2026-10-21T0256Z-intel
One pipeline fire, in full · intel run of 2026-10-21 · sub-agent allocation and telemetry, per-iteration verification verdicts and findings, source-list edits, coverage gaps, bridge invocations, and the run's own verification & coverage notes: what was published, what was dropped at the borderline or judged not relevant (and why), single-source carve-outs, and contradictions. Rendered from runs/2026-10-21/2026-10-21T0256Z-intel.md.
Run telemetry
- Items returned
- 10
- Duration
- 36m 07s
- Tool calls
- 5 WebFetch14 WebSearch200 bridge
- Cited sources
- 5 of 26 in slice
- Items returned
- 3
- Duration
- 25m 14s
- Tool calls
- 4 WebFetch24 WebSearch120 bridge
- Cited sources
- 2 of 19 in slice
- Items returned
- 9
- Duration
- 23m 48s
- Tool calls
- 3 WebFetch17 WebSearch150 bridge
- Cited sources
- 2 of 14 in slice
- Items returned
- 9
- Duration
- 20m 33s
- Tool calls
- 2 WebFetch29 WebSearch90 bridge
- Cited sources
- 2 of 12 in slice
Verification
Deep dive
·
Entries this run published (6) and updated (4)
- CVE-2026-0257, Palo Alto PAN-OS GlobalProtect: pre-auth authentication bypass via certificate reuse, marked by CISA as used in ransomware campaigns
- Metabase CVE-2026-72898: an unauthenticated SQL-injection zero-day gave attackers administrator access to BI instances, exploited since at least 3 August, with VenariX counting fifteen downstream victims
- PK Softech, software supplier of Swiss pension funds: malware and a data outflow at Publica, with the City of Zurich fund PKZH saying its insured persons' test data was stolen, the Bernese funds BPK and BLVK and Pensionskasse Post also reporting the supplier incident, and the Federal Prosecutor's Office investigating
- ConnectWise Cloud Backup (formerly SkyKick): the vendor's Microsoft 365 application credential was used to sign in to customer tenants, with directory-role self-assignments in about 50 tenants and, Huntress reports, added credentials in two
- CVE-2026-109618 / CVE-2026-109619, PHP: two critical flaws rated CVSS 4.0 9.2, which CERT-EU reads as possible remote code execution, are to be fixed in a release pre-announced for 21 October 14:00 UTC, with a screenshot of an exploit tool reported leaked
- Oracle October 2026 Critical Patch Update: six unauthenticated network CVSS 10.0 rows in Access Manager, SOA Suite, E-Business Suite and JD Edwards, and WebLogic CVSS 9.8 flaws reachable over HTTP and T3/IIOP
- AA26-293A: FBI, CISA and German and UK law enforcement describe SafePay ransomware, which enters through VPN credentials and five edge-device and backup-server flaws and factory-resets backup NAS devices before encrypting
- eMudhra: the private keys of eight intermediate CA certificates were trivially recoverable, so anyone could forge trusted HTTPS certificates; browsers block them, clients with their own trust store or no revocation checking need an update (CVE-2026-111943 in Go)
- APT28 (Swallowtail) used the HOOKEDGE backdoor against a law-enforcement agency, a naval shipbuilder and an aircraft-engine maker in two NATO states; at the shipbuilder it then pushed an SSH key for a persistent tunnel, captured NTLM handshakes and ran a reflective loader
- TeamUpdraft breach: stolen UpdraftCentral connection keys are used to push backdoor plugins to connected WordPress sites, with no flaw in UpdraftPlus and no CVE; deleting the keys is the fix
Sources changed (this run)
Edits this run made to sources/sources.json · promotions, demotions, new candidates, and fetch-method / category / reliability / url corrections (the run record's sources_changed[]). Paginated; 10 per page.
21 last_successful_fetch · 15 notes · 3 added · 1 status.
