2026-10-22T0256Z-intel

Verification & coverage notes

Window: gap 24.0 h from 2026-10-21T0256Z-intel, window 26 h, developing-story window 72 h. The container clock agreed with the network date (skew 0 s) and the first fetch of origin/main was current. A Thursday-morning fire dominated by one story: the PHP release that the previous fire had published at 11 h before it landed as "no fix yet" shipped at about 13:30 UTC on 2026-10-21, with technical advisories, attack traffic from three telemetry owners, and Swiss cantons, universities, a fire-brigade platform and Publica taking sites offline. The rest of the window is one vendor bulletin that matters (GitLab), a no-fix vendor advisory that follows from PHP (PAN-OS), Cisco's scheduled run, a supply-chain compromise (LiteLLM), two threat-research items on identity and edge-device tradecraft, and three root-cause or scope developments on covered incidents.

KEV sweep (work/2026-10-22T0256Z-intel/kev-window.txt, catalogue 2026.10.21): no KEV addition inside the window; S1 read the catalogue twice and confirmed it, and nothing carried a RANSOMWARE row. Neither PHP CVE is KEV-listed; CVE-2025-64446, CVE-2019-6693 and CVE-2026-0257 are, which the k0t entry cites.

Backlog (state/coverage_backlog.md): no open row, nothing carried or added.

Published (6 new): pan-os-panorama-php2shell-mgmt-interface-no-fixed-release (notable: no fixed release on any train, a firewall management plane, Palo Alto scores the PAN-OS impact as availability only and knows of no exploitation against its products, no action item because the management-interface restriction already stands on the CVE-2026-0322 entry; declares the PHP entry and the two earlier PAN-OS entries in references[]), cve-2026-110264-gitlab-org-mode-renderer-unauth-rce (notable: unauthenticated CVSS 10.0 path to code execution on self-managed GitLab, clears PD-11(b) through its own mechanics, GitLab ships detections and its pages state neither exploitation nor a public proof of concept), cve-2026-76466-cisco-expressway-cluster-unauth-root-rce (notable: the scheduled-release row of Cisco's 2026-10-21 run, with the Unified CM family and Snort 3 hardening releases that reach the 9.0 bar, none reported exploited), litellm-1-107-0-pypi-docker-credential-stealer-lookalike (notable: S1 and S3 returned it, merged), artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse (notable: Microsoft's attribution plus Expel's Okta self-registration observation; CrowdStrike and Recorded Future corroborate other users of the tool) and k0t-fortiweb-fortigate-globalprotect-edge-device-campaign (notable: single vendor source, declares the CVE-2026-0257 and FortiBleed entries in references[]). Updated (4): the PHP entry (moved to critical: unauthenticated runtime RCE, fixed builds out, attack traffic observed by Cloudflare, watchTowr and VulnCheck, public proofs of concept circulating, authorities telling operators to patch today; nothing confirmed as compromised and neither CVE KEV-listed, so exploitation is written as attempts), the ConnectWise entry (Microsoft's Storm-0940 attribution, the 2,250-tenant attempt count and the restoration start), the OVHcloud CLI entry (root cause, payload and exfiltration from OVHcloud's postmortem) and the Publica entry (the assumed scope of practically all federal and federally affiliated staff, one chain of reporting).

Deep dive: none. PHP2Shell already has its entry and the exploitation evidence is attempts only; no other candidate clears the bar.

borderline-drop lines:

• borderline-drop: Fortinet FortiSIEM CVE-2026-106173 (9.4, unauthenticated, public Horizon3 proof of concept) (S1) - only 7.5.0 is affected, the gRPC port is normally an internal management plane and no source reports exploitation; reopen on an exploitation report. S1 offered it as borderline.
• borderline-drop: CrowdStrike's four agentic-AI actors (S3) - gated report, vendor summary only, no detection specifics and no Swiss victim; the ARTEX entry carries the transferable lesson.
• borderline-drop: Symantec's Skynet LLMjacking agent (S3) - hijacks exposed LLM endpoints and AI gateways, no constituency exposure.
• borderline-drop: Tor exit-relay SSH interception with Ebury 1.8.3 (S3) - SSH over Tor is not a constituency practice.
• borderline-drop: Cisco Talos trusted-platform message abuse, Huntress finger.exe ClickFix and Abnormal AI Athena StealthRoute (S3) - delivery and phishing-as-a-service variants with no new detection decision.
• borderline-drop: NorForge exposed Cairn panels, Pillar Security opencode flaw patched without a CVE, and two Wiz CIRT posts (S3) - lookback items below the bar; the Wiz feed is added to the next rotation.
• borderline-drop: EFK audit of federal Microsoft 365 (S2) - oversight findings with no patch, hunt, block or detect decision; the audit report is accepted by the BIT and binds no other body.
• borderline-drop: CERT-FR CTI-008 report on web-application data breaches (S2) - statistics and generic principles, dated 2026-10-20.
• borderline-drop: BACS week-42 review (TWINT relay phishing) and the Swiss Government Cloud tender (S2) - consumer fraud and procurement.
• borderline-drop: Zeabur and Railway environment-variable breaches, Onamae.com Desktop Cloud, UK ICO reprimands of Ogi Networks and Data Cymru, Kreisverwaltung Oberspreewald-Lausitz (S4) - no constituency nexus, a two-year-old incident, or a precautionary shutdown with no attack confirmed (incident floor).
• borderline-drop: Plex and SiteGuard KEV rows, Chrome 156, the Mozilla dot releases, Laravel, Roundcube, the WordPress plugin batch, MikroTik token replay, Splunk, Apache Traffic Server and Pulsar, the lesser Cisco advisories, the rest of the Fortinet October batch and the ICS advisories (S1) - already dropped by the previous fire, routine, out of window, authenticated, or without constituency exposure. The October Patch Tuesday CVRF still shows Windows Shell CVE-2026-96951 as the only exploited flaw.

