2026-10-20T0256Z-intel

Verification & coverage notes

Window: gap 24.0 h from 2026-10-19T0256Z-intel, window 26 h, developing-story window 72 h; the container clock agreed with the network date (skew 0 s) and the first fetch of origin/main was current. A Tuesday window with a quiet authority surface (every Swiss and neighbouring-authority listing the sub-agents swept had one item at most inside it), and a thin day for new disclosures: the signal was mostly developments on covered findings, four new entries and five changelog records.

KEV sweep (work/2026-10-20T0256Z-intel/kev-window.txt): no CISA KEV addition inside the window (catalogue 2026.10.16, read again by S1 and FU1), so no NOT COVERED, MENTION-ONLY, COVERED-STALE or RANSOMWARE row.

Backlog (state/coverage_backlog.md): the one open row, Beyond Gravity, reached its 2026-10-20 expiry. S2 and S4 searched in four languages and read the SRF original, BACS, the NCSC.ch Security Hub and the federal news listing and found nothing newer than 2026-10-16; still no vector, behaviour or data class, and the China assumption rests on one outlet's anonymous sources. Struck with that reason and a reopen condition.

Published: cve-2026-110936-siemens-software-center-clickfix-sideload (notable, vendor-confirmed exploitation, attackers ship their own signed copy), ovhcloud-cli-release-assets-replaced-secret-stealing-build (notable), nginx-three-unauth-heap-corruption-flaws-fixed-1-30-6 (notable; F5's October bundle had never been dispositioned, FU1 read the vendor channel; three CVSS 4.0 9.2 heap flaws plus two companions in the same release, no exploitation or proof of concept) and bacs-authentication-security-classes-technology-assessment (routine policy; the national authority's reference for grading authentication, non-binding). Updated: Publica / PK Softech (federal security organs named by Blick, Libera AG and the Bernese fund per NZZ; both missed by the 2026-10-19 sweep although published before it), ConnectWise Cloud Backup (Huntress's second tenant and the random secret planting), Citrix CVE-2026-88771 and CVE-2026-88779 (Rapid7's incident analysis chaining the two) and Atlassian CVE-2026-21589 (ENISA's record restored after the rejection).

borderline-drop lines:

• borderline-drop: Eptura Archibus CVE-2026-107186, CVE-2026-107187, CVE-2026-107188 (S1) - Rapid7's pre-authentication DWR chain to JSPX code execution has no exploitation reported, no vendor advisory was found, the application is normally internal and no constituency deployment is established; reopen on exploitation, a KEV listing or a Swiss deployment report.
• borderline-drop: PwnEscape CVE-2026-99999, Linux kernel guest-to-host escape (S1, S2, S3) - a local primitive that needs guest code execution, no exploitation, not in KEV, stable fixes listed; the 2026-10-16, 2026-10-17 and 2026-10-19 fires made the same call. S2 and S3 returned it as a new item; pwn.ai's part 1 forecasts exploits in weeks to a month, which is the researcher's expectation and not a development. Reopen on a public exploit, a KEV listing or reported exploitation.
• borderline-drop: Adobe Commerce and Magento CVE-2026-103849 public reproduction lab (S1) - the lab says it does not show a stock remote-code-execution chain, no exploitation is reported and the covered entry already carries Sansec's four reproduced routes and the warning that attackers will follow; reopen on a working public exploit or exploitation.
• borderline-drop: WPSplinter, Broadcom WPS Monitor (S3) - a proximity-only attack, a single researcher source, no exploitation, no CVE, no Swiss device named, and replacement the only lever.
• borderline-drop: Storm-3119 and Storm-2990 phishing ecosystem (S3) - Microsoft's primary is dated 2026-10-14, outside the record's lookback; no Swiss nexus; hardening advice generic.
• borderline-drop: Loxone cyberattack (S2, S4) - the 2026-10-19 note asked for a re-check for a vendor statement, and one now exists (CRM, support and applicant data copied, website defaced by a group calling itself Samurai), but the access path is undisclosed, the actor is a defacement claim and no source ties a Swiss customer to it; incident floor. Reopen on a vector, a Swiss customer or partner notification, or a leak of installer data confirmed by the vendor.
• borderline-drop: Roundcube 1.7.5 and 1.6.20 (S2, FU1) - twenty fixes without CVE ids, per-fix severity or exploitation; FU1 saw the previous two Roundcube releases receive CVE ids about eight to nine days after release, so the CVE ids are likely around 2026-10-27 to 28; re-check then.
• borderline-drop: Rank Math PRO 3.0.123 BleepingComputer sample (S4) - a PHP sample of unconfirmed provenance adds a cloud-credential theft capability, and the covered entry already directs rotation of every credential the site can reach.
• borderline-drop: Check Point Swiss attack statistics, Ontinue Teams report, Windows 10 LTSB and Server 2016 lifecycle notices, OFAC PAIPA designations, the biometric identity card rollout, the Republik leak, French leak-forum claims (I-CAD, Vackelys, Blissim and others), Canva, Bullhorn, OpenCode, Nikkei, Sourcenext, abc Bank, the CDU Heilbronn mailbox phishing, Eichstätt, Yamato, Burger King Japan and ETS (S2, S4) - vendor statistics, lifecycle notices, out-of-nexus or unconfirmed claims.
• borderline-drop: Apache Camel batch, Mercury, Craft CMS, GeoVision, Searchlight AEM, Calif Hexacon demos, Plex2Shell, SiteGuard WAF, the BeyondTrust PRA claim (S1, S3) - no exploitation or no constituency nexus; BeyondTrust's own advisory page is walled (403 on every rung).
• borderline-drop: Darktrace CikaBika, Calif Big Fish OpenBSD, KELA reports, AhnLab ARTEX, Sonatype Q3 index (S3) - outside the lookback, no CVE or exploitation, or statistics.

