2026-10-13T0256Z-intel

Verification & coverage notes

Standard 26 h window (2026-10-12T00:57Z to 2026-10-13T02:57Z), following the 2026-10-12 fire that published one entry. The mechanical KEV diff found no CISA KEV addition inside the window (catalog 2026.10.08) and no RANSOMWARE-flag flip on a covered CVE, and S1 read the catalogue itself and agrees. The four sub-agents returned 20 candidate items (S1 four, S2 eight, S3 four, S4 four); two ship as new entries, three become changelog records, and the rest are dropped below. No deep dive and no critical: the Danfoss incident and the GitLab flaw are high, since neither is shown to be exploited against, or deployed in, the constituency. The Patch Tuesday cycles of 2026-10-13 (Microsoft, Adobe, Fortinet, Ivanti, SAP's own page, the ICS sets) were not yet published when S1 checked at about 03:20Z (Microsoft publishes about 17:00 UTC), so the next fire must read them first (msrc cvrf 2026-Oct, the SAP page, Adobe and Fortinet bulletins); SAP's October CVE records were already public through its CNA and S1 found no pre-auth code execution, no exploited and no publicly disclosed flaw among them.

Published (2):

• 2026-10-13/danfoss-ak-sm-ak-sc-french-supermarket-refrigeration-attack (incident, high): CERT-FR alert CERTFR-2026-ALE-012 reports numerous compromises of an internet-exposed controller class, with physical damage in hundreds of French stores and ANSSI saying other European countries may be affected. Relevance ground, stated here and not in the entry: a shared target profile (internet-exposed building and refrigeration controllers, often contractor-managed) under PD-11(c); no Swiss victim is named in any source, so the priority stays at high. It carries the 2026-08-28 Claroty entry in references[]; no source ties the attack to those CVEs, so no record was added there. S2 and S4 both returned it.
• 2026-10-13/cve-2026-97229-gitlab-ci-regex-compiler-unauthenticated-rce (vulnerability, high): an unauthenticated CVSS 10.0 code-execution flaw in self-managed GitLab, an out-of-band critical patch release, NCSC-CH and CERT-EU advisories within hours; PD-11(b) on the flaw's own mechanics (anonymous path to full control of a build server, 19.4.1 still affected), no exploitation reported. S1 and S2 both returned it.

Updated (3), each one record on the existing entry:

• 2026-10-08/cve-2026-102255-sonicwall-sma1000-workplace-ssrf (update, priority stays high): NCSC Switzerland edited its advisory on 2026-10-12 to record the flaw as actively exploited, citing two honeypot operators (Defused from 2026-10-08, Previdian from 2026-10-09); SonicWall's advisory still says no evidence. The CVE status is not moved to exploited because the evidence is attempts against decoys.
• 2026-10-10/cve-2026-84411-mikrotik-routeros-web-management-preauth-rce (correction, no float): the entry said the long-term releases were pending; MikroTik's own changelogs show 7.23.8 (2026-10-08) and 6.49.23 (2026-10-07) already carry the fix, so the entry was imprecise when published. A correction rather than an update because the releases predate the entry; the vendor notice still reads pending.
• 2026-10-09/publica-pk-softech-supplier-malware-intrusion-data-outflow (improvement, no float): Publica's own page of 2026-10-08 lists civil status and the IBAN among the data that could be affected, and the AWP wire relays the supplier's "rather small volume" and "may be business data" framing; the entry carried neither and the action now names the IBAN.
• borderline-drop: P7 DarkSword iOS 18.4-18.7 exploit-kit variant (S3; iVerify 2026-10-08, Report URI 2026-10-09; lookback items); the exploited flaws have been fixed since 2025 and Apple extended iOS 18.7.7 to more devices on 2026-04-01, the kit leaked publicly in March and the 2026-10-10 fire already dropped the chain; the new facts (on-device keychain and wallet theft, delivery through a re-registered analytics domain and brokered traffic) change no decision for a managed fleet on current iOS. One source conflict is left for the audit: Apple's iOS 18.7.7 note does not name CVE-2026-20700, which GTIG says was fixed in iOS 26.3.
• borderline-drop: Ghostscript CVE-2026-39919 (S3, Wordfence, CVSS 9.8); the exploit chain is build-specific (Wordfence's own exploits failed in 10,240 attempts across ten other environments), no exploitation, not in KEV, EPSS 0.0078, upstream fix 2026-09-08 and distribution advisories since September: regular patch cycle, and no Swiss deployment is established.
• borderline-drop: ((OTRS)) Community Edition 6 and Znuny CVE-2026-93582 (S1, CVSS 9.4), needs an HTTP Basic backend plus header-to-environment mapping, 6.x is end of life, no exploitation, Znuny listed a matching advisory on 2026-09-16 (its body was not fetched), no Swiss deployment is established.
• borderline-drop: Magecart fake-Stripe skimmer with a Sepolia smart-contract dead drop, and a ClickFix kit delivering a trojanised Fileside Electron app (S3, Report URI), one self-interested script-integrity vendor, indirect nexus, on-chain C2 resolution and ClickFix already covered.
• borderline-drop: Anthropic's report on unintended model actions on US government sites (S4, primary 2026-10-09, outside the window), no constituency victim, ordinary web weaknesses, and the AI-agent incident family is already covered by the OpenAI and earlier Anthropic entries.
• borderline-drop: Ahold Delhaize outage (S4; company release, NOS, BleepingComputer), no vector, actor or behaviour public (incident floor), no Swiss or public-sector nexus; BleepingComputer finds no link to the French refrigeration attack.
• borderline-drop: FortiBleed Swiss exposure census, 4,313 FortiGate interfaces reachable in Switzerland (S2 and S4; Inside IT, Netzwoche, Risikomonitor; the primary report was not found); an exposure count adds no operational fact to the covered entry.
• borderline-drop: FTAPI dataset published on The Gentlemen's leak site (S2; heise, 2026-10-12), single source, mostly marketing material plus an apparent customer list; the entry stays routine.
• borderline-drop: Qilin core-member arrest (S2; NRW, Japan's NPA, lookback); a law-enforcement action that changes nothing defenders do; Ricardo (Swiss Marketplace Group) 890,000-account disclosure (S2, S4), no vector, no actor, no public-sector nexus (incident floor); N0n claim against about 50 maritime and port operators (S4), claim-only.
• borderline-drop: S1 candidates held below the gate, IBM Guardium siblings, HPE Aruba AOS-S and ClearPass (2026-10-06), AnyDesk Linux CVE-2026-109390 (fixed in June), SAP October rows (CVE-2026-89111 library-level, 89110 and 89107 authenticated, 89108 administrator), ZITADEL, WinBox, HAProxy Data Plane API, phpMyFAQ, SmarterMail, Metasploit msf-ws, Veeam, ILIAS, Cisco Nexus and License bundles, authenticated, administrator-only, library-level or already patched, none exploited, no established constituency exposure.

Backlog (state/coverage_backlog.md): all four open rows were re-gated on today's facts and none changed state, so nothing is appended and each stays held on its named condition with its expiry unchanged. IBM Guardium Data Protection CVE-2026-85542 and its four unauthenticated siblings: none is in CISA KEV (catalog 2026.10.08), IBM's bulletin of 2026-10-08 lists CVE-2026-85542 as authenticated with no exploitation statement, ACN's alert is unchanged, no public proof of concept and no constituency deployment surfaced (expires 2026-10-14). SafePay claim on ARA-Region Lyss-Limpachtal and Payload claim on Netech: ransomware.live shows no press confirmation, S2 and S4 found no Swiss press report and neither victim site carries an incident notice (both expire 2026-10-14). Beyond Gravity: every public account still traces to the single 2026-10-02 company release as relayed by AWP, Inside IT and Netzwoche, with no vector, actor or data class named (expires 2026-10-20). The three rows that expire on 2026-10-14 are struck by the next fire if their conditions are still unmet.

Contradictions and discrepancies carried in the entries: (1) GitLab: CERT-EU and BleepingComputer give 19.3.4 as the 19.3 fix, the vendor page names 19.3.5 and says 19.3.4 had a merge-request page bug; the entry uses the vendor figure. (2) SonicWall: NCSC Switzerland says actively exploited, the vendor advisory says no evidence; both statements are in the entry, with the evidence limited to attempts against decoys. (3) Danfoss: Infosecurity quotes Intermarché at 150 stores while AFP and BFMTV give 300 Intermarché or Netto shops; BFMTV says 300 is twice the first estimate of 150, so the entry says the counts moved during the day. Single-source facts: the forced 50-degree defrost and the "older than version 4" scope are BFMTV's reporting alone.

