2026-10-12T0256Z-intel

Verification & coverage notes

Quiet Monday window: the 26 h window (2026-10-11T00:57Z to 2026-10-12T02:57Z) followed a weekend, and the newest item on every authority source (NCSC-CH, NCSC-NL, BSI, CERT-FR, CERT-EU, CERT.at, CISA, ENISA, Europol, OFAC) is dated 2026-10-09 or earlier. The mechanical KEV diff found no CISA KEV addition inside the window (catalog 2026.10.08) and no RANSOMWARE-flag flip on a covered CVE, and S1 read the catalogue itself and agrees. Four sub-agents returned seven candidate items (S1 three, S2 none, S3 one, S4 three), all marked borderline by their authors. One new entry ships and no existing entry changed: no deep dive, no critical. The scheduled vendor cycles (Microsoft Patch Tuesday, SAP, Adobe) land on 2026-10-13 and Oracle's CPU on 2026-10-20, so none fell in this window; Microsoft's early October release has no exploited or publicly disclosed CVE in its structured fields.

Published: 2026-10-12/cve-2026-85097-bricksforge-pro-forms-upload-php-exploited (notable): a pre-auth upload-to-PHP flaw in a paid WordPress add-on, exploited since 2026-10-07 per Patchstack's telemetry, vendor fix available. It is first coverage from a rotational source's lookback (PD-7(d); Patchstack's primary is dated 2026-10-08, outside the 26 h window); no earlier record carries a disposition for it, because the 2026-10-11 S1 raised it from outside its slice. Relevance ground, stated here and not in the entry: an exploited unauthenticated code-execution flaw with a vendor fix clears PD-11(b), the vendor is German and the add-on is sold to site builders in the DACH region, and no source shows a Swiss public-sector deployment, so the priority is notable and the entry is held short.

• borderline-drop: Ricardo (SMG Swiss Marketplace Group), about 890,000 accounts with names, addresses and phone numbers exposed, announced 2026-10-09 (S4, re-raised from lookback; the 2026-10-11 fire already dropped it), Swiss home region and victim-confirmed, but a private consumer marketplace with no vector, no actor and no public-sector nexus (incident floor); the only mappable technique would rest on the word "vulnerability" alone.
• borderline-drop: ShinyHunters / FBI portal case, arrest of a Canadian ransomware-negotiation executive and the group's no-release statement (S4, update-of; the 2026-10-11 fire already dropped the arrest), a law-enforcement development with no tradecraft or hardening content, the identity rests on Krebs's sources and court records the FBI has not confirmed.
• borderline-drop: IDC Frontier IDCF Cloud fourth report of 2026-10-09 (S4, update-of), a response-organisation notice with no technical, scope or recovery fact beyond the covered entry.
• borderline-drop: expired-domain script hijack delivering the P7 DarkSword iOS chain through a dead analytics tag (S3; Report URI, iVerify), exploitation of the domain re-registration rests on one researcher who sells a script-integrity product, no independent report, no public-sector site named, and the iOS chain was already dropped by the 2026-10-10 fire.
• borderline-drop: Chrome 155 stable, 247 security fixes, no exploitation statement (S1), already dropped by the 2026-10-10 fire.
• borderline-drop: "PoC available" tags on CVE-2026-107406 and CVE-2026-84411 (S1), Previdian's tag, and S1's own look at the GitHub repositories shows README-only exploit-sale or lure pages, not exploit code; low confidence, attacker-adjacent URLs, and neither covered entry claims a public proof of concept.
• borderline-drop: SmarterMail build 9777 (post-authentication, aggregator-only CVE), Apache Struts S2-075 to S2-078 (denial of service or disclosure, no code execution), Zimbra 10.1.21, the NCSC-NL Kiteworks bulletin, Android and Apple bulletins, the EUVD weekend batch, and the Cisco, HPE, IBM Verify, Splunk and Veeam bundles that earlier fires held below the gate, no exploitation, no public exploit, no established constituency exposure (S1).
• borderline-drop: CloudSEK NEBULA (executive summary only, full report gated, no nexus), Booz Allen OT-lab study of frontier models (lab only, whitepaper gated), Zenity AgentCorruption (patched, vendor disputes the framing), OpenAI's influence-operations report, the MonsterCloud indictment, the Silent Ransom Group leak-origin story, ASOS breach (consumer retailer, vector unconfirmed) (S3).
• borderline-drop: Swiss leak-site claims with no victim statement or press confirmation (Camandona SA, Hotel Delfino Lugano, Boullard Musique, dd-automation, stuecheli, Rueeggerseg AG); claim-only listings fail PD-6 (S2, S4).
• out-of-window: Zug draft cantonal Information Security Act and ordinance in consultation since 2026-07-15 (comments to 2026-11-09, S2), a draft with a comment deadline, not an obligation, and 89 days old.