| Source | Change | From → To | Reason |
|---|---|---|---|
| cert-eu | last_successful_fetch | · → 2026-10-21 | fetched and used |
| cisa-advisories | last_successful_fetch | · → 2026-10-21 | fetched and used |
| cisa-kev | last_successful_fetch | · → 2026-10-21 | fetched and used |
| enisa-euvd | last_successful_fetch | · → 2026-10-21 | fetched and used |
| inside-it-ch | last_successful_fetch | · → 2026-10-21 | fetched and used |
| ncsc-ch-focus | last_successful_fetch | · → 2026-10-21 | fetched and used |
| hunt-io | last_successful_fetch | · → 2026-10-21 | fetched and used |
| technadu | last_successful_fetch | · → 2026-10-21 | fetched and used |
| bleepingcomputer | last_successful_fetch | · → 2026-10-21 | fetched and used |
| cyberdaily-au | last_successful_fetch | · → 2026-10-21 | fetched and used |
| chrome-releases | last_successful_fetch | · → 2026-10-21 | fetched and used |
| oracle-cpu | last_successful_fetch | · → 2026-10-21 | fetched and used |
| symantec-security-com | last_successful_fetch | · → 2026-10-21 | fetched and used |
| unit42 | last_successful_fetch | · → 2026-10-21 | fetched and used |
| recordedfuture-insikt | last_successful_fetch | · → 2026-10-21 | fetched and used |
| patchstack | last_successful_fetch | · → 2026-10-21 | fetched and used |
| sansec-research | last_successful_fetch | · → 2026-10-21 | fetched and used |
| wordfence | last_successful_fetch | · → 2026-10-21 | fetched and used |
| netzwoche | last_successful_fetch | · → 2026-10-21 | fetched and used |
| swissinfo-ger | last_successful_fetch | · → 2026-10-21 | fetched and used |
| sophos-xops | last_successful_fetch | · → 2026-10-21 | fetched and used |
| forescout-research | status | candidate → active | promotion_due: cited by published entries from 3 distinct runs |
| sap-security-notes | notes | · → recipe note appended | 2026-10-21 (S1): recipe note from the sub-agent source ledger, text in sources.json |
| msrc-update-guide | notes | · → recipe note appended | 2026-10-21 (S1): recipe note from the sub-agent source ledger, text in sources.json |
| cisa-advisories | notes | · → recipe note appended | 2026-10-21 (S1): recipe note from the sub-agent source ledger, text in sources.json |
| enisa-euvd | notes | · → recipe note appended | 2026-10-21 (S1): recipe note from the sub-agent source ledger, text in sources.json |
| anssi-fr | notes | · → recipe note appended | 2026-10-21 (S1): recipe note from the sub-agent source ledger, text in sources.json |
| lumen-black-lotus-labs | notes | · → recipe note appended | 2026-10-21 (S3): recipe note from the sub-agent source ledger, text in sources.json |
| vaud-soc-cyber-threat-review | notes | · → recipe note appended | 2026-10-21 (S2): recipe note from the sub-agent source ledger, text in sources.json |
| netzwoche | notes | · → recipe note appended | 2026-10-21 (S4): recipe note from the sub-agent source ledger, text in sources.json |
| swisscybersecurity-net | notes | · → recipe note appended | 2026-10-21 (S4): recipe note from the sub-agent source ledger, text in sources.json |
| apa-ots | notes | · → recipe note appended | 2026-10-21 (S2): recipe note from the sub-agent source ledger, text in sources.json |
| hunt-io | notes | · → recipe note appended | 2026-10-21 (S3): recipe note from the sub-agent source ledger, text in sources.json |
| technadu | notes | · → recipe note appended | 2026-10-21 (S3): recipe note from the sub-agent source ledger, text in sources.json |
| news-admin-ch | notes | · → recipe note appended | 2026-10-21 (S2): recipe note from the sub-agent source ledger, text in sources.json |
| citizen-lab | notes | · → recipe note appended | 2026-10-21 (S3): recipe note from the sub-agent source ledger, text in sources.json |
| nethemba | added | · → status: candidate | S4: first-hand discoverer of the UpdraftCentral backdoor campaign on its own sites, with a live-updated changelog that the TeamUpdraft entry rests on; strong primary for WordPress and supplier-key compromises at a low cadence; article pages read with extract, no feed checked. |
| jpcert-eyes | added | · → status: candidate | S3: national-CERT technical blog (attack-infrastructure investigations, APT tradecraft, sensor reports), distinct from the existing 'jpcert' advisory record; its Atom feed reads directly with dated items. |
| bs-ch-medienmitteilungen | added | · → status: candidate | S2: first-party cantonal incident disclosures that reach the trade press late (the Erziehungsdepartement release of 2026-09-04 on a school print system was found six weeks later through the Vaud SOC digest); cantonal and communal press rooms are the largest uncovered public-sector source class. |
| connectwise-trust-center | notes | · → recipe note appended | 2026-10-21 (main): every transport fails again, so the id joins TRANSPORT_BLOCKED_UNREACHABLE in tools/source_health.py and the health check classes it handled |
Coverage gaps (this run)
Sources this run's brief needed that returned no usable content via any documented recipe. Bridge-recovered or quiet-day sources do NOT appear here. (Distinct from the independent source-accessibility probe at the foot of this section, which probes all active sources regardless of what any run needed.)
No coverage gaps in this run · every source the brief needed returned usable content via its documented recipe.
Bridge invocations (this run)
3 bridge calls this run · these are successful bridge fetches (separate from "Coverage gaps" above).
