2026-10-23T0256Z-intel

Verification & coverage notes

Window: gap 24.0 h from 2026-10-22T0256Z-intel, window 26 h, developing-story window 72 h. The container clock agreed with the network date (skew 0 s) and the first fetch of origin/main was current. A Friday-morning fire in the second day of the PHP2Shell story: the new signal is downstream (vendor impact statements, the Swiss and UK public-sector picture, diverging exploitability assessments), a vendor-confirmed exploited SD-WAN controller flaw, two out-of-cycle vendor releases (HPE Aruba, Fortinet), and three identity, boot-chain and C2 tradecraft reports.

KEV sweep (work/2026-10-23T0256Z-intel/kev-window.txt, catalogue 2026.10.21): no KEV addition inside the window, nothing NOT COVERED, no RANSOMWARE row; S1 read the live catalogue three times and confirmed it. Neither PHP CVE and not CVE-2026-114625 is KEV-listed.

Backlog (state/coverage_backlog.md): no open row, nothing carried or added; the Beyond Gravity row stays struck because S2 found nothing newer than 2026-10-15.

Published (8 new): cve-2026-114625-arista-velocloud-orchestrator-sqli-exploited (high: vendor-confirmed exploitation, any tenant login, no KEV listing; Arista is first-party and the only source, hence single-source; the two earlier VeloCloud entries are declared in references[]), hpesbnw05162-hpe-aruba-aos-8-aos-10-72-cves-19-unauth (notable: 19 unauthenticated network rows at 9.0 or above in one bulletin, HPE knows of no exploitation or public code; clears PD-11(b) through the number of unauthenticated rows on a management plane and campus wireless estates, a one-clause judgement), netscaler-php2shell-management-gui-fixes-2026-10-27 (notable: own entry because the product, the surfaces and the fix date are NetScaler's; declares the PHP entry and the PAN-OS entry in references[]; lookback item, source dated 2026-10-21 20:23 UTC), fortinet-hardening-release-fortios-fortimanager-fortimail (high: out-of-cycle critical and high fixes the vendor urges at once, advisories withheld to 2026-11-10, exploitation unknown; techniques[] carries T1190 on the vendor's statement that internet-facing devices come first and the interim measure restricts administrative interfaces, no CVE ids exist yet), fortinet-fortisandbox-fortisiem-pre-auth-critical-fixes (notable: first coverage of the Fortinet PSIRT bundle of 2026-10-13, found through the verifier's coverage pass, two unauthenticated critical rows, FortiSandbox GUI authentication bypass at 9.6 and FortiSIEM 7.5.0 path traversal to code execution at 9.4, neither listed as exploited; the FortiSandbox ranges include the builds that fixed the three flaws reported exploited in June, which is the non-obvious defender hook; references the June FortiSandbox entry and the hardening entry), m365-token-spray-replay-rogue-entra-devices-mfa-wipe (notable: Huntress only, behaviour-rich identity tradecraft against the Microsoft 365 estate the constituency runs), blackx-uefi-bootkit-baton-drop-revocation-default-off (notable: a state-actor bootkit whose enabling condition is a default-off Microsoft control; actions[] empty because the revocation is a fleet programme, not a do-now task; references the FishMonger and UEFI-shim entries because CVE-2023-24932 appears in the store) and mythicratatoskr-yggdrasil-mesh-c2-uac-0099-sandworm-wiper (notable: Ukrainian victim of 2025, kept for the mesh-C2 detection hook and the access-handoff-to-wiper pattern; ground (d)). Updated (4, all type: update): the PK Softech entry (the supplier's January deletion pledge apparently not kept, a second-hand report that the Federal Prosecutor's Office confirmed Akira, the Ticino fund IPCT), the PHP2Shell entry (BACS: no known Swiss attack but federal PHP applications affected, the UK Lords figures, AWS's 2026-10-17 first attempt as relayed, Sansec's and Red Hat's cautious exploitability assessments against VulnCheck's exploit, vendor impact statements; priority left at critical because attack traffic is observed, authorities order the update and VulnCheck holds a working exploit, with no compromise confirmed), the eMudhra entry (Java: Oracle alert and OpenJDK advisory for CVE-2026-91403, NCSC.ch 13091) and the PAN-OS entry (the advisory's 2026-10-23 hotfix estimates for PAN-OS 12.2 to 10.2, WildFire WF-500 and WF-500-B and Panorama still undated). PHP2Shell on Cisco Expressway stays a one-clause statement on the PHP entry: it is a different finding from the CVE-2026-76466 entry, so no changelog record was written there.

