2026-10-17T0256Z-intel

Verification & coverage notes

Window: gap 24.0 h from 2026-10-16T0256Z-intel, window 26 h, developing-story window 72 h; the container clock agreed with the network date (skew 0 s) and the first fetch of origin/main was current. One new entry (AOMEI Backupper and AnyViewer update-channel tampering by UNC7017, high: GTIG names Switzerland among 11 victim countries and the decision is a bounded endpoint hunt over April to July) and five changelog records: Atlassian CVE-2026-21589 (update: the CVE record was rejected by its CNA on 2026-10-16 while advisory, fixes and KEV listing stand; the record was checked against the EUVD record, the CVE Services record and the vendor advisory), PK Softech (update: the Pensionskasse Stadt Zürich confirms that insured persons' and pensioners' test data was stolen, Pensionskasse Post confirms personal data left), Exchange October update (update: Microsoft's registry workaround and do-not-uninstall guidance for the Windows Server update regression), PaperCut NG/MF (update: Hunt.io's recovery of the attacker's open directories, a second configuration-based XML-RPC route, a cron-kept SOCKS tunnel, 45 live victim pivots, Switzerland among the countries listed) and Ivanti Connect Secure (improvement: CVE-2026-111357 now identifies the unfixed root-escalation step; it does not re-float the entry).

KEV sweep (work/2026-10-17T0256Z-intel/kev-window.txt): two additions in the window, CVE-2025-61624 and CVE-2026-102764, both COVERED by the previous fire's entries; no COVERED-STALE, MENTION-ONLY or RANSOMWARE rows. S1 also confirmed that no covered CVE moved from not-exploited to exploited and that the EUVD exploited list (ten records since 2026-10-01) is fully covered.

Backlog (state/coverage_backlog.md): the one open row, Beyond Gravity, was re-gated on today's facts by S2: no new fact since the SRF report of 2026-10-15, the vector, actor and data class are still not public and the China assumption rests on anonymous sources, so an incident entry would carry no evidence-bound technique. The row is unchanged and expires 2026-10-20; no note was appended because nothing changed state.

borderline-drop lines:

• borderline-drop: Arkadia SpeeCAN RAIDEN, NET119 and 119RAIDEN, the Japanese municipal alerting and emergency-call registration supplier (S4; first disclosure 2026-10-13, vendor updates to 2026-10-16, up to 3.1 million addresses possibly exposed) - the vendor names no vulnerability, vector or actor, so any technique id would be inference; no Swiss nexus; incident floor. The 2026-10-16 fire dropped it on the same ground and nothing since changes it.
• borderline-drop: PwnEscape CVE-2026-99999 and Vghost CVE-2026-74580, Linux guest-to-host and local escalation flaws (S3) - a guest or local prerequisite, no exploitation, not in KEV, fixed in stable kernels; regular patch cycle.
• borderline-drop: NGINX 1.30.6 and 1.31.7 (five configuration-dependent flaws), Next.js out-of-band update (two unauthenticated RCEs, one conditional on Cache Components, one on SVG optimization), SAP Cloud SDK for Python CVE-2026-89111, Check Point LiteLLM CVE-2026-35029, OX Apache Airflow SSH host-key defaults (S3) - no exploitation or public proof of concept reported, conditional configurations, constituency exposure not established; Next.js was dropped on the same facts by the 2026-10-16 fire.
• borderline-drop: Microsoft, Health-ISAC and Japan's police disruption of YAM Store, CoGUI and Iron Man (S3; dropped by the 2026-10-15 and 2026-10-16 fires on the same facts) and Qurium's Aeza address-space report with a Swiss-registered block (S3; the Swiss consequence is the analyst's inference, not Qurium's) - no decision a Swiss responder makes differently within 7 days.
• borderline-drop: Republik's Metabase intrusion (S2; one trade-press relay of the victim's statement, a private-sector magazine, the CVE inferred rather than named, and the covered Metabase entry already carries the credential-rotation guidance).
• borderline-drop: DD-Automation (S2; Safepay claim) - a sub-supplier of the contractor that runs the conveyor technology at the Army logistics base; the Army says no interfaces exist and site security is unaffected, the only source is Inside IT, and the one technique id (T1657) would rest on the leak-site claim alone.
• borderline-drop: Eichstätt ransomware, the Berlin Landesnetz closure statement, Fehmarnbelt contractor FLC, the BAE-run US Bankruptcy Noticing Center outage (S2, S4) - incident floor: no vector, actor or behaviour beyond the impact, so no honest technique mapping. S3's Norwegian armed-forces rental-car lead was not followed: its primary was not reachable and it carries no Swiss nexus.
• borderline-drop: alleged Qilin member extradited from Japan to Germany with the Synnovis attack folded into the case (S4) - a law-enforcement item with no reported change in the group's activity and no defender decision.
• borderline-drop: GreyNoise proxyjacking, Symantec's Aoki infostealer, Forescout's ROMULUS (an update-of on the covered ChatGPT ClickFix entry with no new decision), Fox-IT's Cobalt Strike corpus, XBOW's Chrome chain (S3) - marginal for this constituency.

