2026-10-16T0256Z-intel

Verification & coverage notes

Window: gap 24.0 h from 2026-10-15T0256Z-intel, window 26 h, developing-story window 72 h; the container clock agreed with the network date (skew 0 s). Five new entries (BeyondTrust Remote Support CVE-2026-102764 critical; Drupal core SA-CORE-2026-014 high; AdFection, CL-UNK-1211 and PEERSTITCH notable) and eight changelog records, seven update and one improvement (the Exchange OWA caveat, which does not re-float its entry): PAN-OS 11.2.16 published; the CISA KEV listing of the Atlassian flaw; the AhsayCBS hotfixes, KEV listing and Bitdefender MDR intrusions (notable to high); CERT-FR's lateral-movement alert on Ivanti Connect Secure; Microsoft's Exchange outage notice after the October Windows updates; the police fraud-call warning and BVK statement on PK Softech; IDC Frontier's fifth report; Sansec's BlockStrap reproduction for the Adobe October entry. No deep dive: nothing cleared the bar. The previous record's publish_status is ok.

Operational event: a container restart at about 03:16Z killed the first S1 to S4 spawns 19 minutes in. S3 had written six valid items; S1, S2 and S4 had only progress lines. All four were re-spawned as resumptions with incremental findings writes, each carrying its progress lines as leads; the sub_agents blocks show the original started_at and the final ended_at, so durations span the restart. One continuation per domain was not needed afterwards. The main-agent clock stayed correct (verified after the restart).

KEV sweep (work/2026-10-16T0256Z-intel/kev-window.txt): one addition in the window, CVE-2026-21589 (Atlassian), COVERED. Its entry stated attempts only and said in a dated section that the flaw was not in KEV, so the listing shipped as an update record (PD-13 exploitation-status change). No RANSOMWARE rows. The AhsayCBS pair (KEV 2026-10-14, covered as exploited by the 2026-10-15 fire) needed an update for a different reason: Ahsay's own hotfixes and its admission that the earlier patches were incomplete, which the entry still described as "no fixed release named".

Backlog (state/coverage_backlog.md): the one open row, Beyond Gravity, was re-gated with a dated note appended. SRF reports (single outlet, anonymous sources, 2026-10-15) that the company and the Confederation assume China is the attacker, and the Council of States' oversight committee chair said the committees were told of a data outflow; the company says the origin is not confirmed. S4 recommended a short notable entry and S2 left the choice to the main agent. Held instead on two grounds, relevance first: with no vector, behaviour or data class public there is no exposure test, detection or hunting step a Tier 2/3 reader could take from an entry, so under PD-11 it is a headline rather than actionable knowledge; and no evidence-bound ATT&CK mapping exists, so an incident entry would FAIL the gate's non-empty techniques[] rule; the row expires 2026-10-20 and is struck then unless a vector, behaviour or data class is named.

borderline-drop lines:

• borderline-drop: Arcadia SpeeCAN RAIDEN, the Japanese municipal emergency-alert and NET119 supplier (S4; first disclosure 2026-10-13, up to 3.1 million addresses possibly exposed, 111 public bodies reported), no vector or actor named, so any techniques[] id would be inference; no Swiss nexus; incident floor. Its transferable lesson (a multi-tenant alerting supplier is a single point of failure) is not yet a decision.
• borderline-drop: Juniper October 2026 Junos bundle, 23 of about 154 CVEs at CVSS 9.0 or above including three unauthenticated J-Web authentication bypasses and an httpd overflow (S1), no exploitation per Juniper SIRT, exposure needs web management configured, the vendor pages are a JavaScript shell; the 2026-10-15 fire made the same call.
• borderline-drop: Nutanix CVE-2026-84731 (pre-auth cluster-admin bypass on port 9440, fixed in AOS and Prism Central 7.6.0.8, 7.5.2, 7.3.1.18; PoC validated at disclosure, none public), Znuny CVE-2026-93483 (fixed since 2026-09-16, applies only where the HTTPBasicAuth backend is configured), Splunk CVE-2026-76268 (Patroni REST API on search head cluster members), Next.js out-of-band RCEs (narrow preconditions, two without CVE), AnyDesk Linux CVE-2026-109390 (public exploit, direct TCP/7070 only, fixed 2026-06-23, no exploitation), Windows DNS CVE-2026-62878 (DoS-only PoC), Fortinet FortiSandbox and FortiSIEM (Known Exploited No; dropped on 2026-10-14 and 2026-10-15) (S1), none exploited, none an out-of-band decision on its own mechanics; re-gate on exploitation or a public exploit.
• borderline-drop: PwnEscape CVE-2026-99999, a Linux kernel guest-to-host escape (S3), local vector inside a guest, a lab result, fixed in stable kernels, no exploitation reported.
• borderline-drop: FortiBleed Swiss exposure scan (S2; one trade-press relay, reachable interfaces not compromises), QuartzLine (S3; no public Mandiant document, second source an AI-agent-authored blog), KELA's Silent Ransom Group chat analysis (S3; authenticity unverified), the swarmcha.se Tencent agent fleet (S3; no constituency nexus), YAM Store, ARTEX and UAT-6275 (S3; dropped by the 2026-10-15 fire on the same facts), the Microsoft October Patch Tuesday residual (S1; none exploited, the five Outlook preview-pane RCEs rated Exploitation Less Likely), Le Tampon Qilin claim, Park Dental 8-K (S4).
• Left out of the PK Softech update: Stiftung FAR (S4, S2). Inside IT lists it as a potential victim, blue News relays CH Media that FAR's IT partner is a different provider than Publica's, FAR is a private foundation and its own notice was not found (bzbasel.ch is 403 on the direct, extract and reader transports).