Borderline drops: borderline-drop: YOOtheme Pro 5 image handler CVE-2026-102785 — unauthenticated CVSS 4.0 10.0 but no exploitation reported and no constituency deployment shown; a vendor-ordered immediate update and a package-diff write-up do not clear PD-11 (written, then cut at verification iteration 1); borderline-drop: Splunk October bundle SVD-2026-1007 to 1013 — scheduled bundle, grouped hardening rows with no stated prerequisites, no exploitation, regular patch cycle; borderline-drop: ISC BIND CVE-2026-94300 and two DoS flaws — CVSS 8.1 with high complexity, needs a captured signed GSS-TSIG message, no exploit known; borderline-drop: Roundcube 1.6.20 and 1.7.5 — about twenty fixes, authenticated paths, no exploitation statement; borderline-drop: Chrome 156 and the Edge Chromium batch — no exploitation reported, routine browser cycle; borderline-drop: MikroTik CVE-2026-89035 — unreviewed CVE record plus a BSI marker, no vendor advisory, so a no-fix claim cannot be cited to the vendor; borderline-drop: Siemens October Patch Day via CISA ICSA-26-295 — no exploitation, no constituency deployment shown; borderline-drop: EFK audit of the federal Microsoft 365 tenant — oversight audit, no near-term defender decision; borderline-drop: Swiss Government Cloud tender — procurement, non-security; borderline-drop: Beyond Gravity — no development since 2026-10-15, the struck row's re-open condition is unmet; borderline-drop: Ebury 1.8.3 on 333 Tor exit relays — no constituency nexus (relay operators and hosters); borderline-drop: CVE-2026-99999 PwnEscape (Linux KVM guest-to-host) — needs an attacker-controlled guest, no exploitation, no workaround, regular kernel cycle; borderline-drop: DeadTag expired-tag domains — vendor-driven research, no government nexus, the exploit-kit leg was dropped by earlier fires; borderline-drop: Rapid7 Q3 2026 quarterly report — statistics without a defender takeaway; borderline-drop: Hunt Intelligence Graylog and X-Road activity in Ukraine — Ukraine-only victims, Log4Shell public-PoC chain; borderline-drop: P3 and Navigate360 anonymous-tip breach — no Swiss customer shown, out of nexus; borderline-drop: Railway environment-variable exposure — no vector or actor yet and no Swiss nexus, preliminary report due 2026-10-23 midday ET, a later fire re-gates it; borderline-drop: NEC sub-contractor credential abuse (Japan) — out of nexus, lookback item; borderline-drop: Capcom, Onamae Desktop Cloud, the AfD mail leak and the US, Australian and Japanese incidents S4 listed — out of nexus, no transferable technique; borderline-drop: Ircantec forum-sale claim and Medienwerkstatt (Akira claim, mis-tagged DE) — claims without victim confirmation, PD-6; worth a re-check next fire. out-of-window: Sophos IR vishing plus SSPR abuse with a Primary Refresh Token session — primary dated 2026-10-19, window_hours=26, not a rotational-lookback item; the audit may want it, as it may Talos "Parasitizing trust" (2026-10-21, trend piece, dropped for recency and novelty).