- tools/kev_window_diff.py ×1
- tools/fetch_source.py cisa-kev ×1
- extract ×1
Verification findings · all iterations
Per-iteration finding detail. Each table is one verifier pass · what was flagged, how the main agent remediated it, and the outcome. Walking the tables top-to-bottom shows the verifier's debugging trail across iterations.
Iteration #1 NEEDS_FIXES · 27 findings (truth=12, editorial=8, advisory=7) · Claude Sonnet 5.5 · 20m 25s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F13 analytical-link-as-fact | · | Unit 42 says 'Ransomware operators exploiting CVE-2026-0257 include Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc)' and, separately, 'In one notable case, attackers moved from the compro | · | |
| F3 claim-not-supported | · | The cited Wordfence page carries only the Site Health check (Tools > Site Health > Info > Server). None of php.net, CERT-EU, Sansec or Wordfence mentions mod_php, nginx, PHP-FPM or `php -v` in the bod | · | |
| F3 claim-not-supported | · | The one citation is Google, whose post says 'no TLS certificates chaining to these six intermediate CAs were logged to Certificate Transparency (CT) before our blocking action'. It carries neither eMu | · | |
| F4 hallucinated-fact | · | BleepingComputer (the only source for eMudhra's position): 'eMudhra said most of the affected intermediate certificates were never used in production and that it had found no evidence they were used t | · | |
| F3 claim-not-supported | · | The advisory's 'should not be attributed as malicious without analytical evidence' note introduces Table 1. WinSCP is not in Table 1 (7-Zip, FileZilla, Mimikatz, PowerShell, PsExec, RClone, ScreenConn | · | |
| F3 claim-not-supported | · | (low confidence) The Nethemba page's own published time is 2026-10-19T05:44:02Z; 2026-10-21 is the 'last updated' stamp of a living post, two days after publication. TeamUpdraft's page metadata dates | · | |
| F3 claim-not-supported | · | (low confidence) TeamUpdraft: 'We believe our customer database was accessed. It holds: ... connection keys for UpdraftCentral, UpdraftVault and UpdraftClone'. The vendor's belief is stated as a fact | · | |
| F3 claim-not-supported | · | (low confidence) Patchstack says 'The account also outlives the plugin' and 'as of 19 October no plugin update stops it'; it does not state that updating UpdraftPlus leaves an installed backdoor in pl | · | |
| F3 claim-not-supported | · | (low confidence) Symantec: the Edge window only fetches the task via fetch(); 'the batch script located the downloaded file, copied its contents into a new .cmd file, executed it, and uploaded the out | · | |
| F3 claim-not-supported | · | (low confidence) The cited vendor blog says 'After gaining access to your instance, the attacker could inject arbitrary SQL'; 'unauthenticated' comes from BleepingComputer's quote of the CEO and the G | · | |
| F4 hallucinated-fact | · | (low confidence) BleepingComputer says Framework's instance was 'accessed' and Tally's 'Metabase analytics environment was compromised' with email addresses and password hashes reached; no source says | · | |
| F4 hallucinated-fact | · | (low confidence) Neither cited page says Zurich (swissinfo: 'Swiss online magazine'; Netzwoche: 'Onlinemagazin'). The Keystone-SDA original on bluewin.ch (https://www.bluewin.ch/en/news/hackers-steal- | · | |
| F9 surface-contradiction | · | Unit 42 (cited for the new section) dates the KEV listing to 13 May; the catalogue JSON read this iteration and Rapid7 say 2026-05-29. The entry silently keeps 29 May with no Contradiction line. The r | · | |
| F9 surface-contradiction | · | (low confidence) Huntress (cited in the same entry; SpecterOps relays it) says the app authenticated 'between 06:13 and 08:34 UTC' and 'moved through tenants in sorted GUID order, a few seconds apart' | · | |
| F9 surface-contradiction | · | (low confidence) Nethemba, a source of this entry, names the basis and frames it as an upper bound: 'the vendor estimated that fewer than 10% of users have an UpdraftCentral or Migrator key, which mea | · | |
| F8 needs-more-research | · | (low confidence) The KEV record the entry already cites carries exposure conditions the line drops: CVE-2020-3259 'affects only specific AnyConnect and WebVPN configurations'; CVE-2023-27532 is a Clou | · | |
| F8 needs-more-research | · | (low confidence) Patchstack and Nethemba both state that on UpdraftPlus 1.26.4/2.26.4 and earlier an attacker does not need valid keys (CVE-2026-10795), so sites on old versions face both problems and | · | |
| F8 needs-more-research | · | (low confidence) Symantec says the identifier 'names the second-stage installer and its scheduled task', the entry maps T1053.005, and its own Recorded Future evidence quote asks for 'detection covera | · | |
