerable Data Hub Adapter endpoint; the 2026-08-16 section drops "import".
F3 claim-not-supported	·	(low confidence) "DIAG is the SAP GUI presentation protocol, so the affected listener is one that ordinarily faces user workstations, and the affected kernel list spans KRNL64NUC/KRNL64UC and KERNEL b	Applied: the DIAG sentence is moved outside the citation and marked as analyst judgement.
F3 claim-not-supported	·	(low confidence, declined in iteration 1) No page read gives 2026-09-15. The report page shows only "September 2026"; the HTML carries no datePublished; Help Net Security's coverage is dated 2026-09-1	Applied: the report is dated September 2026 in the body, citations and sources, with Help Net Security's 2026-09-16 coverage cited; event_date stays as a day-level estimate.
F4 hallucinated-fact	·	(low confidence) The entry's own Update says "What is confirmed is exploitation attempts against sensors ... and scanning for vulnerable systems ... no party reports a compromised production instance"	Declined: the status rests on Defused's in-the-wild exploitation attempts plus NCSC-NL's advisory of attackers actively seeking vulnerable systems; the nginx case has honeypot attempts alone and an unknown rating from…
F4 hallucinated-fact	·	The report says "Nine entries exceed the entry-shape length guide: seven main analyses over 550 words and two headlines at 125 characters", but the two over-long headlines belong to Zammad and Denmark	Applied: the report says seven entries (nine WARNs) and states the exploitation-consistency result for every window entry.
F4 hallucinated-fact	·	python3 tools/check_run.py 2026-10-11T1307Z-audit currently FAILs run-clock: completed=2026-10-11T15:18:04Z precedes verification.iterations[1].ended_at=2026-10-11T15:50:41Z by 1957 s, and duration_se	Applied: completed and duration_seconds are re-stamped after the loop.
F4 hallucinated-fact	·	(low confidence) The report's "Watch items" section lists six open items: legacy queue, non-CVE duplicates, Nightmare Eclipse, webfetch-only sources and their quotes, publisher revisions and backlog r	Applied: the record says six open.
F4 hallucinated-fact	·	(low confidence) The list of this fire's priority moves is presented as the movement the repairs caused, but omits the polyfill entry, which this fire moved high to notable. On disk six entries moved	Applied: polyfill and Cisco ISE are added to the movement list.
F4 hallucinated-fact	·	(low confidence) The 34 entries are the October 1-11 entries; the 37 non-product registry entities count first_seen from 2026-09-30 (audit window start). With first_seen on or after 2026-10-01 the reg	Applied: the report gives 30 non-product entities first seen in October.
F5 missing-citation	·	(low confidence) "The chain is not CVE-2026-42897, which was a separate, exploited cross-site scripting flaw in Outlook Web Access." has no inline citation inside the section; the facts are supported	Applied: the sentence cites MSRC.
F5 missing-citation	·	(low confidence) The sentence "Rounding out the High Priority set, CVE-2026-58243 (CVSS 8.8, Note 3772411) covers the SQL Console ..." ends the paragraph with no citation; Onapsis and the SAP page car	Applied: the CVE-2026-58243 sentence cites Onapsis.
F5 missing-citation	·	(low confidence) "No party reported exploitation of any of these on patch day; three days later Defused saw exploitation attempts ... and NCSC-NL reported active scanning (see the 2026-08-16 update)"	Applied: the patch-day status cites NCSC-CH's unknown rating, and Defused and NCSC-NL carry their citations.
F5 missing-citation	·	(low confidence) "a DIAG-parsing memory-corruption attempt surfaces as work-process crashes or short dumps clustered on one instance rather than as an authentication event" is an uncited inference sta	Applied: the short-dump sentence is marked as analyst judgement, anchored to Onapsis's crash outcome.
F8 needs-more-research	·	(low confidence) The rewritten main analysis opens with "Current state" and then describes the disclosure-day position; it carries none of the labelled lines (Exposure, Detection, Defender takeaway).	Applied: Exposure, Detection and Defender takeaway lines reflecting the shipped fix are added to the main analysis.
F16 ?	·	(low confidence) The record raises the priority for "exploitation is vendor-confirmed and KEV-listed for a management-plane flaw". The flaw was fixed and KEV-listed on 2026-06-15, four months ago, nee	Applied: priority stays notable; the raise to high is withdrawn.
F11 editorial-advisory	·	The sourcing_note still reads "migration: evidence backfilled from v2 brief body (item predates the Evidence footer field)": workflow vocabulary in a reader-facing field, and now false because this fi	Applied: the sourcing note describes the actual sourcing.
F11 editorial-advisory	·	(low confidence) The 2026-08-24 section still names `C:\\Windows\\System32\\phoneinfo.dll` as "the strongest single indicator", plus the WD_SCAN symbolic-link name, file-name and object-name indicator	Declined: the System32 DLL path a Windows binary loads is a platform artifact the entry contract allows as an example, not attacker infrastructure.
F11 editorial-advisory	·	(low confidence) Earlier sections keep self-referential wording ("previously recorded here as carrying no exploitation", "The mechanism is unchanged from the original entry", "The original entry state	Applied: the self-references in the 2026-08-16 and 2026-08-28 sections are rephrased; em dashes are style-only.

Iteration #? NEEDS_FIXES · 87 findings (truth=47, editorial=12, advisory=28) · Claude Sonnet 5.5 · 22m 24s