Single-source: the Exchange entry stays single-source (Microsoft is the vendor and the only observer); the AOMEI entry is multi-source (GTIG and METAL are independent first-hand observers) at B1. Reduced-confidence inclusions: none.

Contradictions: CVE-2026-111357's description says exploited in the wild in October 2026 while CISA's ADP data on the same CVE record says Exploitation none; the entry cites Volexity and the GitHub advisory text for the exploited status and does not repeat the CISA field because the CVE Services record is not a citable source. The PKZH page still carries the earlier line that it is checking whether its data is affected next to its confirmation; the entry reports the confirmation and the fields still being clarified.

Priority and ground calls: AOMEI is high rather than notable because GTIG names Switzerland among the victim countries and the decision is a hunt over a bounded period; it is not critical (no exploitation of a constituency system is shown and the vendor's servers are reported repaired). The Atlassian and Ivanti records leave priority unchanged (high, critical); the Exchange record leaves notable; PK Softech stays notable. The Next.js, NGINX, PwnEscape and Vghost drops follow the PD-11(b) limb: no exploitation signal and no mechanics that force the timeline. The Exchange update is update rather than improvement because Microsoft's workaround is a new vendor development, not a re-read of material already published.

Candidate sources: manageengine-metal added (S3), co-primary for the AOMEI entry; no feed exists, the landing page and reports read with extract. Not added: qurium, tencent-zhuque-lab, forescout-vedere-labs (S3; their items were dropped), br24-bayern (S2; no feed probed) and internet-watch-impress (S4; its only item was dropped), which the next audit may revisit. drupal-security promoted to active (promotion_due, three contributing runs). Recipe notes from the sub-agents' coverage gaps were folded into 25 source records, trail-of-bits moved from webfetch to its direct feed, and cash-ch-awp, the one UNSOLVED row of the health check, got a health_cmd on the news sitemap; the second health sweep reports 246 probed, 245 relevant and 1 stale, and no UNSOLVED row.

Rotation: slices were ranked on the rotation cursor; the previous two fires had attempted 109 records, and excluding them as a belt-and-braces removed 23, 23 and 29 candidates from the S1, S2 and S3 pools. S4's pool of breach sources had all been attempted by the previous two fires, so its 14 oldest by cursor were allocated anyway. All 21 essential records were attempted. The S3 slice carried 122 to 148 h lookbacks.

Coverage gaps: ivanti-advisory-hub (JavaScript shell on every transport, as in the previous fire), the BSI WID-SEC advisory page (an Angular shell; the CVE text came from the GitHub advisory page instead), the EUVD human page (an Angular shell; the rejection text is read from the record's data and is the one quote the gate could not machine-check), two metered-reader credits spent when extract fell through to the reader for BeyondTrust and Wordfence pages (S1), databreaches-net posts (reader fallback), fuitesinfos and hackernews (listing windows shorter than the lookback). No other unrecovered failure.

Verification loop: three cold passes of the single verifier definition, findings per iteration 22, 11 and 5 (truth 9, 4 and 2), all remediated or declined with a reason in the record. Iteration 1 corrected an attribution of METAL's reproduction, a missing citation per clause on PK Softech, a stale PaperCut fixed-version statement (the September bulletin, revised 2026-10-13, now lists 24.1.10 and names 24.1.11) and two run-record counts; iteration 2 found a stray template token in the AOMEI Triage line and a handful of hedges. Iteration 3 returned NEEDS_FIXES with two low-confidence one-clause truth findings (a Previdian timeline time on the Atlassian entry and a lines-versus-sections count on the AOMEI entry) and no F1 or F4, so under the early-exit rule both were applied and the run publishes without a fourth pass; verification_residual_count is 2 for that reason. Declined with reasons: PK Softech priority stays notable, the long sourcing notes and the PK Softech consolidation are left for the audit, and the actor-chosen task names stay as behavioural anchors.

Dates and telemetry: GTIG's AOMEI page carries 2026-10-15 in its JSON-LD and visible dateline but a page-meta published_time of 2026-10-16T21:02Z, and The Hacker News reported it on 2026-10-16; the entry cites it as 2026-10-16 and the window gate passes on that date. S2's return header counts 27 web searches and 130 bridge fetches, its findings file 24 and 120; the header is recorded in sub_agents.

Operational notes: files over 1 MB under work/2026-10-17T0256Z-intel/ (S1's 47 MB Microsoft October CVRF working copy, two copies of the CISA KEV JSON and the quote-check page bodies) were deleted before commit; all are re-fetchable public data and the findings that used them are in the findings files. Stop-hook nudges to commit arrived repeatedly mid-run and were not acted on (nothing is committed before Phase 6). A background-job cd in one deep-read command ran three fetches from the wrong directory; they were re-run with absolute paths. Entry timestamps were set from the container clock, which was re-read before each record.