| F18 action-item-discipline | · | (low confidence) The first half restates the body's Detection paragraph (b); the task is the response (delete the key first, restore, rotate, end sessions). Keep actions[0]; shorten actions[1] to the | · | |
| F16 org-triage | · | (low confidence) With this update the entry says the federal bodies assume Akira, that the data includes employer details of fedpol/NDB staff under cover identity, that an internal assessment sees dan | · | |
| F11 editorial-advisory | · | Headline states Sansec's inference as fact (php.net names no fixed branches; Wordfence: 'unsupported versions should not be expected to receive a patch'); CERT-EU wrote 'consider isolating internet-fa | · | |
| F11 editorial-advisory | · | Reader-facing sourcing_note carries fetch narration and composition rationale (when/what was read, why a CVE is 'carried') and runs to 5 or more sentences (Publica's is a paragraph block). The rule is | · | |
| F11 editorial-advisory | · | No em dash in reader-facing entry text (the section heading is the only exception). Pre-existing text, but the entries are re-published by this run. | · | |
| F11 editorial-advisory | · | Style rule bars file-name indicators; 'ld.exe' is the malware file name from Symantec's IOC table and the id_rsa-under-ProgramData path is a hunt string. The behavior (reflective loader decrypting an | · | |
| F11 editorial-advisory | · | Record-keeping narration inside a non-internal record summary that renders to readers; end the summary at the Sophos finding. Also: the Sophos sweep facts (07:11 to 08:47 UTC, ascending GUID order, 1 | · | |
| F11 editorial-advisory | · | The newest section reports an actor and a ransom demand (unconfirmed), so the two dated closers now read as current; add 'as of that date'. The Libera clause attributes the statement to a fund; NZZ at | · | |
| F11 editorial-advisory | · | The same living page is listed twice with different dates, and the older body sections still cite it as 2026-06-09 for text the page has since superseded ('No post-access behavior or lateral movement | · |
Iteration #2 NEEDS_FIXES · 7 findings (truth=1, editorial=1, advisory=5) · Claude Sonnet 5.5 · 14m 22s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F4 hallucinated-fact | · | (low confidence) Sansec (https://sansec.io/research/php2shell) says only that "A screenshot of an exploit tool named PHP2Shell, credited to Calif.IO, leaked alongside the advisory. Its banner claims t | · | |
| F9 surface-contradiction | · | (low confidence) The fix for iteration-1 finding 25 added "as of that date" to the closers of the 2026-10-17 and 2026-10-20 sections but left this 2026-10-10 closer in the present tense; the newest se | · | |
| F11 editorial-advisory | · | Reader-facing sourcing_note keeps reading-limit narration and a malware file name (ld.exe, which iteration 1 asked to remove from reader text) and several run past the two-sentence provenance limit. T | · | |
| F11 editorial-advisory | · | Same living page listed three times; this fire added the third record. Iteration-1 finding 27 asked for one record per living page on the PAN-OS entry and the fix merged them there; the same shape was | · | |
| F11 editorial-advisory | · | Google: "Some legitimate certificates chaining to this root will cease to function in Chrome as a result". The hedge word is dropped. Advisory. | · | |
| F11 editorial-advisory | · | The advisory's own Table 7 maps PsExec service execution to T1569.002 and the Windows command shell to T1059.003, and the body describes PsExec remote execution, but neither id is in techniques[]. Adv | · | |
| F11 editorial-advisory | · | Pre-existing em dashes and pipeline-internal wording in older Metabase text and one append-only PAN-OS record. The decline (left for the audit sweep) is acceptable; recorded as a residual so the audit | · |
Iteration #3 NEEDS_FIXES · 9 findings (truth=5, editorial=1, advisory=3) · Claude Sonnet 5.5 · 20m 58s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F2 generic-url | · | (low confidence) The primary source is the php.net year news archive (title 'PHP: News Archive - 2026'), a listing index of every 2026 news item, not the single announcement. CERT-EU, Sansec and Wordf | · | |
| F3 claim-not-supported | · | The cited advisory page (fetched this iteration, 1295 risk-matrix rows parsed) says only 'refer to ... Patch Availability Document for Oracle Products, My Oracle Support Note CPU391' and 'Please click | · | |
| F3 claim-not-supported | · | Not what the sources say: CERT-EU writes 'according to other leaks [1,2,3]' and cites a social-media post for PHP 5 onwards; Sansec reports that 'Information about the embargoed bugs leaked on October | · | |
| F3 claim-not-supported | · | Recorded Future (https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge) puts the hedge on the attribution of the activity: 'Insikt Group assesses with moderate confidence that this a | · | |