F-code	Section	Verifier summary	Remediation · outcome
F13 ?	·	The iteration-2 rewrite attributes to the NCSC warning a preparation list it never asked for. Takeaway: "the warning's lasting lesson is the preparation it asked for ahead of a large international eve	Applied: the takeaway attributes NCSC's baseline measures to its measures document and the event-specific steps to ZENDATA; the correction no longer says preparations lapsed.
F5 missing-citation	·	(low confidence) "\\"all versions affected\\" plus \\"no authentication\\" plus a widely deployed, easily fingerprinted product is a combination that historically closes quickly once someone reconstru	Applied: the closing generalisation is marked as analyst judgement.
F4 hallucinated-fact	·	(low confidence) sourcing_note still says JetBrains "rates the flaw critical without a numeric score and withholds the exploitation details", the same attribution of an act of withholding that this fi	Applied: the sourcing note says JetBrains publishes no detail beyond the agent polling protocol.
F11 editorial-advisory	·	(low confidence) Reader-facing section ends with record-keeping narration: "The main analysis now closes with the current takeaway: patch, and treat any server ... as an incident-response case because	Applied: the sentence narrating the edit is removed from the correction section.
F4 hallucinated-fact	·	(low confidence) "Command and control ran on the open-source AdaptixC2 post-exploitation framework" states as settled what Talos hedges in the next sentence of its section.	Applied: the AdaptixC2 sentence carries Talos's hedge.
F4 hallucinated-fact	·	(low confidence) The body quotes Talos as saying the implant is "the first publicly documented Windows implant to apply this model to tactical command and control" with the hedge cut out, while this f	Applied: the quote includes "to our knowledge".
F11 editorial-advisory	·	(low confidence) Reader-facing text refers to the entry itself: "the entry follows Citrix, the vendor" (self-reference of the 'this entry' kind that rule 12 lists as workflow-internal language).	Applied: the contradiction line names Citrix as the authority on its fixed builds instead of referring to the entry.
F3 claim-not-supported	·	(low confidence) The date 2026-06-01 for Microsoft's statement is not on the BleepingComputer page, which says 'Update June 02, 08:51 EDT: Added Microsoft and CCB statements.'; the MSRC clause is unci	Applied: Microsoft's statement is dated to BleepingComputer's 2026-06-02 addition, MSRC is cited for the advisory clause, and the summary dates the statement to June.
F3 claim-not-supported	·	(low confidence) Krebs says patches exist for 2012 onwards but not that 2012/2012 R2 are affected; that is CERT-EU's list.	Applied: CERT-EU is co-cited for Server 2012 and 2012 R2.
F4 hallucinated-fact	·	'No source supports the earlier statements that 16 of the CVEs came from an AI scanning harness or that the DNS Client flaw runs code in dnsapi.dll' is false: Microsoft's own blog states the MDASH cla	Applied: the correction states Microsoft's MDASH and dnsapi.dll statements, cited to its blog, and keeps only NetworkService as unsupported; the record summary follows.
F3 claim-not-supported	·	(low confidence) No cited source says the records are not EU-only; BC says 'customers in different markets', HIBP 'the market the support ticket originated in'.	Applied: the clause says the records concern customers in different markets and no source limits them to the EU.
F3 claim-not-supported	·	The cited CISA alert does not mention Oracle's May 2026 Critical Security Patch Update fix; it lists only the CVE and 'based on evidence of active exploitation'.	Applied: the Oracle fix clause cites Oracle's CSPU advisory.
F4 hallucinated-fact	·	(low confidence) No source mentions a distribution backport; Securelist says the maintainers backported to 0.9.27 and 0.10.4.1.	Applied: the Exposure line names the 0.9.27 and 0.10.4.1 backport releases, cited to Securelist.
F11 editorial-advisory	·	(low confidence) The 12.1.7 ETA is stated only in the 2026-05-13 Update section, not in the main analysis as the rationale claims; the live PSIRT still shows '>= 12.1.7 (ETA: 05/28)'.	Applied: the main analysis notes that the advisory's table still marks 12.1.7 with an ETA.
F11 editorial-advisory	·	(low confidence) Frontmatter states exploitation as fact while Microsoft denies it; the body carries the Contradiction line.	Declined: CCB, a national CERT, states exploitation; the status follows it and the contradiction line carries Microsoft's denial.
F11 editorial-advisory	·	sourcing_note is three sentences of analysis beyond provenance; stray nested parentheses.	Applied: the sourcing note is two sentences of provenance and the nested parentheses are tidied.
F11 editorial-advisory	·	Composition rationale in a reader-facing field.	Applied: the composition remark is dropped from the sourcing note.
F4 hallucinated-fact	·	Evidence quote attributed to Rapid7 is not a substring of the Rapid7 page (the only Rapid7 source on the entry). The gate could not read this page, so it was not machine-checked. Quote: "CVE-2026-3527	Applied: the Rapid7 evidence quote is replaced with a sentence the page carries.
F4 hallucinated-fact	·	(low confidence, legacy sentence) No cited source describes exfiltration over a web service. Mandiant describes zstd-compressed archives and an outbound SSH connection to the leak-site mirror, and its	Applied: the exfiltration step is mapped to T1048 per Mandiant's outbound SSH channel, and T1567 is dropped.
F3 claim-not-supported	·	(low confidence) TechCrunch relays the same actor claim: "a ShinyHunters member told TechCrunch on Wednesday". It verified nothing independently, so "independently corroborated" is not what the page s	Applied: TechCrunch is described as relaying a ShinyHunters member's account.
F3 claim-not-supported	·	(low confidence) The co-cited SecurityWeek page says the opposite on fixes: Oracle appears to have released mitigations only. Rapid7 and BleepingComputer (not cited here) say a patch shipped, so the s	Applied: the patch is cited to Rapid7 and SecurityWeek is dropped from that clause.
F3 claim-not-supported	·	(low confidence, earlier-fire sentence) The cited SecurityWeek page reports the leak-site listing and sizes but does not tie the Council of Europe claim to PeopleSoft, the Environment Management Hub o	Applied: the Council of Europe's link to the campaign is cited to The Register; the hub and CVE are no longer tied to SecurityWeek.
F3 claim-not-supported	·	(low confidence) The terminating NCSC-CH citation carries product names only, no version ranges.	Applied: the summary attributes the version ranges to depthfirst.
F3 claim-not-supported	·	(low confidence) The cited depthfirst research writeup describes a rewrite with "?" in the replacement followed by a `set` directive that references a capture group. It has no "unnamed" capture and no	Applied: the Exposure clause cites depthfirst's NGINX Rift page, which carries it.
F4 hallucinated-fact	·	(low confidence) The string in quotation marks is not verbatim, and the sentence has no inline citation.	Applied: NCSC-CH's status is quoted verbatim and cited.
F3 claim-not-supported	·	(low confidence) heise states no time zone. "local time" and the UTC conversion are the entry's reading, stated flat, while the same sentence marks the DENIC conversion as "giving no time zone; read a	Applied: heise's 21:43 is converted as CEST, marked as the entry's reading.
F4 hallucinated-fact	·	(low confidence) Cisco's initial public release is 2026-06-03, not 06-04 (06-04 is the date of the folded brief entry).	Applied: the record summary dates Cisco's disclosure 2026-06-03.
F3 claim-not-supported	·	(low confidence) The MSRC FAQ gives the engine release cadence as monthly or as needed; the multiple-times-daily figure is for definitions and, as an upper bound ("up to"), for update checks.	Applied: the auto-update sentence follows Microsoft's wording.
F3 claim-not-supported	·	(low confidence) Onapsis does not say "without authentication" for this note; that comes from SAP's text quoted by BleepingComputer.	Applied: the summary attributes the unauthenticated reach to SAP.
F3 claim-not-supported	·	(low confidence) Onapsis carries the quoted sentence and the outcome, not the internal-versus-internet weighting, which is the entry's own judgement left unmarked inside the cited sentence.	Applied: the internal-versus-internet weighting is marked as analyst judgement outside the citation.
F3 claim-not-supported	·	(low confidence) NCSC-NL relays Defused ("Defused meldt"); the scanning is Defused's report, not an NCSC-NL observation. The sentence credits NCSC-NL as the reporter without the Defused attribution, w	Applied: NCSC-NL is described as relaying Defused's report.
F4 hallucinated-fact	·	(low confidence) The remediation did not fully land: "import-job" and "import" remain in this section while this fire's own correction says "No cited source calls the vulnerable endpoint an import end	Applied: the 2026-08-16 detection paragraph drops import, ETL and the normal-traffic claims and marks the scheduling heuristic as analyst judgement.
F4 hallucinated-fact	·	(low confidence, earlier-fire sentence) Defused reports exploitation attempts at honeypots; no source says the exploit works or that it was built from scratch rather than patch-diffed.	Applied: "working exploit" becomes exploitation attempts, marked as analyst judgement.
F4 hallucinated-fact	·	(low confidence) None of the five cited pages names NTLM (grep 0). Sources say "Negotiate authentication", "capture-replay" and a "captured hash". The body relay clause was cut back to Franky's wordin	Applied: the summary drops NTLM and coercion.
F3 claim-not-supported	·	(low confidence) The remediation did not land as described: the foothold conclusion is still in the text, now after the closing parenthesis, unmarked as the entry's own inference. watchTowr says only	Applied: the foothold reading is marked as analyst judgement.
F8 needs-more-research	·	The action floor is the RoguePlanet fix build. The entry records the ShieldBreak bypass (CVE-2026-69414) but not that Microsoft fixed it in a later engine, so a pinned estate that reaches 1.1.26060.30	Applied: the action floor rises to 1.1.26080.3, the ShieldBreak fix build cited to MSRC, with a section line.
F18 ?	·	(low confidence) Restates the hunting guidance of the 2026-09-13 section (audit logs for GraphQL subscription requests with abnormal argument shapes targeting Advanced Search) and rests on the thin ed	Applied: the hunting action is dropped.
F11 editorial-advisory	·	Advisory, low confidence. (1) The prior-iteration fix for the dated-before-the-event wording did not change the text: the 10 May section still reads "DENIC's addendum of 11 May 2026 states ..." with n	Applied: the 2026-05-10 section says DENIC's later addendum; kind stays policy, the stopgap the report names.
F11 editorial-advisory	·	Advisory, low confidence. sources[0] dates the Cisco advisory 2026-07-01 (the revision) although it was first released 2026-06-03 (iteration 2 raised it; only the record summary was touched). The reco	Declined: the cited revision is the 2026-07-01 one, which carries the exploitation confirmation.
F11 editorial-advisory	·	Advisory, low confidence. (1) "no fix" is in quotation marks but is not a source phrase (NCSC-CH: "no patch available"). (2) The record summary narrates references, source rating, evidence and action	Applied: the quotation marks around "no fix" are dropped; the record summary describes this fire's own change.
F11 editorial-advisory	·	Advisory, low confidence. sources[] carries https://security-hub.ncsc.admin.ch/#/posts/12935 twice (two dates). Em dashes remain in reader-facing text of several entries (nginx 4, shinyhunters 10, rog	Declined: the two NCSC-CH records carry the dates the citations use; em dashes are stripped at render.
F3 claim-not-supported	·	The Triage sentence says the advisory 'names what BeaverTail, InvisibleFerret and OtterCookie collect (browser authentication data, clipboard contents, keystrokes, screenshots and wallet data)'. The a	Applied: the Triage line says the advisory lists what the actors' infostealers target, without "freshly"; the section and record summary follow.
F3 claim-not-supported	·	(low confidence) Now that the Detection sentence carries its LevelBlue link, the clause is checkable and two parts are not on the page: the status string is written as 'not a member of the password re	Applied: the Detection line quotes LevelBlue's status string and its bulk-enumeration pattern.
F4 hallucinated-fact	·	(low confidence) The title says 'eight frontline case studies of AI agents weaponized inside real intrusions and red-team engagements'. The body, corrected in this fire, says case 6 'is an operational	Applied: the title and summary describe AI-related attacks, failures and assessments.