Single-source and carve-outs: cve-2026-110936-siemens-software-center-clickfix-sideload rests on Siemens ProductCERT alone for the exploitation of its own product (single-source, Admiralty A2); bacs-authentication-security-classes-technology-assessment is BACS on its own publication (single-source-national-cert). The Publica update attributes the federal note to SonntagsBlick (Blick is reliability C); the Finance Department's confirmation is limited to the Federal Council briefing. Reduced-confidence inclusions: none. Contradictions carried: OVHcloud lists v0.11.0 to v0.15.0 as compromised and the GitHub reporter checked v0.13.0 to v0.15.0 (both stated in the OVHcloud entry); the Debian tracker marks bookworm and trixie vulnerable while upstream marks 1.30.6 fixed (carried as distribution lag in the NGINX entry).

Dates for the next fires: Oracle's October Critical Patch Update lands 2026-10-20 (S1 read the pre-release: 1283 patches, 34 unauthenticated in E-Business Suite and 132 in Fusion Middleware; CVSS 9.9 for Essbase and Trusted Answer Search; the risk matrices carry the CVE ids, read with extract of oracle-cpu), the Atlassian monthly security bulletin is due 2026-10-20 and was not listed at 03:00 UTC, and Cisco publishes Expressway, IOS XR for ASR 9000, Secure Client, Snort and Unified Communications advisories on 2026-10-21. The 2026-10-21 fire should carry all three.

Candidate sources: opensourcemalware (S4) and forescout-research (S1) added, each cited by an entry this run. Not added: cve-services-api (S1's suggestion to sweep covered CVEs for state and SSVC changes through the CVE Services API found the Atlassian restoration and CISA-ADP's rating of CVE-2026-103849; the endpoint is on the gate's blocked-URL list, so a fire may read it but not cite it, and the audit can decide whether to make it a standing duty) and d3lab (S3, Italian phishing lab, no item this fire).

Coverage gaps: blick-ch (the 121 h lookback cannot be served: RSS holds about 12 h and the news sitemap about 48 h, so Blick items of 2026-10-15 to 2026-10-17 were not enumerated), kela-cyber (undated listing and gated reports), ahnlab-asec (reader-only listing and two of three reader keys exhausted), reliaquest (sitemap lastmod is not a publication date; no new post found), connectwise-trust-center (403 on every rung, no ConnectWise update after 2026-10-19 01:15 UTC could be read), my.f5.com (JavaScript shell on every transport; F5's text came through the CNA record as republished by Debian and by relays), parlament.ch committee pages (JavaScript-only), cyber.gouv.fr (Incapsula wall on the direct transport), hub.ivanti.com (unreadable on every transport; ivanti-advisory-hub is a stale fetch-gap id, the record is ivanti-psirt), ec-digital-strategy-newsroom and Europol feed items (undated listings).