| F4 hallucinated-fact | · | (low confidence) The `rce` tag is stronger than the entry: the advisory gives only a CVSS vector (network, no privileges, High confidentiality, integrity and availability) and no vulnerability class, | · | |
| F6 strengthen-primary-source | · | (low confidence) `patch-available` on all five records rests on neither cited source (the advisory names no fix; KEV requiredAction says 'apply mitigations per vendor instructions'). The vendor adviso | · | |
| F11 editorial-advisory | · | Advisory, residual: this run edited the Metabase paragraph (added the GHSA citation) and left its em dash; the other em dashes in older Metabase sections and the append-only PAN-OS 2026-06-17 record s | · | |
| F11 editorial-advisory | · | Advisory: 'when read' narrates the research step; state the tracker's date instead ('as of the 2026-10-20 tracker'). | · | |
| F11 editorial-advisory | · | Advisory, low: the Publica page is still listed under two records (dated 2026-10-08 and 2026-10-20; the body cites each date), and ConnectWise's source is the Trust Center advisories index page (the 1 | · |
Iteration #4 NEEDS_FIXES · 12 findings (truth=6, editorial=0, advisory=6) · Claude Sonnet 5.5 · 23m 02s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F4 hallucinated-fact | · | (low confidence) Frontmatter states pre-auth and zero-click as fact. No source does: CERT-EU (https://cert.europa.eu/publications/security-advisories/2026-018/) says only 'CVSS scores of 9.2, which in | · | |
| F4 hallucinated-fact | · | (low confidence) Neither cited source states authentication or network vector for these two. CISA KEV for CVE-2020-3259: 'An attacker could retrieve memory contents on an affected device'; for CVE-202 | · | |
| F4 hallucinated-fact | · | (low confidence) Go's announcement (https://groups.google.com/g/golang-announce/c/66pojueaQek) says only 'We're blocking trust in a small set of intermediate certificates due to specific security conc | · | |
| F4 hallucinated-fact | · | (low confidence) Title and headline run the three victims and the post-access steps into one sequence. Symantec (https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets) reports t | · | |
| F3 claim-not-supported | · | (low confidence) Google, Mozilla and the tracker (all fetched) give no key value or '256'; only BleepingComputer, citing Mozilla's bug report ('had values smaller than 256, allowing anyone to recover | · | |
| F3 claim-not-supported | · | (low confidence) TeamUpdraft (https://teamupdraft.com/blog/security-incident-october-2026/): 'We believe our customer database was accessed. It holds: ... connection keys for UpdraftCentral, UpdraftVa | · | |
| F11 editorial-advisory | · | Advisory, residual: em dashes remain in the Metabase title (reader-facing, rendered with the entry this run republishes) and in older Metabase sections; the append-only PAN-OS record summary carries o | · | |
| F11 editorial-advisory | · | Advisory, residual (declined in iteration 3): the Publica page is still two source records. ConnectWise's source is the Trust Center advisories listing (the saved 2026-10-19 read shows the 19 October | · | |
| F11 editorial-advisory | · | Advisory: the sentence narrates the research step. The reader-relevant fact is that the Akira claim rests on the standfirst and key points of a paywalled article relayed by Inside IT; 'paywalled repor | · | |
| F11 editorial-advisory | · | Advisory: fifteen is VenariX's count as of 2026-08-17; the 2026-09-29 section already says the real total is higher (Shipup), and the 2026-10-21 section adds Republik, a confirmed victim outside that | · | |
| F11 editorial-advisory | · | Advisory: 'today' reads stale once the entry is re-read after the 21 October release (the next fire rewrites it). '(16:00 CEST)' is arithmetic the php.net page does not carry (Sansec's does); drop it | · | |
| F11 editorial-advisory | · | Advisory, low: a malware-specific export string sits close to the file-name and mutex indicator class the style rule bars; iteration 1 removed the loader and key file names for the same reason. The be | · |
Iteration #5 NEEDS_FIXES · 9 findings (truth=3, editorial=1, advisory=5) · Claude Sonnet 5.5 · 19m 14s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F4 hallucinated-fact | · | Supersession (4c h): the title and the main-analysis sentence assert fifteen as the confirmed total, unattributed, while the entry's own newest sections add confirmed victims outside VenariX's count ( | · | |
| F4 hallucinated-fact | · | (low confidence) state/cves_seen.json still carries the row {id: CVE-2026-111943, first_seen/last_seen 2026-10-21, primary_source_url golang-announce/66pojueaQek} at line 9308, so the run record's sta | · | |
| F3 claim-not-supported | · | (low confidence) Unit 42 (https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/) writes "We're also aware of public reporting attributing exploitation to threat actors using | · | |