F4 hallucinated-fact	·	(low confidence) The evidence quote 'We are working to provide a high quality security update that addresses this vulnerability.' (publisher: Microsoft Security Response Center) is not on the cited MS	Applied: the evidence quote is Microsoft's current statement that the engine update addresses the flaw.
F3 claim-not-supported	·	(low confidence) 'The report's eight case studies, drawn from real Mandiant incident-response and offensive-security engagements' has no inline link and the report does not say it. Cases 1, 2, 3, 4, 5	Applied: the sentence says the cases are presented as observed by Mandiant, cited.
F5 missing-citation	·	(low confidence) 'LiteLLM, the open-source AI gateway/proxy widely deployed to multiplex LLM API calls in enterprise AI stacks' is cited to the CISA KEV JSON and the GitHub advisory; neither (nor Hori	Applied: "widely deployed" is dropped.
F11 editorial-advisory	·	The decline rationale ('the System32 DLL path a Windows binary loads is a platform artifact') does not hold: LevelBlue states phoneinfo.dll 'is not expected to exist natively' and lists it under 'File	Declined: the file and link names also sit in an earlier fire's append-only record summary, so removing the section's copy would not take them off the entry.
F11 editorial-advisory	·	(low confidence) The 2026-08-24 section received a 'since shipped an engine fix' pointer; the 2026-08-18 and 2026-08-21 sections still end on 'nothing to patch' with no pointer. They are dated history	Applied: the 2026-08-18 and 2026-08-21 takeaways point to the shipped fix.
F11 editorial-advisory	·	(low confidence) The two double-quoted phrases read as quotations but are not on the cited LevelBlue page (it says 'no password reset policy defined for this user' and 'not a member of the group enabl	Applied: the error codes are described in LevelBlue's wording without quotation marks.
F11 editorial-advisory	·	(low confidence) The delta remediation keeps event_date as 'a day-level estimate'; no page read gives the day (report page: 'September 2026'; Help Net Security coverage dated 2026-09-16). The earliest	Applied: event_date is 2026-09-16, the first dated coverage.
F11 editorial-advisory	·	(low confidence) sourcing_note reads 'migration: evidence backfilled from v2 brief body (item predates the Evidence footer field)', workflow-internal provenance in a reader-facing field (check 12). Th	Applied: the sourcing note describes the actual sourcing; the Check Point row stays, the two findings being linked.
F11 editorial-advisory	·	(low confidence) After the rewrites some listed sources are no longer cited anywhere in the body: Canvas lists Infosecurity Magazine (its citation was dropped in this fire); DAEMON lists the Kaspersky	Declined: uncited corroborating sources are harmless; they stay listed.
F11 editorial-advisory	·	(low confidence) The section only repeats the Exposure line now carried in the main analysis, so the changelog adds no delta beyond the main analysis; an internal record (or a section that says what c	Applied: this fire's Publica record is withdrawn: four later fires (2026-10-13 to 10-17) superseded its exposure and actions, so the entry stays as they left it.
F4 hallucinated-fact	·	The record summary (claim eaa32c4b96) says the entry carries one action covering every branch, but the iteration-2 remediation emptied actions[] and the file now reads `actions: []`; the summary was n	Applied: the record summary no longer claims an action.
F5 missing-citation	·	(low confidence) A deployment-prevalence claim with no citation that carries the downgrade of the whole entry; none of the three cited pages says it, and HeroDevs words it more weakly.	Applied: the deployment premise is marked as analyst judgement.
F3 claim-not-supported	·	(low confidence) 'must' overstates the vendors' wording: Microsoft says the mitigation 'can be removed' (MSRC), 'if you choose to remove mitigations' (June blog) and 'you should' (July blog); what is	Applied: the title says the update does not remove the mitigation.
F3 claim-not-supported	·	(low confidence) The clause ends in a Proofpoint citation, but the Proofpoint page only lists 'TA488 (Void Blizzard, Laundry Bear)' and never says that Microsoft tracks the actor under that name. The	Applied: the clause reads TA488 (also tracked as Void Blizzard and LAUNDRY BEAR).
F4 hallucinated-fact	·	(low confidence) Proofpoint says the server-side grant 'requires deliberate removal from the Exchange server' and that credential rotation and re-imaging will not evict the actor; it never mentions pa	Applied: the headline and summary say the foothold needs deliberate removal and survives password resets and re-imaging.
F4 hallucinated-fact	·	(low confidence) The iteration-2 finding (no source says the structures are Swiss- or EU-administered) was fixed in the headline and main takeaway only. The same unsourced nexus remains in two other p	Applied: the 2026-08-05 and 2026-09-02 sections drop the Swiss nexus or mark it as analyst judgement.
F4 hallucinated-fact	·	(low confidence) NZZ of 2025-06-13 reports the Federal Council's proposal and its roughly 500,000 estimate during the National Council debate; it says the Council of States had approved the register '	Applied: the 500,000 figure is described as the Federal Council's estimate, as NZZ reported in June 2025.
F9 surface-contradiction	·	(low confidence) The reader-facing record states the fix date as fact; the cited BleepingComputer page says 'the fix for the issue was released on February 19' and XLab says 'publicly disclosed as ear	Applied: the record summary gives Ghost's 2026-02-16 advisory date beside BleepingComputer's and XLab's 19 February.
F7 drop	·	(low confidence; iteration-2 finding stands) The decline rationale says the routine entry 'already reads as a short patch-cycle item'. It does not: the body is about 880 words (313 + 289 + 156 + 78) o	Declined: the code-path detail is VulnCheck's research the detection rests on; the audit lists length-guide breaches for the fires rather than cutting earlier fires' analyses.
F18 ?	·	(low confidence) A 'do now' task on an entry the record rates routine and outside the constituency's estate; it restates the body's Defender takeaway (F18 b) and joins two tasks. The do-now list is re	Applied: actions is emptied.
F11 editorial-advisory	·	(low confidence) The cited EPSS URL carries no date parameter and now returns 0.0247 and 0.0226 (2026-10-11), the 0.9324 and 0.9286 values exist only for 2026-09-04 (the sourcing note dates them). A r	Applied: the EPSS source carries its date parameter.
F11 editorial-advisory	·	(low confidence) The headline says 'Russian' where Proofpoint (and the body after the iteration-2 fix) says 'Russia-aligned'; and six em dashes remain in reader-facing sections this fire edited in pla	Applied: the headline says Russia-aligned and the edited section's em dashes are replaced.
F11 editorial-advisory	·	(low confidence, advisory) Iteration-1/2 F11 stands: three takeaways coexist, one labelled '(updated)', although this fire edited the 09-02 takeaway in place and could have folded them (check 4c-h). A	Declined: each dated takeaway belongs to its section; the main takeaway is current.
F11 editorial-advisory	·	(low confidence) None of the four cited pages (AIR, The Hacker News, Help Net Security, heise) names the public sector or any sector; the tag is unsourced (same class as the n8n finding of iteration 2	Applied: sectors is emptied.
F11 editorial-advisory	·	(low confidence, advisory) The record is internal, yet it changes a factual statement in the main analysis (an overclaim 'none exists' becomes 'none demonstrated'); a reader who relied on the old sent	Applied: the record is reader-facing with a one-paragraph section; the takeaway's em dashes are replaced.
F11 editorial-advisory	·	(low confidence, advisory) T1491.002 (External Defacement) is mapped to the hidden script-loader injection; the sources describe silent article tampering, not visible defacement. Systemic: this fire's	Applied: T1491.002 is dropped.
F4 hallucinated-fact	·	The rewritten entry says the three bugs were undisclosed and that 'there is nothing to apply from the contest result itself', and lowers priority to routine because the result 'leaves nothing to apply	Applied: the summary, takeaway and section record that CVE-2026-62911, one of the chain's bugs, was fixed in August and has public exploit code, with a reference to its entry.
F4 hallucinated-fact	·	(low confidence) The entry scopes CVE-2026-20181 to releases 3.1 to 3.5. Cisco's fixed-release table lists 'Earlier than 3.1' as 'Migrate to a fixed release.' for CVE-2026-20181 (and 'Not vulnerable.'	Applied: releases earlier than 3.1 are named for CVE-2026-20181, as Cisco's table lists them.
F4 hallucinated-fact	·	(low confidence) The iteration-2 remediation claimed the action 'no longer asserts a reachability path NLnet Labs does not state', but it still says CVE-2026-81642 'needs only that a validating resolv	Applied: the action drops the reachability clause.
F4 hallucinated-fact	·	(low confidence) The record lowers the priority because the activity is 'a single-tenant event from early June with no named sector or constituency link', but sectors still lists public-sector and tec	Applied: sectors is emptied.
F3 claim-not-supported	·	(low confidence) 'in the appliance's web access logs, internet requests to /v1/file.app whose file parameter carries a path traversal' ends on an InfoGuard citation. InfoGuard shows a JSON POST body (	Applied: the Detection line places the traversal in the JSON request body.
F4 hallucinated-fact	·	(low confidence) cves[] and the main analysis give 15.0.3 flatly, while the entry's own Contradiction line (05-20 Update section) says the CVE record NCSC-CH published lists versions before 15.0.4 and	Applied: the CVE-2026-44126 record and the main analysis state both fixed-version readings.
F4 hallucinated-fact	·	(low confidence) 923 is the page count of the quote-literal check only; the CVE-citation check read 234 pages (page-checks.txt: 'fetching 923 cited page(s) for the literal-quote check', 'fetching 234	Applied: the report gives 923 pages for the quote check and 234 for the CVE check.
F4 hallucinated-fact	·	(low confidence) The figures are the as-published (HEAD) means. On disk after this fire's records the same 34 entries average threat 10.9 and incident 3.0 (this fire added technique ids to October ent	Applied: the report labels the means as published and gives the post-record values.
F7 drop	·	(low confidence) After the correction the entry is, in its own words, 'a patch-cycle item': no exploitation, no public announcement, no workaround needed, one flaw needing administrative credentials,	Declined: the entry is routine and short; its length carries the per-release fix table.
F10 missed-angle	·	(low confidence, unverified) SOCRadar's CVE page for CVE-2026-81642 reports one public exploit entry ('public exploit, none observed'; 'after 1 public PoC repositories were reported'). The repository	Declined: unverified: no source read this fire confirms a working public PoC.
F17 ?	·	(low confidence) The sources that carry the finding are ZDI and BleepingComputer, both B in sources.json (zdi B, bleepingcomputer B); only MSRC is A, and it supports the side statement about CVE-2026-	Applied: the rating is B2, following the contest reporting.
F8 needs-more-research	·	(low confidence) The entry has Defender takeaway and Triage but no Exposure line, although its sources state the affected range (up to and including 1.26.0), the fixed release (1.26.1), the DNSSEC-val	Applied: an Exposure line with the affected range and NCSC-CH's preconditions is added.
F11 editorial-advisory	·	(low confidence) The rendered, non-internal record summary names an Admiralty code and a frontmatter field, which check 12 lists as workflow vocabulary in a reader-facing field (the iteration-2 declin	Applied: the record summary drops the rating code and the field name.
F11 editorial-advisory	·	sources[] lists CybersecurityNews (SEPPmail) and The Register (Cisco SD-WAN), cited nowhere in the text; the Register citation was removed from the one clause it did not support, so it now stands as a	Declined: uncited corroborating sources are harmless; they stay listed.
F11 editorial-advisory	·	Reader text refers to the store's own entry structure ('tracked in a separate entry'); check 12 lists 'tracked here' and 'see the <date> entry' wording.	Applied: "tracked in a separate entry" is dropped.
F11 editorial-advisory	·	(low confidence) The 10.0 reads as InfoGuard's figure; InfoGuard's page carries no score (The Hacker News and the CVE record do). The body cites it correctly.	Applied: the summary attributes the 10.0 to The Hacker News.
F11 editorial-advisory	·	(low confidence, optional) Microsoft's own 'MITRE ATT&CK Techniques observed' list carries T1190 for the App Service probing the body still describes. The drop is defensible (no credential path to thi	Declined: Microsoft found no App Service credential path to this tenant, so the drop stands.