Backlog (state/coverage_backlog.md): all four open rows were re-gated on today's facts and none changed state, so nothing is appended; each stays held on its named condition with its expiry unchanged. IBM Guardium Data Protection CVE-2026-85542 and the four related unauthenticated flaws: none is in CISA KEV, IBM's bulletin makes no exploitation statement and no constituency deployment surfaced (expires 2026-10-14). SafePay claim on ARA-Region Lyss-Limpachtal and Payload claim on Netech: ransomware.live shows no press confirmation, no Swiss press report exists and the victims' own sites carry no notice (both expire 2026-10-14). Beyond Gravity: every public account still traces to the single company statement of 2026-10-02, with no vector, actor or data named (expires 2026-10-20).

Single-source: 2026-10-12/cve-2026-85097-bricksforge-pro-forms-upload-php-exploited: Patchstack is the only observer of the exploitation; Dr. Web restates it, the vendor changelog confirms an upload fix in 4.0.1 without naming the CVE, and the CVE record's assigner (Wordfence) scores it 9.8 where Patchstack scores it 10.0. The CISA enrichment on the CVE record lists exploitation as none, stamped about three hours after the Patchstack article.

Rotation: ranking used the derived cursor; 81 standard or candidate records (S1 27, S2 24, S3 30) were set aside as attempted in the previous two fires, and S4's pool of 19 breach and ransomware sources is smaller than a slice, so nine of its twelve records were swept although the previous two fires had attempted them.

Coverage gaps: apa-ots (no listing or feed route; WebSearch only); swissinfo-ger (the extracted homepage is a stale 2026-09-29 snapshot); cloudsek-triad (executive summaries only; the full report is gated); sentinellabs and proofpoint listings recipes re-confirmed. Reader credit: extract fell through to the metered reader on community.citrix.com, psirt.global.sonicwall.com and source.android.com, and one key rotated on an HTTP 402.

For the next audit: (1) an optional improvement on 2026-10-06/denmark-cpr-population-register-third-party-access-breach: TV 2 Kosmopol, relaying Ritzau on 2026-10-09, says the CPR office's notification states the actor did not use the access for the whole period and that the compromise appears to have stopped on 2026-09-20, which reconciles the minister's ten days with Ritzau's 21 days and 17 hours that the entry sets side by side; (2) S1 suggests a cheap gate for any "PoC available" claim: the unauthenticated GitHub repository search plus the contents API separates exploit code from README-only exploit-sale repositories; (3) S3 flags the DNSSEC root key rollover of 2026-10-11 as a watch item only if a resolver-outage report appears.

Source health: the probe covered 241 records (240 relevant, 1 stale: threatpost, already demoted and handled) and its UNSOLVED list was empty, so no repair was owed this run. Verification: two iterations, no entry dropped. Iteration 1 (truth 4, editorial 7, advisory 3) found attribution and citation slips, the unaccounted-for 4.0.0 release, a missing public proof-of-concept statement and a duplicated action; all but the unreadable VulnCheck listing were fixed. Iteration 2 (truth 1, advisory 2) found one clause attributed to Patchstack that its page does not state, and it was removed. The low-residual early exit applies (truth plus editorial is 1, no F1 or F4), so the residual of 1 was remediated after the last pass and not re-verified.