| F8 needs-more-research | · | (low confidence) The fix for iteration 4 added the Cisco advisory (cisco-sa-asaftd-info-disclose, fixed-release table) and SonicWall SNWLID-2024-0015 (affected Gen5/6/7 builds and fixed builds) as sou | · | |
| F11 editorial-advisory | · | Frontmatter field names ('auth and vector fields of the CVE records') in a reader-facing sourcing_note (check 12), introduced by the iteration-4 remediation. Reword without field names, e.g. 'the entr | · | |
| F11 editorial-advisory | · | Reading-limit narration remains in the reader-facing sourcing_note after iteration 4's fix covered only the section and the source label; 'paywalled report relayed by Inside IT' carries the point. | · | |
| F11 editorial-advisory | · | (low confidence) event_date is defined as the primary-source publication date (docs/pipeline.md); the primary TeamUpdraft post and Patchstack are dated 2026-10-19, the sibling entries use the publicat | · | |
| F11 editorial-advisory | · | Standing advisory: em dash in reader-facing text of entries this run republishes; recorded as audit residual, may be left. | · | |
| F11 editorial-advisory | · | Standing advisory: the ConnectWise source is the advisories listing page (403 on extract, WebFetch and jina today; the saved 2026-10-19 read confirms the 19 October advisory at its top above 2025 advi | · |
Iteration #6 CLEAN · 6 findings (truth=0, editorial=0, advisory=6) · Claude Sonnet 5.5 · 24m 15s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F11 editorial-advisory | · | Advisory (low): the summary contract is 1 to 3 self-contained sentences (TL;DR bullet, RSS and notification text). This fire appended the Akira / ransom clause, the entry's newest and highest-stakes d | · | |
| F11 editorial-advisory | · | (low confidence) Advisory: at publication php.net lists no fix (the entry's own cves[].fixed says 'none published as of 2026-10-21' and the tag is no-patch), so 'are fixed in' reads as a past fact in | · | |
| F11 editorial-advisory | · | (low confidence) Advisory: the Cisco page the entry now cites carries a CVSS 3.0 base score of 7.5 for CVE-2020-3259 and the SonicWall page SNWLID-2024-0015 carries CVSS v3 9.3 (vector CVSS:3.0/AV:N/A | · | |
| F11 editorial-advisory | · | (low confidence) Advisory: Symantec's command line runs ssh.exe from C:\Windows\System32\OpenSSH with the identity file under ProgramData; no source says ssh.exe itself ran from a user or ProgramData | · | |
| F11 editorial-advisory | · | (low confidence) Advisory: the 15:32 UTC first-observed time is Patchstack's telemetry (the body cites it to Patchstack alone); Nethemba only relays it in an update and dates the attacks on its own si | · | |
| F11 editorial-advisory | · | Standing advisories, none introduced by this fire's additions (the additions carry no em dash and no workflow wording). The ConnectWise page answered 403 on extract, WebFetch and jina today and was ch | · |
Iteration #7 NEEDS_FIXES cap-breach · 7 findings (truth=1, editorial=1, advisory=5) · Claude Sonnet 5.5 · 20m 49s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F3 claim-not-supported | · | The 15:32 UTC start time is attributed to Patchstack alone while BleepingComputer gives the time. | · | |
| F9 surface-contradiction | · | The two vendors give different sweep windows and cadence and the entry did not say so. | · | |
| F11 editorial-advisory | · | The action asserted that distributions do not follow the php.net schedule. | · | |
| F11 editorial-advisory | · | Older text carries em dashes and a pipeline-narration phrase. | · | |
| F11 editorial-advisory | · | Living pages carry one dated source record. | · | |
| F11 editorial-advisory | · | event_date is the disclosure date, not the first installation. | · | |
| F11 editorial-advisory | · | Oracle is borderline notable; the advisory lists tools by name. | · |
Verification & coverage notes
The run record's narrative body, verbatim. This is where the run accounts for its own judgement calls: every borderline drop and judged-not-relevant item with its reason, dedup decisions, single-source items and their carve-outs, contradictions, and per-source coverage gaps, so nothing the run considered disappears silently.
Verification & coverage notesrun record body
2026-10-21T0256Z-intel · Sonnet 5.5 · window 26 h · 6 entries published
Verification & coverage notes
Window: gap 24.0 h from 2026-10-20T0256Z-intel, window 26 h, developing-story window 72 h. The container clock agreed with the network date (skew 0 s) and the first fetch of origin/main was current. A Wednesday window with three fresh disclosures that a defender works the same day (PHP's pre-announced critical release for 14:00 UTC, Oracle's October CPU, the SafePay joint advisory), one supplier-side compromise with active exploitation (TeamUpdraft) and two research items; six new entries and four changelog records.