Iteration #? NEEDS_FIXES · 64 findings (truth=26, editorial=14, advisory=24) · Claude Sonnet 5.5 · 32m 56s

F-code	Section	Verifier summary	Remediation · outcome
F3 claim-not-supported	·	Iteration-3 finding on 'must' stands; only the title was changed. No cited page says administrators must roll the mitigation back: the June blog recommends keeping it in place and says 'if you choose	Applied: the body and the 2026-07-31 takeaway say the mitigation stays in place until removed by hand, not that it must be rolled back.
F3 claim-not-supported	·	(low confidence) The watchTowr page gives no timing for its own reproduction and exposure validation and does not say the attackers worked 'independently'. It says: 'is already seeing behavioral probe	Applied: the sentence drops the timing and "independently" and gives watchTowr's own reading of the honeypot probes.
F3 claim-not-supported	·	(low confidence) The July 2026 post that terminates the clause says Exchange 2016 and 2019 updates 'are available only under the Period 2 ESU program' and are for customers enrolled in Period 2 for up	Applied: the Period 1 end date is cited to the May blog.
F4 hallucinated-fact	·	(low confidence) The iteration-3 F4 removed 'outlives the patch' from the headline and summary because Proofpoint never mentions patching, but the takeaway keeps the same inference as fact. Proofpoint	Applied: the takeaway drops patching and cites Proofpoint's deliberate-removal statement.
F4 hallucinated-fact	·	(low confidence) The frontmatter overstates the body's sources: the cited Proofpoint report and the body name government, telecommunications, finance, hospitality and aerospace targets; no cited page	Applied: healthcare and education are dropped from sectors.
F5 missing-citation	·	(low confidence) Four technical paragraphs of OWAReaper behaviour (onload= loader, hidden icon payload, autofill harvesting, GetClientAccessToken, localStorage PageDataPayload.OwaUserDefaultSettings p	Applied: the four 2026-07-31 mechanism paragraphs carry their Proofpoint citation.
F5 missing-citation	·	(low confidence) The cmdlet and property are the entry's own addition and appear on none of the cited pages (MSRC says only 'regularly verify whether ... automatic deployment ... is working'); accurat	Applied: the cmdlet example is dropped from the action.
F5 missing-citation	·	(low confidence) An uncited detection claim stated as fact in a body this fire rewrote; Kaspersky's report names no such AWS-side signal. It is a sound inference, and sibling entries mark such lines (	Applied: the AWS-side detection sentence is marked as analyst judgement.
F7 drop	·	(iteration-2/3 finding re-raised; the decline rationale does not answer check 11 / the repo rule) This fire itself rates the entry routine and says in its Correction section: 'no exploitation is repor	Declined: the length carries VulnCheck's code-path research that the detection rests on; the audit lists length-guide breaches for the fires rather than cutting earlier fires' analyses.
F8 needs-more-research	·	The body carries a Detection line only. The actionability contract requires a Defender takeaway on every entry and an Exposure line where sources support it; the cited sources clearly support both (ES	Applied: Exposure and Defender takeaway lines are added, cited to V4bel, Ubuntu and Red Hat.
F11 editorial-advisory	·	(low confidence) kind: policy is defined in site/taxonomy.yaml as 'a regulatory action, deadline or authority guidance that changes what the constituency is obliged or advised to do'; a non-adversaria	Declined: kind policy is the documented stopgap for a non-adversarial item with no honest ATT&CK mapping (report recommendation 4).
F11 editorial-advisory	·	(low confidence) The iteration-3 point on the record summary was not answered: the decline rationale addresses only the sources[0] date. The record summary still narrates the fold ('absorbing the sepa	Applied: the record summary no longer narrates the fold.
F11 editorial-advisory	·	Advisory. The section repeats the same cited fact twice back to back (a fix-up residue from the iteration-3 edit), narrates a priority change as reader text, and the title and first body paragraph sti	Applied: the duplicated fix-build sentence is removed from the section.
F11 editorial-advisory	·	Advisory (low priority; the iteration-3 advisory stands for these entries). Rule 12 allows the em dash only in the section heading. The site strips them at render and the gate checks only new text; th	Declined: em dashes are style-only and stripped at render.
F11 editorial-advisory	·	Advisory. These sentences narrate a change to the entry's own metadata (priority, framing) as reader text; rule 4c(i)/12 reserve that for an internal record or for a section that tells the reader what	Declined: the sections state why priority moved, a reader-facing fact, not record-keeping.
F8 needs-more-research	·	(low confidence) The actionability contract requires a Defender takeaway on every entry; this high-priority exploited-CVE entry has Exposure, Detection and Contradiction lines but no takeaway (the dec	Applied: a Defender takeaway line is added, cited to CERT-EU and CCB.
F8 needs-more-research	·	A KEV-listed, priority-high LiteLLM RCE entry carries none of the labelled lines and no interim mitigation. Both cited sources clearly support them and the trimmed action no longer carries them: GHSA	Applied: Exposure, Detection and takeaway lines with the advisory's workaround are added and the record is reader-facing with a section.
F11 editorial-advisory	·	(low confidence) Style rule: no em dash in reader-facing entry text. Declined in earlier iterations as stripped at render; body was rewritten this fire so the text is in scope. Advisory only.	Declined: em dashes are style-only and stripped at render.
F11 editorial-advisory	·	(low confidence) No cited page (watchTowr, ZDI, eSentire, The Hacker News, CISA alert, KEV record) names the telco or public sector or any sector; the tag is unsourced, the same class as the plugin4sh	Declined: sector tags are the profile's relevance call, not a source claim.
F3 claim-not-supported	·	(low confidence) The cited risk-matrix page carries the component, HTTP protocol, 'Remote Exploit without Auth: Yes' and 9.8, but not the words 'take over' (they are in Oracle's English-text version,	Applied: the takeover wording cites Oracle's risk-matrix text and the payment-engine description Help Net Security.
F11 editorial-advisory	·	(low confidence) Style rule: no em dash in reader-facing entry text; the body was re-written this fire. Advisory only.	Declined: em dashes are style-only and stripped at render.
F11 editorial-advisory	·	(low confidence) No cited page (JetBrains advisory, follow-up, Cadence post, CISA alert, KEV record) names any sector; the four sector tags are unsourced, the same class as the plugin4shell, n8n and S	Declined: sector tags are the profile's relevance call, not a source claim.
F3 claim-not-supported	·	(low confidence) The cited SAP page row carries the note number, CVE id, CVSS 8.1 and the title 'Potential buffer overflow vulnerability affects SAP Commerce Cloud in public-cloud deployments with NGI	Applied: Note 3773203 is described in SAP's own words, without upstream or downstream framing.
F3 claim-not-supported	·	(low confidence) NCSC-NL relays Defused's report that attackers are actively scanning and seeking vulnerable Data Hub Adapter systems; it does not mention honeypots or exploitation attempts, and the c	Applied: the correction separates Defused's honeypot attempts from its scanning report, which NCSC-NL relays, each cited.
F4 hallucinated-fact	·	(low confidence) No cited source says a working exploit exists: BleepingComputer reports Defused's first exploitation attempts at honeypots, 'no public PoC' and 'no party reports a compromised product	Applied: the 2026-08-16 sentence says exploitation attempts appeared within days.
F11 editorial-advisory	·	(low confidence) Reader-facing section narrates the edit ('The main analysis now records...') rather than stating a delta; same class as the TeamCity record-keeping sentence of iteration 3, which was	Applied: the record-keeping sentence is removed from the correction section.
F8 needs-more-research	·	(low confidence) The cited SAP patch-day page states the affected release identifiers (CVE-2026-58231: COM_CLOUD 2211, 2211-JDK21; CVE-2026-44772: XMII 15.4, 15.5, MII_ADMIN 15.4, 15.5; CVE-2026-44758	Applied: the Data Hub Adapter record names COM_CLOUD 2211 and 2211-JDK21; the body keeps its prose labels.
F11 editorial-advisory	·	(low confidence) Only retail (BleepingComputer: 'online stores owned by ... large retailers') and arguably manufacturing (MII) have a source; public-sector and finance are named by none of the cited p	Declined: sector tags are the profile's relevance call, not a source claim.
F11 editorial-advisory	·	(low confidence) No cited page (Onapsis x3, CERT-EU, BleepingComputer, Senthorus) names the public sector or any sector; the tag is unsourced. Title ('... (CVE-2026-58240, CVSS 9.8), two unauthenticat	Declined: sector tags are the profile's relevance call, not a source claim.
F3 claim-not-supported	·	(low confidence) The advisory says StoatWaffle uses 'a malicious VS Code configuration file that triggers auto-run code execution when the folder is opened and trusted'. It names '.vscode/tasks.json'	Applied: the Triage line uses the advisory's words: a malicious VS Code configuration file that runs when the folder is opened and trusted.
F11 editorial-advisory	·	(low confidence) The advisory names individual IT professionals, web freelancers, crypto/Web3 specialists, a Japanese crypto exchange and 'businesses that outsource or commission work via crowdsourcin	Declined: the advisory's targets are described in the main analysis; the summary's framing stays.
F3 claim-not-supported	·	(low confidence) The sentence chains a Talos-only fact (the actor's PoC and sqlmap attempt to retrieve user information) with GLPI-advisory facts (unauthenticated SQLi in the inventory endpoint, fixed	Applied: the PoC and sqlmap clause cites Talos.
F4 hallucinated-fact	·	(low confidence) Talos hedges this phase: 'We also identified traces indicating that the VHDX files were compressed with zstd and transferred to cloud storage services such as Wasabi using rclone ...	Applied: the summary and body say Talos found traces indicating the chunked rclone upload.
F4 hallucinated-fact	·	(low confidence) 'Equally exploitable' is the entry's comparison, not AIR's. AIR says only that 'git gives an attacker two ways to exploit it' and calls the result zero-click across all four. The Hack	Applied: "equally exploitable" is dropped.
F11 editorial-advisory	·	(low confidence) None of the six cited pages (SolarWinds release notes and two trust-center advisories, NCSC-NL, CERT-FR, GBHackers) names the public sector or any sector; the tag is unsourced, the sa	Declined: sector tags are the profile's relevance call, not a source claim.
F5 missing-citation	·	(low confidence) About twenty named tools and behaviours (NetScan/SoftPerfect/Nmap, MeshAgent renaming, Atera/Splashtop/ScreenConnect/NinjaRMM, Cloudflared service, ngrok, ntdsutil IFM, Mimikatz/LaZag	Applied: the discovery, toolchain and Defender XDR sentences cite Microsoft, and "redundant" is dropped.
F11 editorial-advisory	·	(low confidence) Em dash in reader-facing title and body. Advisory only.	Declined: em dashes are style-only and stripped at render.
F11 editorial-advisory	·	(low confidence) Em dash in reader-facing text (actions[1]: '... XSL files; the patch alone does not remove the vulnerable servlet'). Advisory only.	Declined: em dashes are style-only and stripped at render.
F3 claim-not-supported	·	The terminating Bishop Fox citation does not carry the clause "no fix for the end-of-support trains" or "upgrading is the only remediation". Bishop Fox only lists the fixed takes and says earlier take	Applied: the end-of-support statement follows sk1000171, cited.
F4 hallucinated-fact	·	(low confidence) The entry now lists R82.20 as affected and gives only the "R82.20 Security Hotfix" as its fix. The primary vendor page also lists a Jumbo Hotfix Accumulator for R82.20 from Take 10 as	Applied: the R82.20 Jumbo Hotfix Take 10+ fix is added to the body and cves[], and the record is reader-facing with a section.
F4 hallucinated-fact	·	(low confidence) The prior-iteration fix named releases earlier than 3.1 in the main text, Exposure line and cves[], but the Correction section still scopes the flaw "from 3.1", and the headline still	Applied: the correction section and headline name releases earlier than 3.1.
F4 hallucinated-fact	·	(low confidence) The figure 44 does appear in reporting by NL Times, the outlet the entry already cites for the Dutch universities: 44 Dutch universities, applied-sciences universities and secondary s	Applied: the correction says the 44 are names on the actor's own list as BNR reviewed it, cited to NL Times.
F4 hallucinated-fact	·	(low confidence) event_date is the date of the NCSC-CH corroborating post (2026-05-15). The first (primary) source is depthfirst, dated 2026-05-13, and the body itself says "F5 released the advisory o	Applied: event_date is 2026-05-13.
F4 hallucinated-fact	·	(low confidence) The entry's own summary says "Cisco's advisory of 2026-06-17" and sources[0] carries date 2026-06-17, while event_date is 2026-06-18 (the SecurityWeek date).	Applied: event_date is 2026-06-17.
F8 needs-more-research	·	(low confidence) The record that touched cves (fields: summary, cves, ...) left affected and fixed null although the body and the cited nginx.org page give exact ranges. Every other vulnerability entr	Applied: the CVE record carries the affected and fixed ranges.
F7 drop	·	(low confidence) The declined rationale ("the entry is routine and short; its length carries the per-release fix table") answers length, not the check 11 relevance bar. The entry says itself that "the	Declined: routine entries record the fix tables of products the constituency runs; the relevance call stands.
F7 drop	·	(low confidence) Seven post-authentication flaws, no exploitation reported (the entry says "No source reports exploitation" and "a standard patch-cycle upgrade"), no sourced nexus after this fire remo	Declined: routine entries record the fix tables of products the constituency runs; the relevance call stands.
F7 drop	·	(low confidence) Five flaws that each need an authenticated workflow editor, no exploitation reported, priority already routine ("The priority moves from notable to routine"). Same check 11 question a	Declined: routine entries record the fix tables of products the constituency runs; the relevance call stands.
F7 drop	·	(low confidence) US military personnel-data breach with no vector, class or actor (the body says so), no Swiss or constituency nexus, and the only transferable lesson is "encrypt identifying fields at	Declined: an earlier fire's routine incident entry; the audit does not drop entries on a relevance call alone.
F11 editorial-advisory	·	(low confidence) Only "and is used as the primary" was removed. The note still carries composition rationale: "Each number is attributed to the vendor that published it rather than merged into a singl	Applied: the composition sentences are cut from the sourcing note.
F11 editorial-advisory	·	(low confidence, advisory) The record says four sentences "no longer narrate the entry's own record-keeping", yet three entry-referential sentences remain in reader-facing text. The decline rationale	Applied: the three self-referring sentences are reworded.
F11 editorial-advisory	·	(low confidence, advisory) Both internal records change reader-facing body text that carries a factual claim: Nexus "forces the device to reload" became "could cause the device to reload" in body and	Declined: both changes are wording alignments within the internal allowance on Nexus; Check Point is now reader-facing with a section.
F11 editorial-advisory	·	(low confidence, advisory) Check 12 forbids em dashes in reader-facing text (only the section heading is exempt). The entries rewritten from scratch this fire (GLPI, Instructure, n8n, FortiClient and	Declined: em dashes are style-only and stripped at render.
F3 claim-not-supported	·	(low confidence) The clause about what the CVE record lists is chained into a sentence that ends on an InfoGuard citation, and no cited page carries it: InfoGuard only has the table row "15.0.3 \| CVE-	Applied: the 15.0.4 reading is now cited to NCSC-CH's advisory, which states it, in the main analysis and the contradiction line.
F3 claim-not-supported	·	(low confidence) Only BleepingComputer dates the fix release to 19 February; XLab says the flaw "was publicly disclosed as early as February 19", a disclosure date, not a fix release. The iteration-3	Applied: the record summary attributes the 19 February fix date to BleepingComputer and the disclosure date to XLab.
F4 hallucinated-fact	·	(low confidence) The iteration-3 finding named this inference in both the action and the takeaway; the remediation removed it from the action only. No source says the prerequisite is independent of at	Applied: the takeaway gives NCSC-CH's precondition, cited, and marks the resolver reading as analyst judgement.
F4 hallucinated-fact	·	(low confidence) The audit report row lists "CVE-2025-39682 had no lower bound" as a defect with ground truth "first affected version 6.0" and "correction (internal)" as the fix, but the entry's range	Applied: the CVE-2025-39682 range now starts at 6.0.
F4 hallucinated-fact	·	On disk 117 existing entries carry exactly one record with run_id 2026-10-11T1307Z-audit (102 corrections, 13 improvements, 2 updates, 27 internal; plus the one new entry NeedyMantis = 118 entries tou	Applied: the report, CHANGELOG and run-record notes give 117 entries: 102 corrections, 13 improvements, 2 updates, 25 internal.
F4 hallucinated-fact	·	state/source_health.json is not modified in this commit (git status clean for it), and its stored history holds no run of the audit's 238-source sweep: the newest 12 runs begin at 2026-10-12T03:23Z an	Applied: the report says the file is unchanged because the 2026-10-18 weekly snapshot on main supersedes this fire's sweep.
F4 hallucinated-fact	·	(low confidence) The sources.json diff shows seven records gaining fetch_method rss plus an rss_url (elastic-seclabs, jpcert, kaspersky-securelist, malwarebytes, proofpoint, socket-dev-blog, frenchbre	Applied: the report and record give seven feed recipes and six notes; eset's recipe reached main through a later fire.
F11 editorial-advisory	·	(low confidence, advisory) The rendered record summary ends "the rating follows the B-rated contest reporting", an Admiralty letter in a reader-facing field (check 12; the same wording was removed fro	Applied: the title names CVE-2026-62911 as the chain bug fixed later; the CVE stays in the CVE-2026-62911 entry, which this entry references.
F11 editorial-advisory	·	(low confidence, advisory) Em dashes remain in reader-facing text ("...intrusions (GIFTEDCROOK via UAC-0226...", "CVE-2025-8088) a path traversal ... nearly a year after the fix"); the iteration-3 del	Applied: the record summary drops "registry"; em dashes are style-only and stripped at render.
F11 editorial-advisory	·	(advisory) Reader text refers to the store's own structure and to unsourced advice as the entry's own: "the entry's own advice is to rename or disable the default psoft/oracle/linuxadm OS accounts", "	Applied: the self-references are reworded and the duplicated evidence record is removed.
F11 editorial-advisory	·	(low confidence, advisory) The oss-security announcement rates one flaw critical (CVE-2026-81642) and two high (CVE-2026-81634, CVE-2026-82717), so CVE-2026-81634 is the second flaw rated high, not a	Applied: "a third" becomes "another" high-rated flaw.

Iteration #? NEEDS_FIXES · 43 findings (truth=15, editorial=6, advisory=22) · Claude Sonnet 5.5 · 29m 08s