Single-source and carve-outs: the PAN-OS, GitLab and Cisco entries rest on the vendors' own advisories (reliability A, single-source); the k0t entry rests on Group-IB with NyxLab alone (B2), with the three CVEs independently KEV-listed; the Storm-0940 attribution is Microsoft's alone and Expel relays it; the Publica scope claim rests on Tamedia's paywalled article relayed by Netzwoche (the ICTjournal copy returned an empty body and is not cited). Contradictions: EPFL's site displayed a not-reachable notice while nau.ch says it still worked, and RTS lists it as suspended; the PHP entry reports both.

Verification: eight iterations of the single cold verifier, none CLEAN. Iteration 1 returned 24 findings (truth 5, editorial 10, advisory 9), among them a real error on LiteLLM: the build authorisation was in the maintainers' own status updates, which the run had not read. Each later pass checked the previous fixes first and then walked the ledger. Truth plus editorial counts ran 15, 8, 6, 6, 3, 3, 4 and 5; the later findings were mostly low-confidence one-clause attribution items, a few caused by an earlier fix (the PHP CVE-mapping sentence, a stray parenthesis) and two by cited pages that changed after the run read them (VulnCheck's weaponized exploit that succeeds with ASLR enabled, ConnectWise's archived advisory updates), both now in the entries. Iteration 8 was the cap, so the run publishes fail-open. The five iteration-8 truth findings were fixed by the main agent afterwards (the ConnectWise indicator date, the Lodur description, the Meraki qualifier, 'at least one' web-shell attempt, the run-record GitLab sentence) and are not re-verified, which is why the residual count is 5, not 0. Declined across passes: the OVHcloud staging-folder and extension names, the PHP exploited status, the watchTowr date label and the PAN-OS reference to the CVE-2026-0257 entry. For the audit: the CVE-2026-97229 GitLab entry still says to upgrade to 19.4.2, 19.3.5 or 19.2.8 now, which the CVE-2026-110264 entry says stay affected; the ConnectWise Trust Center is walled live and its 2026-10-21 updates were read from an archived copy through the metered jina reader; and the PHP entry's VulnCheck exploit wording deserves an independent read.

Source health (tools/source_health.py, 259 probed): nine fresh flags, four cleared in this run. efk-ch and bs-ch-medienmitteilungen got content_scope: general-news (general press and audit listings, mostly non-security by design), cyberattaque-org read again minutes after the sweep (transient), and fox-it-blog is demoted with one reliability-tier drop because blog.fox-it.com now serves a coming-soon placeholder with no posts (the publisher is covered by ncc-research). Five flags are origin-side outages no recipe can repair and stay in rotation with a note: cnil-fr (503 maintenance page), dcod-ch (503), zimbra-security-advisories (502), ec-digital-strategy-newsroom (403 on every transport, which never demotes) and lab52 (TLS reset).

Coverage: all 21 essential sources were attempted and every slice record was attempted (S1 18, S2 27, S3 14, S4 10 plus ransomware-live, databreaches-net and sec-disclosures-edgar). The previous two fires' attempts excluded 10 sources from the rotational ranking, and S4's slice was topped back up with all 10 recently attempted records because the exclusion would have emptied it. Entities added: four, plus two product records from sync_products.py. Promoted: swissinfo-ger. New candidates: php-net-news (first-party PHP security announcements), efk-ch (federal audit reports) and nau-ch (fast Swiss relay of cantonal communiqués); the sub-agents also proposed thephp-foundation-blog, watchtowr-intelligence, tio-ch, norforge, pillar-security-blog, safedep-blog and abnormal-ai-threat-intel, which are left for the audit's source pass. The extract transport fell to the metered reader for Wordfence, ICTjournal, Dark Reading and the CNIL maintenance page; the notes on those records say so.

Next-fire watch: Basel-Stadt's promised status update of 2026-10-22 and any compromise report from a PHP-running public body, PAN-OS fixed releases and a KEV listing for either PHP CVE, whether the Confederation, Publica or the Federal Prosecutor confirms the actor or the scope for PK Softech, Basel-Stadt and other cantonal restoration, ConnectWise's restoration instructions, the LiteLLM maintainers' next incident updates and the vulnerability they scheduled for disclosure on 2026-10-27 (a changelog record on the LiteLLM entry when it lands). For the audit: trendmicro-research recipe check (feed stale since 2026-09-25) and including wiz-blog in the next rotation.

Coverage gaps: zimbra-security-advisories (HTTP 502 on every transport), dcod-ch (HTTP 503 on feed and homepage), cnil-fr (503 maintenance page), connectwise-trust-center (403 on every transport), prodaft (no dated listing), news-admin-ch (only the 12 newest cards reachable), tagesanzeiger.ch (paywalled body, lead read), trendmicro-research (feed stale, no in-window post confirmable), citizen-lab (feed lags, listing used).