KEV sweep (work/2026-10-21T0256Z-intel/kev-window.txt, catalogue 2026.10.20): six additions in the window. CVE-2026-110936 (Siemens Software Center) was COVERED. The five NOT COVERED rows are dispositioned: the four Plex Media Server flaws (CVE-2026-96652, -96654, -96655, -96656) and EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931) are borderline-drops below. No RANSOMWARE row.
Backlog (state/coverage_backlog.md): no open row, nothing carried or added.
Published: php-critical-release-pre-announced-cve-2026-109618-109619 (high, the release lands about 11 h after the fire; the next fire reads php.net and writes the update), oracle-october-2026-cpu-six-unauthenticated-cvss-10-rows (notable, no exploitation reported; the scheduled-release duty), aa26-293a-safepay-ransomware-edge-flaws-backup-nas-reset (notable), emudhra-intermediate-ca-keys-recoverable-trust-store-updates (notable, dated trust-store consequence on 2026-10-27), apt28-hookedge-backdoor-nato-police-shipbuilder-ssh-tunnel (notable, law-enforcement and government target class) and teamupdraft-updraftcentral-stolen-keys-backdoor-plugins (high, active exploitation of a vendor-held management key against WordPress estates). Updated: CVE-2026-0257 PAN-OS (update: Unit 42 names Qilin and Inc and reports the vCenter and ESXi pivot; S1 and S3 returned the same update and it is one record), PK Softech / Publica (update: Tamedia's Akira and ransom report, unconfirmed; the actor and ransom sentences of the main text moved, the dated earlier sections were left as history), ConnectWise Cloud Backup (improvement: Sophos X-Ops as a second observer of the sweep) and Metabase (update: a Swiss victim, Republik, found through its own statement as relayed by swissinfo.ch and Netzwoche).
borderline-drop lines:
- borderline-drop: Plex Media Server CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 (S1) - KEV-listed, Plex says actively and widely exploited with a public proof of concept since 2026-10-16 and fixes in 1.43.3.10861, but it is a consumer media server and no source shows a public-sector deployment; relevance to the constituency fails the gate and doubt resolves toward drop.
- borderline-drop: EG Secure Solutions SiteGuard Server Edition CVE-2026-106931 (S1) - KEV-listed, vendor and JVN confirm exploitation, but a Japan-only host WAF with a local attack vector and no constituency exposure.
- borderline-drop: Chrome 156.0.8078.47 (S1) - 353 fixes including six Critical, no exploitation statement; the regular browser cycle.
- borderline-drop: Apache Tomcat 11.0.27, 10.1.61, 9.0.123 JNDIRealm SASL fail-open bypass and the HTTP/2 and AJP mix-ups (S1) - not exploited, configuration-dependent reach.
- borderline-drop: Eptura Archibus CVE-2026-107186, -107187, -107188 (S1) - already dropped by the previous fire; Rapid7's own red-team chain only, normally internal.
- borderline-drop: Unblu Spark CVE-2026-9589 and CVE-2026-14933 (S1) - need authentication or an agent joining the attacker's session, cloud already fixed, no exploitation.
- borderline-drop: Windows Active Directory Domain Services CVE-2026-70229 (S1) - high attack complexity, rated Exploitation More Likely but not exploited; the Patch Tuesday cycle, and S1's reading of the October CVRF found Windows Shell CVE-2026-96951, already covered, as the only exploited CVE.
- borderline-drop: Fortinet FortiSIEM CVE-2026-106173 (9.4, unauthenticated) and FortiSandbox CVE-2026-107656 (9.6) from the 2026-10-13 bundle (S1) - Fortinet states neither is exploited, both are outside the window, and the monthly cycle covers them; S1 offered a catch-up entry and the gate says no.
- borderline-drop: SAP 2026-10-13 Patch Day, Siemens and Schneider October bundles and the CISA ICS advisories of 2026-10-20 (S1) - nothing at CVSS 9.0 or above that is pre-auth and exploited; Roundcube 1.7.5 and 1.6.20, Laravel, Mattermost, Juniper SSR, Duplicator and the older Linux kernel chains dropped as out of window or out of scope.
- borderline-drop: JPCERT/CC and Macnica on app-to-backend API attacks with AI-assisted scanning (S3) - Japanese wave built on basic access-control and configuration weaknesses with no Swiss case and nothing a defender does differently tomorrow.
- borderline-drop: NorForge's open Cairn control panels (S3) - builds on the Gambit entry already in the store, victims in the US, Japan and Australia, no new defender lever.