F-code	Section	Verifier summary	Remediation · outcome
F3 claim-not-supported	·	Iteration-3/4 "must" finding remains in the 2026-07-31 section: the remediation fixed the main analysis and the takeaway only. Para 1: "with the mitigation now something that must be actively torn dow	Applied: the 2026-07-31 section says administrators should remove the mitigation, as Microsoft's July post puts it.
F4 hallucinated-fact	·	(low confidence) Hedge dropped: "Proofpoint reads the unusual breadth as intentional blending with bulk mail."	Applied: the sentence keeps Proofpoint's "may have been".
F4 hallucinated-fact	·	(low confidence) "the implant writes an AES-encrypted copy of itself and a decryption wrapper into browser localStorage"; Proofpoint does not name AES for the localStorage copy (AES-CTR is stated only	Applied: "AES-encrypted" becomes "encrypted", as Proofpoint says.
F4 hallucinated-fact	·	(low confidence) "Public-sector and university SOCs running PeopleSoft Campus Solutions or HCM should audit external reachability of the web/app tier as the first action." No cited page names Campus S	Applied: the sentence drops the application names and "first action" and is marked as analyst judgement.
F4 hallucinated-fact	·	(low confidence) Iteration-4 F4 was fixed in the takeaway and action only. The main analysis still ends: '"...parsed" ([NCSC Switzerland, 2026-09-18](...)), a normal condition for any DNSSEC-validatin	Applied: the main analysis marks the resolver reading as analyst judgement.
F4 hallucinated-fact	·	(low confidence, minor) Hedge dropped: "then ran nmap and masscan against externally exposed hosts and internal services once inside". Talos hedges the use.	Applied: the sentence keeps Talos's "appear to have used".
F8 needs-more-research	·	(low confidence) Iteration-4 F8 was remediated for CVE-2026-58231 only. Four cves[] records still say "see SAP Security Note ..." although the cited SAP patch-day page lists the releases; a responder	Applied: the four remaining CVE records name the releases SAP's patch-day page lists.
F9 surface-contradiction	·	(low confidence) The advisory is dated 2026-09-17 (its structured record's published field), yet BleepingComputer (2026-09-15) and Help Net Security (2026-09-16) already link and quote the same SEC-10	Declined: the cited date is the advisory's own published stamp; the earlier reporting quotes the advisory without dating it.
F11 editorial-advisory	·	(advisory) Iteration-4 F11 only partly remediated (title). The reader-facing record summary still ends "the rating follows the B-rated contest reporting" (Admiralty letter in a reader-facing field, ch	Applied: the record summary drops the rating clause.
F11 editorial-advisory	·	(advisory) The duplicate sentence is gone, but em dashes remain in the title ("CVE-2026-50656, Microsoft Defender ...") and body ("closes it, last vulnerable ..."), the section narrates "The priority	Applied: "in the entry's reading" becomes analyst judgement; em dashes are style-only and stripped at render.
F11 editorial-advisory	·	(advisory) Iteration-4 said the self-references were reworded, but two remain on disk: "Action: see the § 0 callout, patch out-of-band and compromise-assess" (2026-06-12 section) and "adapting to the	Applied: the section reference and the self-referring coverage clause are reworded.
F11 editorial-advisory	·	(advisory) "Relabels the closing line as the Defender takeaway, the label the rest of the store uses." is record-keeping narration with store vocabulary in a rendered record summary.	Applied: the record summary drops the store-label clause.
F11 editorial-advisory	·	(advisory) sourcing_note (listed in this fire's record fields) is a nine-sentence argument with two "see body" pointers, not two sentences of provenance. The correction section ends "The takeaway had	Declined: the sourcing note sets out why the sources disagree, which is provenance.
F11 editorial-advisory	·	(advisory, low confidence) Declined iteration-4 point re-checked: sectors public-sector and finance appear on no cited page (BleepingComputer names retailers; manufacturing via MII), and the equivalen	Declined: sector tags are the profile's relevance call, not a source claim.
F11 editorial-advisory	·	(advisory, low confidence) The iteration-4 remediation removed the fold narration from the record summary. The body still never states Cisco's initial release date (2026-06-03, three weeks before expl	Declined: the record summary states the disclosure date; the body cites the advisory revision it relies on.
F11 editorial-advisory	·	(advisory, previously declined as style-only) Em dashes remain in titles of the nginx, RoguePlanet, MRSProxy, Chosen Brick and Acronis entries and in bodies of nginx, PeopleSoft, SAP, MRSProxy, Cisco	Declined: em dashes are style-only and stripped at render.
F3 claim-not-supported	·	(low confidence) The Detection line states 'SES-sent messages carry `.amazonses.com` in the Message-ID header' as an unhedged detection premise and cites Kaspersky; Kaspersky says the header 'almost a	Applied: the Detection line keeps Kaspersky's "almost always".
F3 claim-not-supported	·	(low confidence) 'Elastic ... points to the Dune-derived naming the payload reuses as the similarity to previous Shai-Hulud campaigns' binds two separate Elastic statements together. Elastic says the	Applied: the Dune references and the similarities to earlier campaigns are stated separately, as Elastic does.
F4 hallucinated-fact	·	(low confidence) The CVE record (kernel CNA) lists stable series 5.4.73 (<5.5), 5.8.17 (<5.9) and 5.9.2 (<5.10) as affected as well as 5.10 onward, with no fix in any of them (all end of life). The af	Applied: the affected range names the 5.4.73+, 5.8.17+ and 5.9.2+ stable series with no fix.
F7 drop	·	(low confidence) This fire's own Correction says 'no exploitation is reported, a vendor fix has existed since 2026-09-01, the root path needs an existing suspended billing account, and Virtualizor sit	Declined: the length carries VulnCheck's code-path research that the detection rests on; the audit lists length-guide breaches for the fires rather than cutting earlier fires' analyses.
F8 needs-more-research	·	(low confidence) The affected field names OS platforms and 'fully patched as of the August 2026 updates', the LevelBlue test environment. Microsoft's record scopes the flaw to Malware Protection Engin	Applied: the affected field names Malware Protection Engine 1.26070.7 and earlier.
F11 editorial-advisory	·	Advisory. Em dashes in reader-facing text (rule 12, only the '## Type; at' heading is exempt). Mandiant's title ('ANNUAL REPORT, ...') and its case-study headings were edited by this fire and kept the	Declined: em dashes are style-only and stripped at render.
F11 editorial-advisory	·	Advisory (low confidence). The 2026-05-10 Update section now reports 'DENIC's later addendum of 11 May 2026', a date after the section's own heading, and the same HSM finding appears in the main analy	Declined: the 2026-05-10 section names the later addendum, which is the dated fact.
F11 editorial-advisory	·	Advisory (low confidence). The containment paragraph now states OX's dead man's switch, Elastic's revoke guidance, and then repeats both inside a bold 'Dead man's switch:' sentence; the Correction	Declined: the containment paragraph attributes each statement to its vendor.
F11 editorial-advisory	·	Advisory (low confidence). The Correction says 'the entry no longer presents the campaign as conference-targeted', but the title now reads 'A phishing chain reported against conference attendees' and	Declined: the title names the lure, not the attendees as targets.
F11 editorial-advisory	·	Advisory. 'The entry moves to routine priority: no exploitation is reported, ... and Virtualizor sits outside the typical public-administration estate' narrates a metadata change as reader text (rule	Declined: the section states why priority moved, a reader-facing fact.
F11 editorial-advisory	·	Advisory (low confidence). 'R80 through R81' spans R81.10, which sk1000171 marks end of support but does list a fix for (Jumbo Hotfix Take 192+), and which the same sentence lists as fixed. The sk lis	Declined: R80 through R81 names the R81 line, distinct from R81.10.
F11 editorial-advisory	·	Advisory. The hotfix is the fix, so 'no fix exists short of upgrading' is tautological, and the cited pages neither state nor refute that no workaround exists for these two CVEs (the 'no workaround' s	Declined: style-only wording.
F11 editorial-advisory	·	Advisory (low confidence). PHP's GitHub advisory scores CVE-2026-7262 at 6.3, but PHP's own CVE record (CNA) scores it 2.9 (CVSS 4.0, E:P). The entry states the advisory/CVE-record difference for CVE-	Declined: the entry gives the advisory's score; the CNA difference is minor and noted for the next fire.
F11 editorial-advisory	·	Advisory (low confidence). Routine incident with no vector, class or actor (the body says so), no constituency nexus and one generic lesson ('encrypt at rest', supported only by CNN's 'standard securi	Declined: an earlier fire's routine incident entry; the audit does not drop entries on a relevance call alone.
F3 claim-not-supported	·	Residual of the iteration-4 F3 on this entry. The remediation fixed the Triage line to the advisory's wording, but the newest section (this fire's own) still says the advisory describes a 'tasks file'	Applied: the correction section and record summary use the advisory's wording: a malicious VS Code configuration file that runs when the folder is opened and trusted.
F16 ?	·	Priority calibration. The entry records a KEV-listed, publicly exploitable, distribution-portable kernel root flaw whose own takeaway is patch-now, yet carries notable. Its sibling, the Dirty Frag ent	Declined: Copy Fail is a local privilege escalation fixed since April whose KEV deadline passed in May; Dirty Frag stays high because CVE-2026-46300 reopens its primitive on patched kernels and public exploits target…
F11 editorial-advisory	·	Three takeaway blocks accumulate across the entry (main analysis, 2026-09-01 section, 2026-09-02 section labelled '(updated)'). The 2026-09-02 one addresses a different finding (the Swiss register) an	Declined: each dated takeaway belongs to its section; the main takeaway is current.
F11 editorial-advisory	·	Legacy text outside this fire's diff (this fire only added references[]): the action ends in a dangling section pointer '(§ 4)' that refers to nothing in the entry, and the action list renders into th	Applied: the dangling section reference is removed from the action.
F14 ?	·	(low confidence) Residual of the iteration-4 F3: the body sentence now drops the timing, but the title still says 'honeypots caught exploitation attempts one day after the patch', the headline 'went f	Applied: the title, headline and summary say watchTowr's honeypots recorded probes by 2026-09-11, the day after the patch, without the 24-hour arithmetic.
F3 claim-not-supported	·	(low confidence) The row's KEV cell is not carried by the page the row cites. The Check Point blog says nothing about the KEV catalog. The fact is true (KEV record dateAdded 2026-06-08) but the citati	Applied: the Check Point row, which has its own entry, is removed from the table.
F3 claim-not-supported	·	(low confidence) The citation terminates a clause chain whose first half, 'Starlette to 1.0.1 or later', is not on the GitHub advisory; only Horizon3 carries it, and Horizon3 is cited only at the end	Applied: the Starlette fix version cites Horizon3 directly.
F4 hallucinated-fact	·	The list names eight feed recipes (eset included) and five notes. On disk this fire changed seven feed recipes and six notes: the eset record gained only a note (fetch_method rss and rss_url are uncha	Applied: eset moves from the feed-recipe list to the notes list in section 8.
F4 hallucinated-fact	·	(low confidence) Stale against disk. The Bitget entry's evidence record was replaced after the 15:08 re-run: the quote the re-run flagged ('the attacker may have exploited a vulnerability in a third-p	Applied: the report and the run record say the Bitget warning is cleared by the evidence quote's current wording.
F5 missing-citation	·	(low confidence) An uncited detection claim stated as fact. GitLab's release notes describe the two flaws but name no telemetry or discriminator; this is the entry's inference. The section predates th	Applied: the detection sentence is marked as an inference from the mechanism.
F11 editorial-advisory	·	(advisory, low confidence) Record-keeping narration in a reader-facing section; the factual delta (affected range, Starlette condition, workaround) can stand without it. Also: frontmatter affected_pro	Applied: the section opens on the facts; affected_products stays as published, the products being named in the CVE records.
F11 editorial-advisory	·	(advisory, low confidence) Self-references to the entry in reader-facing text (check 12). Instructure still tags region uk although no fetched cited page reports UK impact (the unsupported UK-universi	Applied: the Splunk record summary and the GitLab section no longer refer to the entry itself, and Instructure drops the uk region.
F11 editorial-advisory	·	(advisory, low confidence) (a) The main analysis sentence, read after the 2026-09-23 backports, is wrong for 19.0.9 and 18.11.12 (fixed, but numerically below 19.1.8); the newest section corrects it a	Applied: the main analysis names the 19.0.9 and 18.11.12 backports; the candidate-source list keeps the re-sweeps' strongest proposals only.

Iteration #? NEEDS_FIXES · 47 findings (truth=19, editorial=8, advisory=20) · Claude Sonnet 5.5 · 30m 15s