Essential-coverage: all 21 essential records were attempted (S1 11, S2 10) and returned content; every authority feed was quiet.

Excluded as recent attempts: the belt-and-braces exclusion of the previous two fires' attempts removed 19 candidates from the S1 to S3 allocation; the breaches pool for S4 is 19 sources and both previous fires had attempted all of them, so S4 took 14 of them oldest-first from the rotation cursor instead of an empty slice. The slices were S1 14, S2 14, S3 14 and S4 14 standard or candidate records.

Source bookkeeping: last_successful_fetch moved for the sources whose items shipped, and consecutive_quiet_periods rose by one for the 41 sources whose ledger rows show a swept source with no in-horizon item. Promotions: bishopfox-blog, borncity and gambit-security met the three-run bar (sources.promotion_due).

Process: the container restarted mid-run (about 03:38 UTC) and killed the first FU1 spawn, which had written only progress lines; its work was lost and it was re-spawned once with the progress carried forward. The repository state on disk was intact. A stop hook asked three times for a commit while the run was mid-pipeline; nothing was committed before Phase 6.

Source health: tools/source_health.py probed 253 records; the first sweep put two on the UNSOLVED list (redcanary, stale since 2026-08-20 after its blog moved into Zscaler's, repointed to Zscaler's dated feed; connectwise-trust-center, unreadable on every transport today, set to blocked), and the second sweep ended with one needs-demote row for connectwise-trust-center that the blocked setting classes as handled on the next probe.

Self-identification: main agent Claude Sonnet 5.5 (claude-sonnet-5-5) from the harness-injected model line; all five research sub-agents (S1 to S4 and the FU1 follow-up) reported Sonnet 5.5 from their own prompt line.

Verification: four iterations, none CLEAN, ending on the low-residual early exit (rule 5). Iteration 1 (NEEDS_FIXES, 11 truth, 5 editorial, 4 advisory) caught that the NGINX entry named three flaws where nginx's own change log lists five and cited a rolling index page as a dated source, a stale ConnectWise title, an unsupported "about a week", an unsourced "unsigned" in the Siemens triage line, a Romulus name collision with RomulusLoader, a false run-record note about Forescout and the Publica enumeration that is Blick's gloss rather than the note's; all but four low-confidence items were fixed. Declined with rebuttal: the NGINX vulnerability-gate objection (F7: three unauthenticated pre-auth flaws scored 9.2 by F5 in the web server public-sector estates rely on, a national authority warns to patch at once, an earlier NGINX flaw was exploited three days after its public proof of concept, Debian stable is unfixed, and the entry says plainly that nothing is exploited), the Publica priority-high suggestion (F16: one outlet's reading of one confidential note, standing actions unchanged), the unreadable Citrix SAML guidance page (403 on every rung, unchanged earlier text) and the ConnectWise rolling advisory index (no per-incident permalink exists). The Atlassian record was retyped from update to improvement on the verifier's reading of the update-versus-improvement rule, so the entry is not re-floated. Iteration 2 (6 truth, 1 editorial, 4 advisory) was all wording precision (a "nobody analysed" absolute, a superlative in the Publica headline, an attack-complexity qualifier attached to a flaw whose page does not carry it, shorthand and a missing reference). Iteration 3 (2 truth, 2 editorial, 2 advisory) found that one address in Siemens' indicator list also appears among Forescout's ROMULUS hosts, which the Siemens entry now says without printing it. Iteration 4 (1 truth, 0 editorial, 1 advisory) found a weakness label that only the advisory carries and a vague closing sentence in an old Citrix paragraph; both were fixed and the fire published on the early exit with a residual count of 1 (the iteration's own truth count, already remediated). The 2026-10-19 note that Loxone was worth a re-check is answered in the borderline-drop list.