2026-10-25T0256Z-intel

Verification & coverage notes

Window: gap 24.0 h from 2026-10-24T0255Z-intel, window 26 h, developing-story window 72 h. The container clock agreed with the network date (skew 0 s) and the first fetch of origin/main was current. A Sunday-morning fire after a Saturday with no new KEV listing and no Swiss item inside the window: the national-CERT and vendor-advisory feeds carried nothing new and relevant after 2026-10-23 apart from a Palo Alto revision, Cisco's eMudhra advisory revision and the EUVD rows behind the eMudhra update, all dated 2026-10-24 (the 46 Microsoft rows of that date were Linux-kernel and third-party library CVEs below the bar), so the new signal comes from a Saturday research publication (Sysdig), two lookback research posts (SpecterOps, and Blackfield, found through it) and developments in four covered findings.

KEV sweep (work/2026-10-25T0256Z-intel/kev-window.txt, catalogue 2026.10.23): no addition inside the window, so no NOT COVERED, MENTION-ONLY or COVERED-STALE row and no RANSOMWARE row; S1 re-read the live catalogue and found the same newest dateAdded (2026-10-23).

Backlog (state/coverage_backlog.md): one open row, ARX Group SA (Aurora leak-site claim against a Swiss engineering consultancy for federal infrastructure projects). S2 and S4 re-checked it on today's facts in German, French, Italian and English and on the trade feeds: the Ransomware.live record is unchanged since 2026-10-23 17:57 UTC and no statement from ARX (formerly Pini Group), SBB, ASTRA/USTRA, BACS or the Swiss press exists, so the hold condition is unmet; the row stays held to its expiry of 2026-11-07, with no new note appended because nothing changed.

Published (2 new): ntlm-relay-signing-bypass-reauthentication-ldap-smb (research, notable; two independent researcher write-ups, SpecterOps and Blackfield, with Microsoft's release notes only for the KB-to-release mapping; it clears PD-11(a) and (d): a primary technical analysis of a bypass of the mitigation every Windows estate relies on against NTLM relay, with public tooling and a patch-verification and compromise-check decision for domain controllers) and zdi-linux-kernel-reports-public-skb-zerocopy-root-exploit (vulnerability, notable; Sysdig's analysis with TuxCare's independent root reproduction; no CVE and no merged fix, a public local root exploit for a bypass of the Dirty Frag fix on the distributions TuxCare tested; clears PD-11(b) on its own mechanics: the exploit is public, the fix is unmerged and the interim mitigation is a decision for hosts that run untrusted code). The NTLM entry carries one actions[] task; the ZDI entry carries none, because its interim mitigations are body guidance (the Defender takeaway); priority: high was considered for the Linux entry and declined because the flaw is local-only and unexploited.

Updated (4, through the changelog, all type update): the eMudhra entry (Oracle's second alert CVE-2026-114820 lists the builds the incident tracker named as fixed for the first alert as affected, so a Java runtime updated on 2026-10-21 needs a second update; OpenJDK now says Debian, Devuan and Ubuntu packages need the keystore recreated by hand, which replaced the entry's earlier statement that updating the operating system's certificates suffices there; Python's ssl denylist CVE-2026-115557; Cisco's product list; main text, actions, CVE records and the earlier update section's tracker-build sentence were rewritten where they stood), the Danfoss and Copeland refrigeration entry (ANSSI's director general told the Senate on 2026-10-21 that elementary flaws were exploited, exposure plus weak passwords, which replaced the headline and summary statement that no source named how the attackers got in; Forescout's exposure counts and hacktivist context; one action reworded; mapping gained T1133 and T1078), the PK Softech and Publica entry (the federal data protection commissioner's formal investigation of 2026-10-22 and its statement that data of several funds was exfiltrated; the entry now carries twelve changelog records, eleven with a dated section because one earlier record is internal, see the audit note below) and the PHP2Shell entry (Tenable's patch for the PHP bundled in Security Center and Enclave Security, Siemens RUGGEDCOM APE1808 on PAN-OS affected with patch information only through support, and ReliaQuest's lab log sequence for detection; priority stays critical).