F-code	Section	Verifier summary	Remediation · outcome
F3 claim-not-supported	·	(low confidence) Both sentences narrow the source: Securelist says the PDFs held 'only payment details and supporting documentation'. 'Payment-only PDFs' is offered as a mail-gateway detection premise	Applied: both sentences say the PDFs held only payment details and supporting documentation, as Securelist does.
F4 hallucinated-fact	·	(low confidence) 'Attackers use leaked IAM access keys, not separate SES API credentials.' is stated flatly. Securelist says 'In most cases' and never discusses separate SES API credentials, so the ex	Applied: the correction keeps Securelist's "in most cases" and drops the SES API credential contrast.
F4 hallucinated-fact	·	(low confidence) Microsoft describes the beacon cookie as carrying Base64-encoded, compressed JSON (computer name, user, parent process, Program Files listing, process list) and never calls it oversiz	Applied: the Detection line describes the cookie as carrying Base64-encoded compressed system information, without a size.
F8 needs-more-research	·	(low confidence) Xint's 'Stealthy' paragraph says the corrupted page is never marked dirty and on-disk checksum comparisons miss it. The Detection line omits it, so a responder could lean on file-inte	Applied: the Detection line adds Xint's point that on-disk checksum and file-integrity tools miss the page-cache corruption.
F11 editorial-advisory	·	Em dashes remain in reader-facing text (iteration 5 raised the same; the audit report calls them style the site strips at render). Advisory, may be left.	Declined: em dashes are style-only and stripped at render.
F11 editorial-advisory	·	Advisory. Both reader-facing sections narrate a priority change as the content of the section, and the Virtualizor one asserts the estate fact with no source (a relevance judgement; the audit treats t	Declined: the sections state why priority moved, a reader-facing fact.
F11 editorial-advisory	·	(low confidence) Beyond public-sector (which the audit declares the profile's call), these tags appear on no cited page: SAP finance; FortiSandbox technology, defense, healthcare; SonicWall finance, e	Declined: sector tags are the profile's relevance call, not a source claim.
F11 editorial-advisory	·	Advisory (declined in iteration 5 as style). The hotfix is the fix, so the clause is tautological, and neither SNWLID-2026-0016 nor the cited outlets state whether a workaround exists for these two CV	Declined: style-only wording.
F11 editorial-advisory	·	(low confidence) File-name and marker-string indicators in reader text; rule 12 forbids file-name indicators. Describe the disguise as a fake Fortinet endpoint patch and the markers as OpenAI-style te	Declined: earlier fires' text outside this fire's changes; the names are the vendor's published hunting artefacts, left for the next record on those entries.
F11 editorial-advisory	·	(low confidence) 'On the FortiGate itself, the administrator accounts, passwords and REST API keys the advisory says to review are recorded in the device's configuration and administrator audit log, w	Declined: an earlier fire's section outside this fire's changes; left for the next record on the entry.
F11 editorial-advisory	·	(low confidence) The ACSC alert page now reads 'Published 25 Sep 2026' (time datetime=2026-09-25T12:00:00Z). Cyber Daily and Australian Cyber Security Magazine both say the alert is dated 24 September	Declined: the cited date is the alert's original publication, which two outlets also give; the page now shows a later revision date.
F3 claim-not-supported	·	The cited sk1000171 no longer carries the indicator set the entry describes. Entry: "Detection concept, per Check Point's own two independent indicators of compromise ([Check Point Support, sk1000171]	Applied: the detection paragraph follows sk1000171 as revised on 2026-10-13 (four log indicators), the action and immediate action no longer say the indicators miss the exploit route, and the section records the…
F3 claim-not-supported	·	(low confidence) Dune references and the similarities to earlier campaigns are now stated separately and correctly, but "Elastic frames the wave explicitly as the return of Shai-Hulud rather than a ne	Applied: "explicitly" and "rather than a new family" are dropped.
F3 claim-not-supported	·	(low confidence) "Cisco's guidance is to corroborate against firewall and network logs external to the ISE node for unexpected outbound uploads or downloads to unfamiliar IP addresses" paraphrases Cis	Applied: the triage line and immediate action use Cisco's wording: uploads initiated from the device to external IPs or downloads from malicious IPs.
F3 claim-not-supported	·	(low confidence) "the script recovered from exposed servers spreads over SSH and drops ransom notes, with exfiltration a separate step ([BleepingComputer, 2026-06-10])": BleepingComputer describes the	Applied: the exfiltration clause cites Mandiant.
F4 hallucinated-fact	·	(low confidence) The action tells readers to "Treat any instance that was internet-reachable and unpatched at any point since 27 May 2026 as compromised until proven clean". Mandiant's guidance is con	Applied: the action says to investigate exposed instances and treat hosts with a web shell as compromised, as Mandiant does.
F4 hallucinated-fact	·	(low confidence) "review `authorized_keys` and `/etc/hosts` for unauthorised additions" implies the actor adds entries to those files. BleepingComputer says the script only parses /etc/hosts and falls	Applied: the /etc/hosts check is dropped and the authorized_keys check is marked as analyst judgement.
F5 missing-citation	·	(low confidence) "the 46-member Strasbourg human-rights body, of which Switzerland is a member": the cited SecurityWeek page gives 46 member states and 27 EU countries and does not name Switzerland; t	Applied: the uncited Swiss-membership clause is dropped.
F9 surface-contradiction	·	(low confidence) The decline said earlier reporting quotes the advisory 'without dating it'. Help Net Security (2026-09-16) dates it: 'in the security advisory published on Tuesday' (2026-09-15), and	Applied: a contradiction line notes the record stamp of 2026-09-17 against Help Net Security's Tuesday, 2026-09-15.
F9 surface-contradiction	·	(low confidence) The entry states the intrusion occurred "overnight into 2026-07-30" (government release and SRF). The Record, cited for the 31,000 figure and the wealth-management remark, says the at	Applied: the timeline notes The Record's two days of access from 29 July beside the government's overnight-into-30-July account.
F11 editorial-advisory	·	Advisory. Em dashes remain in reader-facing text this fire edited: ChainDrop title and summary, Mandiant title ('ANNUAL REPORT, ...') and 'Case study N, ' headings, Acronis title, Liechtenstein summar	Declined: em dashes are style-only and stripped at render.
F11 editorial-advisory	·	Advisory (prior F11 declined with a rationale about attribution, which does not address repetition). The paragraph states OX's dead man's switch, then Elastic's revoke guidance and its 'intimidate' re	Declined: the paragraph attributes each statement to its vendor.
F11 editorial-advisory	·	Advisory (prior F11 declined). This fire rewrote the block's text but kept the label 'updated' beside the main takeaway; it addresses a different finding (the Swiss register) and replaces nothing, so	Declined: each dated takeaway belongs to its section; the main takeaway is current.
F3 claim-not-supported	·	(low confidence) Adjacency: the clause 'The known operational side effects of the mitigation era (...) only clear once both steps are done, so a server left on mitigation-only status keeps them indefi	Applied: the side-effects sentence cites the May post for the list and the July post for their clearing, without "indefinitely".
F5 missing-citation	·	(low confidence) The sentence carries no inline citation (the iteration-5 finding noted this; the remediation changed 'must' to 'should' only). The content is in the July blog (cited a few sentences e	Applied: the rollback sentence cites the July post.
F4 hallucinated-fact	·	(low confidence) Hedge strengthened: Proofpoint says the invisible pop-up is 'the same sized' but the error-handling and reporting mechanisms are 'highly similar', not identical.	Applied: the sentence keeps Proofpoint's "the same sized, invisible pop-up" and "highly similar" error handling.
F4 hallucinated-fact	·	(low confidence) NCSC-CH did not restate Proofpoint's analysis; its advisory only gained a one-line update pointing to the Proofpoint post.	Applied: the 2026-08-30 section says NCSC-CH's post added a link to Proofpoint's analysis.
F11 editorial-advisory	·	(advisory, low confidence) The evidence quote carries markdown underscores (a jina-style rendering of <em>) that are not in the page text; as published it is not a contiguous verbatim substring of the	Applied: the evidence quote drops the markdown underscores.
F3 claim-not-supported	·	(low confidence) Same defect class as the iteration-5 Check Point row, which was removed rather than repaired: the surviving row's KEV cell 'Yes (2026-06-08)' and Exploited cell 'Yes (CISA-confirmed)'	Applied: the table row's source cell adds the KEV catalog for the KEV date.
F11 editorial-advisory	·	(advisory, low confidence) The iteration-5 decline rests on the products being named in the CVE records, but this entry's cves[] records carry no 'affected' field, so no frontmatter field names LiteLL	Declined: the product is named in the title and the table; affected_products is left for the next record on the entry.
F11 editorial-advisory	·	(advisory, low confidence) A file-name indicator remains in reader-facing text (and in that 08-24 record's summary) although this fire dropped the action that named the same file as an indicator; the	Declined: the file and link names also sit in an earlier fire's append-only record summary, so removing the section's copy would not take them off the entry.
F5 missing-citation	·	(low confidence) Uncited detection claim naming an event id and logon type that none of the six cited sources gives; the audit rewrote comparable hunting lines on the PAN-OS entry for exactly this rea	Applied: the detection concept is marked as analyst judgement.
F11 editorial-advisory	·	(advisory) The iteration-5 decline ('the sourcing note sets out why the sources disagree, which is provenance') does not meet the sourcing_note standard of two sentences of provenance: the note argues	Declined: the sourcing note sets out why the sources disagree, which is provenance.
F4 hallucinated-fact	·	(low confidence) The record says the action now names only what watchTowr says a request could read, but 'CI/CD credentials' is not watchTowr's list: watchTowr says the readable files can include 'con	Applied: the action uses watchTowr's wording: configuration files, secrets or other sensitive server-side data.
F11 editorial-advisory	·	(advisory, low confidence) The record summary says 'Ransomware.live's Kairos page lists at least four', which the section does not state and which no cited page carries (the section says only that no	Applied: the record summary no longer cites an uncited Ransomware.live count.
F9 surface-contradiction	·	(low confidence) The two Huntress pieces list different NetSupport persistence (write-up: keyboard-filter driver, service, Winlogon, its own COM object; recap: keyboard filter driver, service, Winlogo	Applied: the contradiction line adds the two pieces' differing NetSupport persistence lists.
F11 editorial-advisory	·	(advisory, low confidence) The iteration-5 decline ('the title names the lure, not the attendees as targets') does not hold literally: the title still reads 'reported against conference attendees', so	Declined: the title names the lure, as Huntress's write-up describes it.
F11 editorial-advisory	·	(advisory, low confidence) The reader-facing Improvement section restates, in one sentence, the Defender takeaway this same record adds to the main analysis, so a reader meets the 24h/72h and no-block	Declined: the section states the reader-facing delta once; the main analysis carries the line.
F3 claim-not-supported	·	(low confidence) The cited GHSA-85c2-q967-79q5 page gives a crafted-envelope reproducer and 'Severity High' but says nothing about credentials or privileges; the 'no credentials' fact rests on the CNA	Applied: the takeaway says the use-after-free is triggered by a crafted envelope and drops the uncited credentials clause.
F3 claim-not-supported	·	(low confidence) The cited NCSC-CH post files RoguePlanet under its 'June 9th 2026' heading ('disclosed another zero day after Microsoft's patch Tuesday announcement'); 2026-06-10 is NCSC-CH's own log	Applied: the disclosure and public-PoC dates are 2026-06-09, Patch Tuesday, as NCSC-CH and Help Net Security give them.
F4 hallucinated-fact	·	(low confidence) No cited source reports .exe or .vbs files written into Startup. Sekoia, The Hacker News and Infosecurity all describe the WinRAR traversal dropping a hidden HTA file there, so an ale	Applied: the action alerts on a hidden HTA file written into the Startup folder, the artefact the sources describe.
F3 claim-not-supported	·	(low confidence) 'each of these behaviors' lists a renamed MeshAgent binary, an ntdsutil IFM snapshot, a persistent Cloudflared.exe service, discovery-scanner activity and s5cmd/Rclone transfers. Micr	Applied: the sentence says Microsoft closes with Defender XDR detections and mitigations for the toolchain, without claiming one per behaviour.
F5 missing-citation	·	(low confidence) The sentence has no citation, and the BleepingComputer citation that closes the next sentence does not carry the 2026-04-29 detection date (BC says only 'On Friday, Instructure disclo	Applied: the first sentence cites The Register, which carries both dates.
F4 hallucinated-fact	·	(low confidence) The iteration-5 finding is not resolved on disk. G2a's findings file lists presseportal-ch among its candidate_sources (a primary-grade Swiss publisher not in sources.json), and the r	Applied: presseportal-ch joins the report's candidate-source list.
F11 editorial-advisory	·	(advisory) Residual of iteration-5 F11 on Exchange and RoguePlanet: the record-summary fix landed, but each section still narrates the priority change as reader text, which is a composition rationale;	Declined: the sections state why priority moved, a reader-facing fact.
F11 editorial-advisory	·	(advisory, low confidence) Iteration-5 F11 was declined as 'minor'. The evidence stands: PHP's GitHub advisory scores CVE-2026-7262 6.3 (Moderate) while PHP's own CVE record scores it 2.9 (CVSS 4.0, E	Declined: the entry gives the advisory's score; the CNA difference is minor and left for the next fire.
F11 editorial-advisory	·	(advisory, low confidence) The record summary says four CVEs were retyped (diff: CVE-2026-44125, -44126, -44127, -7864 changed from rce), but the reader-facing Correction section names only two (CVE-2	Declined: the section names the two retypings a reader acts on; the record summary lists all four.

Iteration #? NEEDS_FIXES · 41 findings (truth=13, editorial=6, advisory=22) · Claude Sonnet 5.5 · 29m 08s