- borderline-drop: Sophos X-Ops Entra intrusion through vishing and SMS-code password reset (S3) - published 2026-10-19, one customer case of a well-known pattern; the ConnectWise entry already carries the tenant-review lever.
- borderline-drop: Hunt.io Graylog Log4Shell chain and GreyNoise's skynox7 proxyjacking (S3) - no constituency nexus.
- borderline-drop: Zeabur second breach, Bullhorn outage, Canva and Canny, IDC Frontier's sixth report (S4) - no Swiss nexus, no actor or exfiltration finding yet, or recovery status only.
- borderline-drop: DD-Automation (Aesch BL), SafePay leak with an "Armasuisse" folder (S4) - single paywalled Inside IT report from 2026-10-16, no victim statement, the Army says the folder holds nothing critical, and nothing to hunt; the Armed Forces supplier nexus is why the next fire re-checks it, and a victim statement or a second source makes it publishable.
- borderline-drop: Skyguide radar-picture outage of 2026-10-20 (Skyguide: no sign of a cyberattack), BACS week 42 TWINT and hotel-booking phishing (consumer targeting), Swiss Government Cloud tender (procurement, no obligation change) (S2).
Single-source and carve-outs: the Oracle entry rests on the vendor's own advisory (reliability A); AA26-293A is single-source-national-cert; the APT28 entry's new victims and tradecraft rest on Symantec alone, with Recorded Future independent on the backdoor; the Akira and ransom claim on the Publica entry rests on Tamedia's paywalled article (standfirst and key points read) relayed by Inside IT and is unconfirmed by the Confederation and Publica; Republik's account rests on swissinfo.ch and Netzwoche, its own page was not read. Contradictions carried in the entries: PHP's affected range (CERT-EU "PHP 5 onwards", Sansec "5.4 or later", both unconfirmed) and the two PHP CVE ids absent from CVE.org and EUVD at 03:38 UTC; which UpdraftPlus release removes which keys (TeamUpdraft's statement against Nethemba's code reading); Google's eight subordinate CAs against six TLS intermediates; Unit 42's text dating the KEV listing of CVE-2026-0257 to 13 May against the catalogue's 2026-05-29, which the entry keeps.
Verification: seven independent passes. Iteration 6 returned CLEAN; the confirmation pass (7) returned NEEDS_FIXES with one low-confidence truth finding (a start-time attribution on the TeamUpdraft entry), one low-confidence editorial contradiction (Huntress and Sophos sweep timings on the ConnectWise entry) and no F1 or F4 finding. Under the early-exit rule the fixes were applied and the run published without an eighth pass; the two residuals are the declined standing items (older em dashes and workflow wording in append-only text, living-page source records) that the audit sweeps.
Coverage: all 21 essential sources were attempted and every slice record was attempted (S1 26, S2 19, S3 14, S4 12; the previous two fires' attempts excluded 116 sources from the rotational ranking, and 12 were topped back up in S4's domain where the exclusion would have emptied the slice). Entities added: five, plus seven product records from sync_products.py. Promoted: forescout-research. New candidates: nethemba, jpcert-eyes, bs-ch-medienmitteilungen. Self-edit: tools/source_health.py now lists connectwise-trust-center as a documented unreachable host (the previous fire set the record to blocked but the tool still flagged it needs-demote); the health sweep ends with no unsolved record. ivanti-advisory-hub in the rotation gap list is a state id with no record in sources.json; the real record ivanti-psirt was read.
Next-fire watch: php.net release at 2026-10-21 14:00 UTC (CVE ids, fixed versions, whether the leaked tool appears; an update on the PHP entry), Cisco PSIRT publications of 2026-10-21 (Expressway, IOS XR, Secure Client, Snort, Unified Communications), CERT-FR's avis on the Oracle CPU, the DD-Automation re-check. For the audit: the ENISA Threat Landscape 2026 (news item of 2026-09-22) and Microsoft's Digital Defense Report 2026 (secondary coverage of 2026-10-14) have no store entry; three September Swiss public-sector incidents from the Vaud SOC digest have none either (CHUV through an external laboratory, 2026-09-08; a Basel-Stadt school print system, 2026-09-04; SRG SSR, 2026-09-28); the vaud-soc-cyber-threat-review recipe note was corrected (the October edition is due about mid-November).
Coverage gaps: apa-ots (no listing or feed route), swisscybersecurity-net (feed 404), news-admin-ch (only the 12 newest cards reachable), tagesanzeiger.ch (paywalled body, standfirst read), ncc-research (listing carries no dates), technadu (extract served by the metered reader, boilerplate only), rapid7-research (feed malformed, listing read through url).
← Operations dashboard · run-record contract: docs/pipeline.md