2026-10-24T0255Z-intel

Verification & coverage notes

Window: gap 24.0 h from 2026-10-23T0256Z-intel, window 26 h, developing-story window 72 h. The container clock agreed with the network date (skew 0 s) and the first fetch of origin/main was current. A Saturday-morning fire in the fourth day of the PHP2Shell story: the new signal is a first vendor-reported intrusion through it, a third PHP code-execution path, one new runtime flaw (Node2Shell) and several second-day corrections to entries the store already carries. The 26 h window held no new critical.

Container restart: at about 03:27Z the container was restarted while S1 was finalising; S1's findings file was already complete on disk (nine items, a 28-row source ledger, ended_at still PENDING in its header) and was taken as S1's return, with S1.ended_at written from the file's last write time (03:26:46Z). No continuation was needed because the ledger answers every slice record. S2, S3 and S4 returned normally. One reading note: the WebFetch summary of Socket's page reported that its share links carry a prefilled prompt asking an assistant to remember the domain; it was ignored.

KEV sweep (work/2026-10-24T0255Z-intel/kev-window.txt, catalogue 2026.10.23): two additions inside the window, CVE-2026-110447 (Collabora CODE server) and CVE-2026-114625 (Arista VeloCloud Orchestrator), both COVERED and already exploited in their entries; no RANSOMWARE row. Neither PHP2Shell CVE and not CVE-2026-115560 is KEV-listed.

Backlog (state/coverage_backlog.md): no row was open at the start. One row added and held: ARX Group SA, a leak-site claim against a Swiss engineering consultancy for federal infrastructure projects, held to 2026-11-07 on a named condition (ARX, a federal client or Swiss press confirms), because PD-6 bars publishing a leak-site claim alone.

Published (1 new): cve-2026-111497-node2shell-brotli-decoder-rce-nodejs-pypi (notable, vulnerability; multi-source: the Node.js project and Google Brotli release with Imperva's independent exploit validation, OpenSourceMalware for the PyPI packages and ENISA's record for the CVSS; it clears PD-11(b) on its own mechanics: unauthenticated code execution through a decoder reached by two ordinary Node.js request and response paths, a public independent demonstration and a patch that ships no CVE for the Python packages; not exploited, so not high).

Updated (9, through the changelog): six update records and three improvement records, none a second entry. update: the PHP2Shell entry (Unit 42's confirmed-intrusion claim set against CrowdStrike, Sophos, Wordfence and SANS ISC, the new informational advisory CVE-2026-115560, vendor status moves; one new action; priority stays critical), the PAN-OS entry (WF-500 now unaffected after a correction the advisory timeline dates 2026-10-23, and the table no longer distinguishes Panorama; 2026-10-24 added threat-signature details), the LiteLLM entry (the maintainers' root-cause post replaces the earlier log-leak hypothesis; Socket's independent reconstruction), the Publica/PK Softech entry (the Ticino fund IPCT's letter of 2026-10-23: about 1,800 persons, data fields, no certain evidence of theft), the TeamUpdraft entry (vendor-stated entry vector, attacker activity after 1.26.13, account password stored by UpdraftPlus Premium) and the GitLab CVE-2026-110264 entry (Ruby's upstream fix versions and the exposure of other Ruby applications). improvement: FortiSIEM CVE-2026-106173 (Horizon3's public proof of concept of 2026-10-20 was missing), Zimbra CVE-2026-73570 (Elastic's reproduction: failed public proofs of concept do not show a patched host; process-lineage detection) and ARTEX (Wiz's independent telemetry and log signatures). Entity registry: tool:node2shell registered by hand and five product entities synced (product:node-js, product:google-brotli, product:python-brotli-pypi, product:brotlicffi-pypi, product:ruby).

Corrections inside the updates worth the operator's eye: the LiteLLM entry carried the maintainers' superseded hypothesis, which its own source now calls inaccurate, and the old evidence quote was replaced; the Node2Shell entry states that OpenSourceMalware's "no advisory database lists the PyPI packages" is superseded by two PYSEC advisories in ENISA's record dated 2026-10-23, so dependency scanners keyed on those identifiers can flag them.