F-code	Section	Verifier summary	Remediation · outcome
F3 claim-not-supported	·	The sentence states flatly that an unauthorized-agent date is not the attempt time. JetBrains hedges: the date does not necessarily indicate when the attempt occurred. A hedge is dropped (low severity	Applied: the line says the date is not necessarily the attempt time and to rely on the log timestamps.
F11 editorial-advisory	·	(advisory) Em dashes in reader-facing entry text; the style rule allows only the changelog heading. The audit report calls these render-stripped.	Declined: em dashes are style-only and stripped at render.
F11 editorial-advisory	·	(advisory, prior F11 re-raised, declined) The "(updated)" label sits beside a main takeaway it does not replace; it addresses the Swiss register, a different finding (changelog check 4c(h)).	Declined: the label marks the later Swiss-register takeaway; the main takeaway still stands for the Liechtenstein finding.
F11 editorial-advisory	·	(advisory, low confidence, prior F11 re-raised, declined) No frontmatter field names LiteLLM or Starlette; product pages and triage agents match on affected_products or cves[].affected.	Declined: product fields for LiteLLM are left for the next record on the entry; no reader-facing claim is wrong.
F11 editorial-advisory	·	(advisory, prior F11 re-raised, declined) The note is about seven sentences, argues the pre-auth rating and points to the body twice ("see body"); the standard is two sentences of provenance.	Declined: an earlier fire's provenance note; it is accurate, and its length is style.
F11 editorial-advisory	·	(advisory, low confidence, prior F11 re-raised, declined) The Correction overstates the change: the title still ties the chain to conference attendees (hedged with "reported against"), and the recap c	Declined: the title is hedged with "reported against"; the correction states the change the body makes.
F11 editorial-advisory	·	(advisory, low confidence) "after April" reads as May onward; Wordfence dates exploitation from 2026-04-13, so the review window is "since 13 April".	Applied: the takeaway's review window starts 2026-04-13, Wordfence's first-exploitation date.
F11 editorial-advisory	·	(advisory, low confidence) No cited page names a targeted or exposed sector for CVE-2026-63077.	Declined: sector tags are the profile's relevance call, not a source claim.
F3 claim-not-supported	·	The only citation on this clause is the NCSC-CH hub post, which does not carry 'fixed in 15.0.3': its summary says 'Several vulnerabilities have been fixed in SEPPmail Secure Email Gateway 15.0.4' and	Applied: the 15.0.3 reading cites InfoGuard, and NCSC-CH stays on the 15.0.4 clause.
F3 claim-not-supported	·	(low confidence) The cited incident page now shows 'Updated: October 14, 2026' and no page text dates a change to 3 October (latest dated event in its timeline is October 2). The '2026-10-03' update d	Applied: the section and record summary drop the 2026-10-03 date; the page's current wording is what the entry follows.
F14 ?	·	(low confidence) Onapsis classes five notes as HotNews (3771065, 3765948, 3747367 update, 3714806, 3758900); after CVE-2026-58231 that leaves four further HotNews, not three. The entry itself says Ona	Applied: "Three further notes" becomes "Further notes".
F11 editorial-advisory	·	Advisory, unchanged from the iteration-6 finding that was declined with an attribution rationale that does not address repetition: the switch and the intimidation reading are each stated twice in one	Declined: the paragraph attributes each statement to its vendor; the repetition is style.
F11 editorial-advisory	·	(advisory, low confidence) Unchanged from the iteration-6 advisory declined as minor. PHP's GitHub advisory shows 6.3 Moderate; PHP's own CVE record (CNA, cveawg.mitre.org) scores 2.9 Low (E:P). The e	Declined: the entry gives the advisory's score; the CNA difference is minor and left for the next fire.
F11 editorial-advisory	·	Advisory: em dashes in reader-facing entry text (the section heading is the only permitted place). Mostly text from earlier fires; this fire edited the ChainDrop, SAP and Entra bodies.	Declined: em dashes are style-only and stripped at render.
F11 editorial-advisory	·	Advisory: both reader-facing Correction sections narrate a change to the priority frontmatter field, which is pipeline record-keeping rather than a fact about the threat. The reasons (no exploitation,	Declined: the sections state why priority moved, a reader-facing fact.
F11 editorial-advisory	·	Advisory, two readability defects after the iteration-6 fix. (1) The Correction section is stamped 2026-10-11 but reports a 2026-10-13 revision of sk1000171; a reader sees a dated section describing a	Applied: the record and its section are dated to the day they reach readers, after the 2026-10-13 revision they report; the 2026-10-04 section keeps its dated numbering.
F3 claim-not-supported	·	(low confidence) The Register page carries the 2026-04-29 detection date but not the 2026-05-01 disclosure date; the delta claims 'The Register, which carries both dates'. The only cited page that bea	Applied: the 2026-05-01 disclosure is dated by BleepingComputer, which is cited for it.
F3 claim-not-supported	·	(low confidence) Help Net Security lists 'Anomalous Netlogon traffic patterns from non-DC source addresses'. The entry drops 'anomalous ... patterns', so as written the indicator matches ordinary memb	Applied: the indicator reads as Help Net Security lists it, anomalous Netlogon traffic patterns from non-DC sources.
F11 editorial-advisory	·	(advisory, low confidence) The record's fields name actions and git diff shows actions[0] reworded ('.exe/.vbs' to 'a hidden HTA file'), but the summary mentions only the references. An internal recor	Applied: the record summary now names the action change.
F4 hallucinated-fact	·	(low confidence) Same blanket assume-compromise rule that iteration 6 found unsupported in the action (remediated there: 'treat hosts with a web shell as compromised, as Mandiant does'), still present	Applied: the action asks to investigate an exposed hub for compromise rather than treat it as compromised.
F4 hallucinated-fact	·	(low confidence) Legacy framing from when the initial-access flaw was attacker-asserted. This fire's correction rewrote the Access paragraph to state Oracle's confirmation of CVE-2026-35273 (CVSS 9.8)	Applied: "better-evidenced" is dropped.
F5 missing-citation	·	(low confidence) Uncited and not marked analyst judgement, unlike the adjacent authorized_keys and hardening sentences this fire marked. The nearest source support is Mandiant's September 'Hunt for Ev	Applied: the bulk-query alert is marked as analyst judgement.
F5 missing-citation	·	(low confidence) 'Strasbourg' is in none of the three cited pages (SecurityWeek, The Register, BleepingComputer); they give 46 member states and 'Europe's leading human rights organization'. Minor, tr	Applied: "Strasbourg" is dropped.
F11 editorial-advisory	·	(advisory) The zstd exfiltration fact is stated twice in one paragraph (this fire inserted the first sentence and rewrote the second), and em dashes remain in the title-adjacent legacy text of earlier	Applied: the repeated zstd sentence is removed.
F11 editorial-advisory	·	(advisory, low confidence) A reader-facing date moved by one day in the summary and body. The record fields name summary and body, but the record summary and the Correction section list the other chan	Applied: the record summary declares the 2026-06-09 date.
F4 hallucinated-fact	·	(low confidence) This fire rewrote the paragraph's lead-in but kept its guidance. No cited source supports it (the paragraph has no citation), and the entry's own later sections show it is wrong for S	Applied: the paragraph points to the 2026-08-24 update, whose LevelBlue mechanism replaced its reasoning.
F9 surface-contradiction	·	(low confidence) Cyber Kendra says 'shipped engine build 1.1.26060.3008 on July 9'; Microsoft's own record for CVE-2026-50656 shows its revision announcing the shipped engine update dated Jul 8, 2026,	Applied: the engine build is dated 2026-07-08, as Microsoft records it.
F8 needs-more-research	·	(low confidence) Cisco's 'Products Confirmed Not Vulnerable' list includes 'Nexus 9000 Series Fabric Switches in ACI mode'. The entry reproduces the Nexus 3000 and other-model exclusions but drops the	Applied: the analysis notes Cisco lists Nexus 9000 fabric switches in ACI mode as not vulnerable; the record is reader-facing with its section.
F4 hallucinated-fact	·	(low confidence) The summary drops the source's hedge. Laux Lawyers (the cited source for the motion text) says the infrastructure is meant to host the data 'möglichst in der Schweiz' (where possible)	Applied: the summary says "in Switzerland where possible", keeping Laux's hedge.
F3 claim-not-supported	·	(low confidence) Microsoft's non-attribution statement is about Storm-3069 only ('it has not attributed Storm-3069 to a Chinese nation-state actor'). For the additional NeedyMantis activity Microsoft	Applied: the summary and body limit the non-attribution to Storm-3069 and say Microsoft has not tied all NeedyMantis activity to one actor.
F3 claim-not-supported	·	(low confidence) Kaspersky says the vendor 'published a new software version intended to address it' and that release 12.6.0.2445 'no longer includes the malicious behavior described in this article'.	Applied: the summary says 12.6.0.2445 no longer includes the behaviour Kaspersky describes.
F11 editorial-advisory	·	(advisory, low confidence) The summary field is cut off mid-sentence with an ellipsis ('introducing unified naming for two capability clusters: GammaPhish (the funnel from …'), so the card text shown	Applied: the truncated summary is completed with both cluster names, declared in the record.
F11 editorial-advisory	·	(advisory) Definition check 12: no em dash in reader-facing entry text (only the '## <Type>; <at>' heading is exempt). The listed text sits in paragraphs this fire edited, so it was open to a clean-up	Declined: em dashes are style-only and stripped at render.
F11 editorial-advisory	·	(advisory, low confidence) The loader's masquerade file name is a file-name indicator of the kind the style rule bars ('no hashes, IPs, attacker domains, mutex or file-name indicators'); the entry els	Declined: an earlier fire's text; the file name is a published masquerade name, not an IOC the profile excludes.
F18 ?	·	(low confidence) check 10b(b): the action restates the body's Defender takeaway paragraph and the immediate_action text almost word for word (access.log review, off-box log cross-check, re-image), so	Applied: the action that restated the takeaway is removed.
F3 claim-not-supported	·	(low confidence) The section says NCSC-CH's 2026-09-15 edit was 'linking a public working proof-of-concept published the same day ([guneykabel, 2026-09-15](https://github.com/guneykabel/cve-2026-85706	Applied: the section says the PoC repository dates from 2026-09-11, and the source record carries that date.
F5 missing-citation	·	(low confidence) 'On the FortiGate itself, the administrator accounts, passwords and REST API keys the advisory says to review are recorded in the device's configuration and administrator audit log, w	Applied: the sentence is marked as analyst judgement.
F11 editorial-advisory	·	(advisory, low confidence) The summary clause is tautological (the hotfix is the fix) and can be read as 'no workaround', which neither SNWLID-2026-0016 (page text carries no workaround statement) nor	Declined: style-only wording.
F11 editorial-advisory	·	(advisory, low confidence) Carried from iteration 6, re-checked: beyond public-sector, these sector tags appear on no cited page: FortiSandbox technology, defense, healthcare; SonicWall finance, energ	Declined: sector tags are the profile's relevance call, not a source claim.
F11 editorial-advisory	·	(advisory, low confidence) Austria: the reader-facing Improvement section restates in one sentence the Defender takeaway this same record adds to the main analysis (24h/72h clock, scans may not be blo	Declined: the section states the reader-facing delta once; the main analysis carries the line.
F11 editorial-advisory	·	(advisory, low confidence) Attacker-chosen marker strings are reproduced in reader text; rule 12 forbids file-name and marker indicators. Text predates this fire; iteration 6 raised it and it was decl	Declined: an earlier fire's text outside this fire's changes; the strings are the researchers' published markers, left for the next record on the entry.

Iteration #? NEEDS_FIXES cap-breach · 37 findings (truth=7, editorial=4, advisory=26) · Claude Sonnet 5.5 · 33m 51s