Borderline drops:

• borderline-drop: Juniper Junos OS and Junos OS Evolved October 2026 bundle (S1; nine unauthenticated or peer-reachable CVSS 9.8 rows: J-Web authentication bypasses, httpd and rpd overflows), the 2026-10-15 and 2026-10-16 fires already dropped it for the same reasons and nothing new exists: no exploitation reported, J-Web needs web management enabled, the BGP rows need a configured peer, the vendor bulletin is eleven days old and outside the window and the CCB lookback; S1 reported "no store coverage" without knowing of those drops.
• borderline-drop: Next.js out-of-band update (S1; two unauthenticated RCEs, one conditional on Cache Components use cache, one on SVG image optimisation), dropped by the 2026-10-17 and 2026-10-19 fires for the same reasons: no exploitation reported, conditional paths, vendor post of 2026-10-14; nothing new since.
• borderline-drop: EFK audit of Microsoft 365 in the federal administration (S2), an oversight finding with no patch, hunt, block or detect decision, accepted by the federal IT provider and binding no other body; the 2026-10-22 fire made the same call.
• borderline-drop: Swiss PHP2Shell exposure measurement from risikomonitor's tracker (S2), single commercial scanner, header-based counts that BACS says overstate where distributions backport the fix, daily totals not like for like; it adds scale but changes no decision on a critical entry that already says to update everything.
• borderline-drop: ConnectWise Cloud Backup restoration timetable from the vendor status page (S1 and S4), the covered entry's action already says to keep the applications disabled until ConnectWise instructs; the new facts (credential reset completed 2026-10-19, backup-restore access expected early in the week of 2026-10-26) change no tenant decision.
• borderline-drop: IDC Frontier sixth report of 2026-10-18 (S4), resumption of the backup service on a routine entry with no Swiss nexus and no decision change.
• borderline-drop: AdFection, the Australian Broadcasting Corporation's and ANSTO's statements (S4), no Swiss or constituency nexus, no new technique, impressions are not infections.
• borderline-drop: Medienwerkstatt (Sulgen TG, Mattenbach group) data copy with Akira's 130 GB claim (S4 and S2), private media-production SME, no access vector or behaviour in any source, the incident floor applies; Akira's Swiss listing pattern is already in the PK Softech entry.
• borderline-drop: Alliance Police Nationale union letter (S4), no scope, no technique.
• borderline-drop: Talos platform-as-proxy mail abuse (S3; order-notification templates, list bombing, bounce messages), original telemetry but about 1,400 messages from two campaigns, single source, awareness-grade for this constituency.
• borderline-drop: CrowdStrike agentic-AI intrusion campaigns (S3); blog summary of a gated report dated 2026-10-23, outside the window and from a non-slice source; the ARTEX thread is already covered.
• borderline-drop: Atlassian October 2026 bulletin (third-party dependency rows rated non-critical), Apache Camel 38 advisories (2026-10-15, config-dependent, 35 on an end-of-life line), Laravel TokenGuard CVE-2026-114509, Pillow image-plugin flaws, ISC BIND 2026-10-21 (CVSS 8.1 with high attack complexity, DoS), PaperCut September bulletin relays (authenticated, no exploitation), Searchlight AEM cloud-only chain (patched), Rapid7 Archibus write-up, Postiz and other low-prevalence EUVD 9+ rows of 2026-10-24, and the 2026-10-20 KEV additions Plex and SiteGuard (before the window, a prior fire's decision) (S1); each fails PD-11 on its own facts; none is exploited in a constituency-relevant product.
• borderline-drop: S2 leads (Microsoft DCU phishing-kit seizure of 2026-10-14, dcod law-enforcement roundup, St. Gallen SKIPD strategy, Swiss e-ID timeline, Quad9 France exit, PostFinance voiceprint ruling, Check Point monthly statistics, Swiss Government Cloud tender, Bundesrat cyber-law mandate of 2026-09-25), no obligation change or defender decision inside the window; details in findings.S2.yaml.
• Previously dropped ksmbd pair: the 2026-10-24 fire dropped the two ksmbd ZDI reports as niche; they are now carried inside the Linux entry because Sysdig's analysis of 2026-10-24 and TuxCare's reproduction put a public root exploit for the sibling report ZDI-CAN-33367 in the same disclosure.