Borderline drops: borderline-drop: Linux ksmbd ZDI-CAN-33774 and ZDI-CAN-33549 — two CVSS 9.0 reports posted to a public kernel list with no mainline fix and no CVE; a niche module, no exploitation, revisit when the CVEs or fixes land; borderline-drop: Pillow 13.0.0 EPS filename argument injection CVE-2026-112900 and siblings — library-cycle fixes, conditional on Ghostscript and attacker-controlled filenames, no exploitation; borderline-drop: Splunk Enterprise CVE-2026-76268 — the advisory of 2026-10-07 is outside the window and Horizon3's write-up of 2026-10-22 fell inside the previous fire's window, where nothing covered it; dropped deliberately on the merits: the Patroni REST API is reachable from the cluster network, no exploitation is reported, the proof of concept is an unverified repository claim and the upgrade (10.4.3, 10.2.7) or the sidecar workaround sits in the regular cycle; reconsider if exploitation is reported; borderline-drop: Oracle E-Business Suite CVE-2026-101767 (Horizon3 write-up) — a row of the October CPU already covered by the CPU entry, not exploited, patch-cycle; borderline-drop: Aokigahara infostealer (Check Point, Symantec) — no delivery vector and no constituency nexus; AI-tool credential theft is an incremental infostealer feature; borderline-drop: SOCRadar INC and The Gentlemen AI workbench — one vendor's reading of attacker-held records with unverified counts, techniques and CVEs already covered by other entries; borderline-drop: Railway platform compromise — no constituency nexus found, the transferable lesson (secrets held in platform variables, AI-key hunting) is carried by the LiteLLM entry; borderline-drop: Caisse des Dépôts PEP's and Ircantec — public-employer portal accounts taken over by social engineering, but no mechanism, no data scope and a contested seller claim (incident floor); borderline-drop: Medienwerkstatt Sulgen TG and Landkreis Oberspreewald-Lausitz — private firm with business-contact data only; a precautionary county shutdown with no confirmed attack (incident floor); borderline-drop: ConnectWise Cloud Backup restoration timetable — no change to what a partner does (connections stay disabled until instructed); borderline-drop: eMudhra leaves the TLS business — the open item is a certificate replacement the entry already asks for. S1 also dropped, with reasons in its findings file, the PaperCut September bulletin rows, the October Patch Tuesday QUIC and OpenSSH for Windows rows, CGM CLININET, rsyslog dynaFile, EDK2 PXE, Laravel TokenGuard, the Atlassian October bulletin, the Zimbra and Okta Access Gateway authenticated chains and Wasmtime; S2 dropped the EFK Microsoft 365 audit (third sighting), the St. Gallen SKIPD strategy, BIT cloud capacity and the BACS consumer material.

Single-source items and carve-outs: the PAN-OS, GitLab and FortiSIEM-sandbox statements rest on first-party vendor pages for their own products; the IPCT figures are the fund's own letter, relayed by Ticinonline; the ARTEX and Zimbra additions are single research sources (Wiz, Elastic) that say what they saw in their own telemetry or lab; Unit 42's confirmed-intrusion claim is single-vendor and is reported as such beside four contrary assessments.

Coverage gaps: connectwise-trust-center (403 on every transport, fourth consecutive run; the status page supplied the restoration plan and is the working route), ec-digital-strategy-newsroom (403 everywhere; now a documented unreachable host in the health tool), databreaches-net (no cheap transport), ibm-support-security-bulletins (no listing transport), community.citrix.com (403, so the revision status of Citrix's PHP guidance could not be checked), lore.kernel.org (proof-of-work challenge) and the rapid7-research feed (error). Not reached by any sub-agent and left to the audit: SAP Security Patch Day of 2026-10-13, which no earlier fire covered either.

Candidate sources: four added (nodejs-security-releases, ruby-lang-news, imperva-threat-research, tio-ch-attacco-informatico); S1's note that PHP, Node.js and Ruby runtime advisories were found two days late through CERT relays supports reading the project security feeds of the main server runtimes every fire. rsi-info-ticino is proposed and not added until its listing is probed; trendmicro-research was moved to the TrendAI blog instead of adding a duplicate. Four sources promoted to active by the promotion rule (arista-security-advisories, hpe-networking-psirt, splunk-advisories, watchguard-psirt).

Source health: the sweep flagged four records, all resolved in this fire: ec-digital-strategy-newsroom added to the documented unreachable hosts in tools/source_health.py (13 of 13 tool tests pass), ssd-disclosure given a health_cmd for its dated posts API, dfirreport and venarix given a 120-day staleness limit for their publisher cadence. The second sweep ended with no unsolved record.

Self-identification: this fire's main agent is Sonnet 5.5 (claude-sonnet-5-5) per the harness model line; the four research sub-agents reported Sonnet 5.5 (claude-sonnet-5-5) in their own return headers.

Verification loop: three cti-verification passes, all NEEDS_FIXES, with truth plus editorial counts of 12, 5 and 2, and every claim in each pass's scope answered against the ledger (306, 315 and 253 claims). Iteration 1 found a mis-assigned footnote on Cisco's Duo and URWB rows, the Panorama and WF-500 table wording and dating on the Palo Alto advisory (its timeline dates the WF-500 correction to 2026-10-23, not 2026-10-24), a fourth Threat Prevention condition, a tense error on the IPCT letter, a Fortinet citation that did not carry the not-exploited clause, Nethemba's blocking plugin as a second blocker, an unhedged Publica sentence, Unit 42's missing foothold qualifier and a missing Exposure line on the Publica entry; all were fixed. Iteration 2 found the Panorama fix incomplete (the advisory's mitigation text names Panorama), a Patchstack time zone, a stale run-record sentence and two missing citations; all were fixed. Iteration 3 found two low-confidence wording defects (TeamUpdraft's key-cutoff sentence after the vendor's own page changed, and a Fortinet clause that attributed cron to a second file) and two advisories; it exited under the low-residual rule (truth plus editorial of 2, no F1 or F4), and all four were fixed after the pass without a further independent read, so verification_residual_count records the final pass's 2. Declined advisories: the Fortinet record type (improvement stays, the proof of concept predates the entry) and the Publica entry's length (consolidation is the audit's job). The Splunk CVE-2026-76268 drop was logged as a deliberate drop after the first pass flagged it as a missed angle; passes 2 and 3 found no missed angle.

Publish note for the audit: the Publica/PK Softech entry now carries eleven changelog sections and about 71 KB; the verifier suggests consolidating its per-fund statements and splitting its first action.