F-code	Section	Verifier summary	Remediation · outcome
F8 needs-more-research	·	(low confidence) This fire rewrote the main analysis (record fields name body) but the entry still carries no Exposure: or Defender takeaway: line, so the site's entity/product lift and agents	Declined: the cited prose carries the exposure and the takeaway; labelled lines are left for the next record, since text added at the cap goes unverified.
F8 needs-more-research	·	(low confidence) This fire rewrote the main analysis (fields name body) and rewrote the summary, actions and cves[] but left the entry without the closing labelled lines the contract requires on every	Declined: the cited prose carries the exposure, detection and takeaway; labelled lines are left for the next record, since text added at the cap goes unverified.
F11 editorial-advisory	·	Product pages and triage agents match on affected_products / cves[].affected; no frontmatter field names LiteLLM or Starlette although GHSA gives 'Affected versions >= 1.74.2, < 1.83.7' and Horizon3 g	Declined: product fields for LiteLLM are left for the next record on the entry; no reader-facing claim is wrong.
F11 editorial-advisory	·	Attacker-chosen label strings on payload pages are reproduced in reader text; the house rule bars file-name and marker indicators. The decline rationale (researchers' published markers, text outside t	Declined: an earlier fire's text; the strings are the researchers' published markers, left for the next record on the entry.
F11 editorial-advisory	·	The changelog record summary is rendered on the site (entry-update__summary / revision__summary) and carries an Admiralty letter and frontmatter-field narration ('verification', techniques 'mapped');	Applied: the record summary describes the rating change in reader terms.
F11 editorial-advisory	·	Cisco says the exploit lets the attacker 'gain unauthorized access to the affected device by bypassing the web-based management interface'; 'entirely' is the entry's addition.	Applied: "entirely" is dropped.
F11 editorial-advisory	·	House rule: no em dash in reader-facing text. The site strips surviving ones at render, so this is a silent style defect only.	Declined: em dashes are style-only and stripped at render.
F11 editorial-advisory	·	None of the cited pages (Fortinet PSIRT x3, CCB Belgium, NCSC-NL, Help Net Security, Security Affairs, KEV) names a victim sector; the sector tags have no source.	Declined: sector tags are the profile's relevance call, not a source claim.
F4 hallucinated-fact	·	The entry now contradicts itself on the RoguePlanet fix date. Body: "was fixed in engine build 1.1.26060.3008 on 2026-07-09". Frontmatter (changed by this fire to resolve the iteration 7 F9): "Engine	Applied: the body dates the RoguePlanet engine fix 2026-07-08, matching the frontmatter and Microsoft's revision.
F7 drop	·	(low confidence) Austrian NIS2 transposition. The entry's own 2026-09-30 correction says it "changes no decision for Swiss entities"; the only Swiss hook is a comparison with Canton Bern's ICSG, and t	Declined: the entry stays as a neighbouring-jurisdiction reference; removing an entry is outside the changelog lifecycle.
F11 editorial-advisory	·	(advisory, prior F11 re-raised after decline) The note is about seven sentences, argues the pre-auth rating and twice sends the reader to "see body". The standard for sourcing_note is two sentences of	Declined: an earlier fire's provenance note; it is accurate, and its length is style.
F11 editorial-advisory	·	(advisory, low confidence, prior F11 re-raised after decline) The record summary says "The title and takeaway no longer present the campaign as conference-targeted", but the title still reads "A phish	Applied: the record summary and section say the title now only reports the conference link and the takeaway drops the targeting.
F11 editorial-advisory	·	(advisory, low confidence) The reader-facing record summary says both "the detection line leads with the helper-to-PowerShell download chain" and, four sentences later, "The startup behaviour and the	Applied: the record summary keeps only the beacon-first Detection line.
F11 editorial-advisory	·	(advisory, low confidence) The headline and body present exploitation as one national CERT's partner-sourced claim that Microsoft says it cannot support, but the machine-consumed fields assert it flat	Declined: the body presents the CCB claim and Microsoft's assessment side by side; the status follows the national CERT's report.
F11 editorial-advisory	·	(advisory, low confidence; iteration 7 F4 remediation holds in part) The paragraph now says LevelBlue's mechanism "later replaced this reasoning", but it still carries uncited hunting guidance that Le	Declined: the paragraph now points to the later LevelBlue mechanism; the heuristic stays as dated context.
F11 editorial-advisory	·	(advisory, low confidence) The example named-capture syntax is not in any cited source; depthfirst and Security Affairs both show `(?<user_id>...)` -> `$user_id`. PCRE accepts both forms, so this is a	Applied: the workaround examples use the `(?<name>...)` syntax the sources show.
F11 editorial-advisory	·	(advisory, previously raised and declined) The reader-facing Improvement section restates in one sentence the Defender takeaway this same record adds to the main analysis (24h/72h clock, scans may not	Declined: the section states the reader-facing delta once; the main analysis carries the line.
F11 editorial-advisory	·	(advisory, low confidence) The summary frames fix versions inside a sentence attributed to NCSC-CH's advisory ('NCSC-CH's advisory of 2026-05-08 lists six CVEs ... insecure deserialization (fixed in 1	Declined: the summary condenses the versions; the body attributes each to its source, NCSC-CH or InfoGuard.
F3 claim-not-supported	·	(low confidence) The sentence makes the jquery.js file a separate artefact that delivered the loader; both cited sources say the file is the loader itself.	Applied: the body names TaskWeaver as the obfuscated loader, named to resemble a jQuery library, that installed Djinn Stealer.
F3 claim-not-supported	·	(low confidence) The action attributes the affected-build reading to SonicWall's advisory SNWLID-2026-0017, while this fire's own Correction and summary say the affected and fixed builds are The Hacke	Applied: the action attributes the affected-hotfix reading to The Hacker News's reading of SNWLID-2026-0017.
F11 editorial-advisory	·	(advisory, low confidence, unchanged from iteration 7, declined there as style) The summary clause is tautological (the hotfix is the upgrade) and reads as 'no workaround', which neither SNWLID-2026-0	Declined: style-only wording; the summary and Correction state the same fix path.
F5 missing-citation	·	(low confidence) Both sentences state facts that sk1000171 carries (verified), but neither ends in a citation; the only sk1000171 citation sits on the following 'Fixed in ...' sentence. The affected-v	Applied: both sentences cite sk1000171.
F11 editorial-advisory	·	(advisory, low confidence) Residual of the iteration-7 finding after the fix: the dating problem is fixed (the Correction is now dated 2026-10-19, after the 2026-10-13 revision it reports), but the 20	Declined: the 2026-10-04 section keeps its dated numbering; this fire's later section revises it.
F4 hallucinated-fact	·	(low confidence) The iteration-7 hedge fix landed in the summary and in body paragraph 2, but the same clause in body paragraph 1 still states hosting 'inside Switzerland' flatly. Laux Lawyers, the cl	Applied: body paragraph 1 says "in Switzerland where possible", as the summary does.
F11 editorial-advisory	·	(advisory, low confidence) Unchanged from iterations 6 and 7. The decline rationale (each statement is attributed to its vendor) does not address the finding, which is repetition: the dead man's switc	Declined: the restatement is the bold lead of a dated section; style only.
F11 editorial-advisory	·	(advisory, low confidence) The iteration-7 file-name finding was declined as 'a published masquerade name, not an IOC the profile excludes'. The style rule names 'file-name indicators' explicitly, and	Applied: the file name is gone; the body describes the loader as named to resemble a jQuery library.
F11 editorial-advisory	·	(advisory, low confidence) event_date is one to two days later than the first primary source's own date: WinRAR event_date 2026-06-09 is The Hacker News's date, Trend Micro (first source, role primary	Declined: one-day event_date drift on earlier fires' entries, left for the next record on each.
F4 hallucinated-fact	·	(low confidence) The old ACSC alert address returned HTTP 200 on live fetch this pass, with a body byte-identical in size (1,541,402 bytes) to the new /alert/ URL and a canonical link pointing at the	Applied: the report row and this fire's record say the old address now names the moved page as canonical.
F4 hallucinated-fact	·	Disk count of records carrying run_id 2026-10-11T1307Z-audit: 117 entries; 86 non-internal corrections + 16 internal corrections (102), 5 non-internal improvements + 8 internal improvements (13), 2 no	Applied: the CHANGELOG gives 24 internal records, the disk count.
F4 hallucinated-fact	·	Table rows sum to 26 folded duplicates while the prose and the run record state 27; the Oracle EBS CVE-2026-46817 survivor received 2 folded entries and is not listed as such, so it falls into 'the re	Applied: the fold table lists Oracle EBS CVE-2026-46817 with its two folded entries, and the singles list drops it.
F11 editorial-advisory	·	(low confidence) Carry-over: the CNA record for CVE-2026-7262 scores 2.9 Low while the entry carries the PHP advisory GHSA-hmxp-6pc4-f3vv score 6.3; the entry attributes the 6.3 to the PHP advisory, s	Declined: the entry gives the advisory's score; the CNA difference is minor and left for the next fire.
F11 editorial-advisory	·	(low confidence) Carry-over: the framing sentence ("Virtualizor sits outside the typical public-administration estate") carries no citation and no cited source states it; it is analyst judgement. Advi	Declined: relevance framing is the profile's call, not a source claim.
F11 editorial-advisory	·	(low confidence) Carry-over: the scope of "rotate every credential" is ambiguous (which credential set the task covers). Advisory only.	Declined: an earlier fire's action; left for the next record on the entry.
F11 editorial-advisory	·	(low confidence) Carry-over: the "external" qualifier is not stated by the cited source (it names the account names, not a source-range class). Advisory only.	Declined: an earlier fire's hunt line; left for the next record on the entry.
F11 editorial-advisory	·	(low confidence) Carry-over: the Infosecurity Magazine source is listed in sources[] but never cited inline in the body. Advisory only.	Declined: an uncited listed source is harmless; left for the next record on the entry.
F11 editorial-advisory	·	(low confidence) Carry-over: sources[0] points at a JSON API endpoint rather than a human-readable advisory page; it resolves and carries the cited text. Advisory only.	Declined: the JSON record is the vendor's own advisory data; left for the next record on the entry.
F11 editorial-advisory	·	Carry-over, declined by the main agent in iteration 7 as stripped at render: the style rule allows an em dash only in the changelog heading. Lines carrying one: 6 in PeopleSoft, 13 in Liechtenstein, t	Declined: em dashes are style-only and stripped at render.

Verification & coverage notes

The run record's narrative body, verbatim. This is where the run accounts for its own judgement calls: every borderline drop and judged-not-relevant item with its reason, dedup decisions, single-source items and their carve-outs, contradictions, and per-source coverage gaps, so nothing the run considered disappears silently.

Verification & coverage notesrun record body

2026-10-11T1307Z-audit · audit · Opus 5.5 · window 271 h · 1 entry published

Verification & coverage notes

Quality audit over 2026-09-30T06:39:43Z to 2026-10-11T13:07:20Z (270.5 h), anchored on the previous audit record. The re-sweeps and truth inventory were extended back to 2026-09-27T13:08Z, the last full audit, because the partial audits of 09-29 and 09-30 had moved the anchor past a stretch no audit had checked (fixed in v4.20). Full report: docs/audits/2026-10-11-quality-audit.md.

Soundness. Eleven truth passes verified 196 entries against about 890 fetched primary URLs. 35 of 196 clean.

Window (133 entries): 35 clean, 84 with imprecisions only, 14 with factual errors. The worst were Kaspersky PAYLOAD (encryption not in the source) and the SonicWall SMA1000 headline (vendor-named exploitation called new).
Legacy batch L1: 20 of 20 wrong.
Consolidation batches D1 and D2: 40 of 43 wrong.

Every defect found real was fixed through a changelog record on its entry; the declined findings are listed in the report with reasons. 117 existing entries carry a record from this fire. 27 duplicates were folded into 21 survivors with tools/fold_entries.py, and every CVE-sharing pair left without a link now carries a reference except one pair of legacy entries held for re-verification (43 unlinked at start). The legacy queue stands at 408 pending.

Completeness. Six re-sweeps confirmed 89 findings as covered and returned 79 items for decision.

Recovered as a new entry: NeedyMantis (Microsoft, 2026-09-28; three fires dropped it on a misapplied recency reason).
Recovered as update records: GitLab's 19.0.9 and 18.11.12 backports, and CCB's public proof of concept for NetScaler CVE-2026-88773.
Correctly droppable, with reasons in the report: the unexploited vendor bundles (Cisco Nexus, HPE, IBM, Splunk, Veeam, ILIAS, WatchGuard), law-enforcement actions, incidents below the floor, claims, and statistics.
KEV: 10 additions since 2026-09-30, all COVERED, no COVERED-STALE and no RANSOMWARE row.

Systemic. Four fixes ship in v4.20:

the window anchor;
the duplicate guard;
the stale page-check backfill clause;
two false-positive classes in the cited-page gate: Mastodon meta text, and image streams in the PDF reader, with a new test.

The page checks re-run from 2026-08-29 clear every citation-cve check. The one quote-literal warning it raised, Bitget's page edited after publication, is cleared: the evidence quote now follows the page's current wording.

Operator signals:

The 10-01 intel fire and the 10-04 audit left no record. The intel gap self-healed; the audit gap is recommendation 3.
The model-generation baseline is in systemic finding 6.

Sources. 13 records were changed: seven feed recipes and six notes (a later fire had already switched eset to its feed). The health sweep found 237 of 238 relevant; threatpost is stale, demoted and archive-only.

Registry. Added malware:needymantis and actor:storm-3069, with the DAEMON Tools incident attributed-to Storm-3069. Four summaries were corrected, and tools/sync_products.py added 20 product entities and moved 11 product first_seen dates earlier.

Calibration: run (first October report). The bars hold and no prompt edit ships. The September/October inconsistency on unexploited critical bundles is recommendation 1.

Warning sweep. check_run.py --all started at 1 warning and 23 acknowledged. The 2026-09-30T0639Z audit's 100.8-hour duration is acknowledged as settled history (an interactive session paused on API usage limits). No other ledger change.

Watch items: six closed (duplicate consolidation, the polyfill indicator, KEV RANSOMWARE rows, top-of-entry drift, NCSC-CH dead links, the three unreadable sources), six open.

Essential coverage: not applicable to an audit fire. The re-sweeps' source ledgers (25, 32, 26, 26, 27 and 36 sources, all attempted) are in work/2026-10-11T1307Z-audit/findings.G*.yaml.

Coverage gaps:

Feed caps bound how far back one fire sees: bsi-de, cccs-alerts, CERT-FR avis, NCSC-NL and msft-secblog recent.
Unreadable on every rung: presseportal.de (Polizei Hamburg), three community.citrix.com posts, F5 K000161019 and BSI WID-SEC-2026-1536.

ATT&CK pin: tools/attack_data.py --check reports local v19.2 equal to upstream latest v19.2. No drift.

Clock: local and network time agreed at fire start (2026-10-11T13:07:20Z, skew 0 s).

Verification: eight cold passes of cti-verification, each split into parallel slices that walked the claim ledger; every pass gave every claim in its scope a verdict. Truth plus editorial findings fell from 144 in iteration 1 to 11 in iteration 8, and no pass returned CLEAN, so the fire publishes on the fail-open rule at the eight-iteration cap with a residual of 11 (advisory findings are not counted). Iteration 8's small, sourced findings were fixed after the pass and are not re-verified: the ShieldBreak fix date, the Swiss motion's hedge, the SonicWall attribution, two Check Point citations, the SimpleHelp loader wording, the CHANGELOG internal count, the fold table and the ACSC address. The residual left for the next audit is low-confidence editorial work on earlier fires' text, among it the missing labelled lines on the RoguePlanet and SAP August entries and the Austrian NIS2 entry's relevance.

Pause: the fire stopped on an API session limit after iteration 3 (2026-10-11T17:21Z) and resumed on 2026-10-19. Before iteration 4 it was re-based on the current main; later fires' records stayed out of scope, and two records dated 2026-10-19 (Citrix, Check Point) follow newer records on main so the changelogs stay append-only. completed and duration_seconds span the pause.

← Operations dashboard · day page 2026-10-11 · run-record contract: docs/pipeline.md