Contradiction: the Danfoss update's ANSSI testimony (exposure and weak passwords, not published flaws) sits against Copeland's acknowledgment of a vulnerability in its end-of-life XWEB EVO controllers and the earlier report that ANSSI had identified a vulnerability in a Danish company's software; no source reconciles them, the entry says so and attributes the cause to ANSSI's testimony, and the verification value stays multi-source.

Single-source items and carve-outs: the Danfoss update's ANSSI account is testimony reported by two outlets (Public Sénat and Le Monde Informatique), no transcript was reachable, and the entry says so; the PHP update's Tenable and Siemens statements are first-party vendor advisories for their own products; the EDÖB's account of its proceeding is its own release, relayed by Der Bund; ReliaQuest's sequence is one vendor's lab result and is reported as such. No contradiction between sources needed a verification: contradicted entry.

Coverage gaps: connectwise-trust-center (403 on every transport including WebFetch, sixth consecutive failing run counting from 2026-10-20; the status page is the working route), apa-ots (Angular shell, no recipe), resecurity (JS shell), lore.kernel.org (proof-of-work challenge on every message page, so the ZDI postings were read through Sysdig, TuxCare, The Hacker News and Phoronix), consilium.europa.eu (403 everywhere, sanctions watch rested on WebSearch), rapid7-research feed (malformed XML, per-post extract works), edoeb-ch-press listing (stale cache, the release page reads), ahnlab-asec (listing via the reader is stale, WebFetch lists it), schneier (reader fallback only, two keys answered HTTP 402 before a third served). S2 and S3 each reached the metered reader through extract fallbacks on pages the direct transports could not read.

Candidate sources: two added (openjdk-vulnerability-advisories, the first-party advisory of record that published the second Java alert before any outlet; blackfield-ch, the Swiss researcher blog behind the independent SMB finding). Proposed and not added: csa-sg-alerts (a relay of vendor facts that surfaced items already dispositioned), publicsenat-fr (carried the ANSSI testimony; a general political outlet, revisit if it surfaces a second primary), pwn-watch (discovery lead only), status-connectwise (a per-incident pivot, not a rotation source). imperva-threat-research and opensourcemalware were promoted to active from sources.promotion_due. trendmicro-research got its feed back as rss_url and fetch_method: rss; 24 recipe notes from the sub-agent ledgers were appended.

Source health: tools/source_health.py probed 266 records; the first sweep flagged one, the new candidate blackfield-ch (its feed carries a single short item, below the content check's minimum, so the record was switched to the bridge method with the listing as the probed route), and the second sweep ended with no unsolved record.

Self-identification: this fire's main agent is Sonnet 5.5 (claude-sonnet-5-5) per the harness model line; the four research sub-agents reported Sonnet 5.5 (claude-sonnet-5-5) in their own return headers.

Audit note: the PK Softech and Publica entry now carries twelve changelog records and is the longest entry in the store; the previous fire's verifier already suggested consolidating its per-fund statements and splitting its first action, which stays audit work.

Verification loop: seven iterations of the single cti-verification definition, each a cold spawn that answered a claim ledger. Iteration 1 (226 claims) found 7 truth and 6 editorial defects and iteration 2 (159) found 3 and 4; iterations 3 to 6 (58 to 160 claims, post-fix scope) found 1, 1, 3 and 5 truth defects, mostly in the run record's own notes, and no iteration returned CLEAN. Every finding was fixed in the entries or the run record before the next pass. Iteration 7 (128 claims, 126 ok) found one low-confidence F3 (the Danfoss Forescout figure's denominator), fixed with the denominator named; with truth plus editorial at 1 and no F1 or F4, the fire takes the low-residual early exit (verification_residual_count: 1). The carried-forward F11 note on the summary length of the PK Softech, Danfoss and PHP2Shell entries was declined in every pass and stays audit work.