Single-source: 2026-10-16/cl-unk-1211-ai-assisted-intrusions-government-linux-hosts and 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager are single-source (Unit 42 is the only observer; PEERSTITCH also cites Fortinet's own advisory for the CVE) at B2. Reduced-confidence inclusions: none.

Contradictions: Ivanti's affected 25.x line differs between sources (Rapid7 and the entry: 25.1.2.2 and prior; the Canadian Cyber Centre: 25.2.2 and prior; CERT-FR lists only the 25.1.1.x and 25.1.3.x lines); Ivanti's own advisory is a JavaScript shell on every transport, so the entry discloses the difference instead of picking a side. The AhsayCBS announcement is dated 2026-10-12 in the page markup, though the extractor drops that dateline and reports a stale 2023 meta date; Huntress dates the hotfixes to the same day.

Priority and ground calls: BeyondTrust is critical on the bar (exploited as a zero-day by a suspected China-nexus actor, unauthenticated, remote-support appliance, persistence survives reboot and configuration reset, GTIG expects broad exploitation, patch available); Drupal is high although unexploited because the Security Team's own pre-announcement warns of exploits within hours or days, the flaw has a known unauthenticated path and Drupal is the CMS behind many public-sector sites; PEERSTITCH stays notable because CVE-2025-61624 needs an administrator account and the intrusion is from 2024, although Fortinet lists the flaw as known exploited and has no fix for FortiOS 7.2, 7.0 and 6.4; PEERSTITCH was published 2026-10-14 about 3 h before the window and is first coverage (Unit 42 was in no earlier slice). AhsayCBS moves to high: KEV-listed, the vendor's patches were incomplete and the fix is partner-only. The Atlassian flaw was already high.

Candidate sources: drupal-security added (S1), its health flag cleared in the same run by switching the recipe to the all-advisories RSS feed. Not added: nutanix-security-advisories (the Nutanix item was dropped), noma-labs, rogueauthority-org and watch-impress (S3 and S4; recipes unverified or a low-reliability publisher), which the next audit may revisit. No promotion_due rows.

Rotation: the digest built; S1 to S3 slices were ranked on the rotation cursor and 91 records attempted by the previous two fires were excluded as a belt-and-braces. S4's pool of 13 breach sources had all been attempted by the previous two fires, so its 12 oldest by cursor were allocated anyway; the S3 slice carried 121 to 148 h lookbacks.

Coverage gaps: ibm-support-security-bulletins (no listing or feed reachable; the PSIRT blog feed is malformed XML), socket-dev-blog (no post list, feed 404), the Juniper support portal and hub.ivanti.com (JavaScript shells), bsi-de (the CSAF page WID-SEC-2026-3976 returned 404 although the RSS item exists), rapid7-research (malformed feed XML, not in a slice), citizen-lab (RSS lagged), the Beyond Gravity company release and the Stiftung FAR notice (not found), bzbasel.ch (403 on the direct, extract and reader transports) and linfo.re (403 on every transport).

Verification loop: eight cold passes of the single verifier definition, findings per iteration 29, 23, 10, 7, 5, 4, 6 and 3, all remediated or declined with a reason in the record; no pass returned CLEAN, so the loop ended at the iteration cap and the run publishes fail-open. Iteration 8 (full ledger, 259 of 259 claims answered) found one truth defect, a false clause in the Adobe sourcing note (the solution table rates both fixes priority 2, as the summary does), which was corrected through the entry's existing changelog record together with two telemetry mismatches in this record; those last corrections were verified by the main agent against Adobe's page and the sub-agent ledgers but not by a further cold pass, hence verification_residual_count: 1. Later passes found mainly run-record statements and low-confidence sourcing questions; the entries' claims were stable from iteration 5 on.

Operational notes: stop-hook nudges to commit arrived repeatedly mid-run and were not acted on (nothing is committed before Phase 6). tools/source_health.py printed one UNSOLVED row, drupal-security, fixed in the same run. The harness offers no TodoWrite tool, so the phase plan lived in these notes. Entry timestamps were re-set once after a clock check showed several changelog at values ahead of real time.