Rotation: ranking used the derived cursor; 78 standard or candidate records (S1 12, S2 24, S3 42) were set aside as attempted in the previous two fires, and S4's pool of 19 breach and ransomware sources was entirely inside those two fires, so its 14 oldest-cursor records were swept anyway.

Coverage gaps: prodaft (no dated listing reachable on any transport; WebSearch only); zaufana-trzecia-strona (undated listing); ransomware-live (recentvictims capped at 100); sap-security-notes (October page 404 until later on 2026-10-13); hadrian-labs, depthfirst, esentire, socradar, msft-ti and proofpoint (listing or extract quirks, no in-window item). Reader credit: extract fell through to the metered reader on 404 and 403 responses (a not-yet-published SAP page, a GitHub advisory, anydesk.com, fortiguard.fortinet.com and psirt.global.sonicwall.com).

For the next audit: (1) tools/fetch_source.py extract falls back to the metered reader on any 404 or 403, spending credit on URLs that merely do not exist yet; S1 suggests url --direct first for such URLs, and a flag to disable the fallback would remove the cost; (2) CERT-FR ALERT bulletins are not in cert-fr avis-recent: the Danfoss alert was found only through the alert feed, now recorded in the anssi-fr notes, and a recipe subcommand would make it routine; (3) S2 suggests a Swiss-press lookback through the cash.ch sitemaps (recorded in the source notes) and notes that the Zug cantonal ISG consultation runs to 2026-11-09 and that CRA manufacturer reporting applied from 2026-09-11 (ENISA); (4) the Apple iOS 18.7.7 note versus GTIG on CVE-2026-20700 (see the DarkSword drop) if the kit resurfaces.

Source health and verification: the probe covered 242 records (241 relevant, 1 stale) and its UNSOLVED list held one record, ico-uk [needs-demote], a false alarm: the recipe downloads a 5 MB sitemap and a cold fetch passed the 45 s probe budget twice, while the same recipe returned in 3 s once cached. tools/source_health.py now honours a per-source probe_timeout (set to 120 on ico-uk) and tools/test_source_health.py covers it; the snapshot in state/source_health.json still shows the false alarm until the next sweep. Verification so far: iteration 1 (truth 9, editorial 5, advisory 4) found hedges missing from the Danfoss title and summary, an unsupported "no security updates" claim, a MikroTik headline that overstated the changelogs, attribution slips in the SonicWall and Publica records and a missing downtime note; all were fixed or declined with a reason. Iteration 2 (truth 4, advisory 4) found one false negative in the Danfoss Exposure line, a registry summary stating the defrost as fact, and two more hedges; all were fixed except one declined F11, the CISA citation date on the MikroTik entry, which iteration 3 raised again and which is now corrected (the advisory's own number, ICSA-26-272, dates it 2026-09-29). Iteration 3 (truth 1, advisory 4) found two stale statements in these notes and wording slips, all fixed. Iteration 4 (truth 5) found a clause in an older SonicWall update section that Defused contradicted, an affected-version range on the MikroTik entry that ignored the long-term builds, an action line on the Publica entry that overlooked Publica's own statement, a Previdian citation date that was the last-observed date, and an off-by-one source count in these notes; all were fixed. Iteration 5 (truth 0, editorial 1, advisory 5) found no wrong claim: it added the retailers' own framing of the attack as hitting a refrigeration service provider or supplier, which the Danfoss entry now carries with a takeaway asking the contractor whether its own remote access was affected, and four wording and consistency points. The low-residual early exit applies (truth plus editorial is 1, no F1 or F4), so the remediations were applied and the run published without a sixth pass; the provider sentences were checked by hand against the AFP and BleepingComputer pages read this run. Residual: the Danfoss changes made after iteration 5 (headline, provider sentences, trims) have had no independent pass, and the SonicWall status stays patch-available on evidence limited to decoys, which a reader may weigh differently from the Atlassian entry.