Single-source items and carve-outs: the Arista, HPE, NetScaler and two Fortinet entries are first-party vendor advisories for their own products (NCSC.ch and heise restate Fortinet and add no independent assessment); Huntress, Kaspersky (the campaign and attribution, with Microsoft's KB independently confirming the default-off revocation) and ESET are single research sources; the Arista exploitation statement has no independent corroboration yet. Contradictions and unconfirmed claims reported, not resolved: Inside IT relays Tamedia that the Federal Prosecutor's Office confirmed Akira exfiltrated the data, Publica's own page of 2026-10-20 still says it is clarifying, and no prosecutor text was found; Sansec and Red Hat judge PHP2Shell exploitation harder than VulnCheck's weaponized exploit shows; Huntress gives 303 successes in 29 organizations and later 232 in 28 for one address, so no count from that passage is used.

Coverage gaps: connectwise-trust-center (403 on every transport including WebFetch and the reader, third consecutive run; ConnectWise coverage rests on search and the CCCS feed). Outside this window and with no store entry, for the audit's re-sweep: SAP Security Patch Day 2026-10-13 and the two non-exploited publicly disclosed October Microsoft zero-days. The Fortinet PSIRT bundle of 2026-10-13 (FortiSandbox, FortiSIEM) was first covered by this run after the verifier flagged it. Tages-Anzeiger has no full-text transport (lede and bullets only), so the Tamedia reporting rests on relays. The jina reader pool had three of four keys at HTTP 402 (operational note only). sources.promotion_due was acted on: expel, php-net-news and ssd-disclosure moved to active.

Candidate sources: one added, arista-security-advisories (the PSIRT behind three exploited VeloCloud Orchestrator advisories this year; extract plus the CSAF route). Suggested and not added under the one-per-run guide: isc-bind-security-matrix, ukauthority, 20min-ch, tio-ch, pwn.ai, CBC News Investigates; novee-security and air-security are noted for demotion at the next audit.

Entity registry: four entities registered (campaign:m365-token-spray-replay-huntress-2026, malware:blackx-uefi-bootkit, actor:apt41, malware:mythicratatoskr; attributed-to, affects relations sourced to the entries that state them) and eight product entities synced. BlackLotus is named only as a comparison and stays unkeyed.

Self-identification: this fire's main agent is Sonnet 5.5 (claude-sonnet-5-5) per the harness model line; the four research sub-agents reported Sonnet 5.5 (claude-sonnet-5-5) in their own return headers.

Verification loop: five cti-verification passes, all NEEDS_FIXES, with truth plus editorial counts of 16, 9, 3, 3 and 1 and every claim of every pass walked against the ledger (303, 282, 222, 284 and 165 claims in scope, all answered). Iteration 1 found the stale PAN-OS state (the advisory gained hotfix estimates three minutes after the entry was written), a VulnCheck sentence the page had since reversed, two stale eMudhra statements, the FortiMail overlap with the exploited CVE-2026-104286 entry, a Frontaliere Ticino aggregator citation, the YOOtheme entry (dropped: no constituency nexus, no exploitation), a PHP2Shell update on the Cisco Expressway entry that did not belong to that finding (reverted, one clause stays on the PHP entry), and the Fortinet PSIRT bundle of 2026-10-13 (new entry). Iterations 2 to 4 removed overstatements the fixes themselves introduced or exposed (a location and a decryption condition no source states, an uncited workaround, an exploited status on CVE-2023-24932, undated present-tense statements, store-internal wording, an eMudhra Update section that repeated the main analysis, the HPE exploitation attribution). Iteration 5 left one low-confidence F3 (from unnamed sources, fixed after the pass and not re-verified) and one advisory (extra ATT&CK ids on the Mythic entry, one added). The loop ended by the early exit of the decision rules (truth plus editorial at most 2, no F1 or F4), so verification_residual_count is 1 and no CLEAN confirmation applies; entries_dropped_by_verification is 1 (YOOtheme). One advisory finding was declined with a rebuttal: the NetScaler entry keeps the name PHP2Shell, which Sansec, VulnCheck, watson.ch and The Register use for these flaws, while its own cited source (Citrix) says two PHP memory safety vulnerabilities.