2026-10-26T0256Z-intel

Verification & coverage notes

Quiet window over Sunday and early Monday (gap 24.0 h, window 26 h starting 2026-10-25T00:56Z). The four sub-agents returned 14 items; two were published as new entries, three existing entries received a changelog record and the rest were dropped or held. The container clock agreed with the network date (skew 0 s) and the previous fire (2026-10-25T0256Z-intel, publish ok) and the 2026-10-25 audit were both on origin/main.

• Published (new): the out-of-band .NET security release of 2026-10-25 (the Brotli decoder CVE-2026-111497 plus corrected fixes for CVE-2026-70197 and CVE-2026-102870) at notable, because Microsoft says the 2026-10-13 release did not fully address two of its flaws and hosts patched that day stay exposed (PD-11(b), out-of-band limb); and the JPCERT/CC and NICT account of app-to-backend API attacks, web shells and AI-platform scanning in Japan at notable, first coverage from the jpcert-eyes rotational lookback (PD-7(d)), cleared under PD-11(d) as A-reliability primary technical analysis with behaviours a responder can check in API logs.
• Updated: php-critical-release-pre-announced-cve-2026-109618-109619 (update: Unit 42 retracted on 2026-10-25 its update that linked an attack on a European government agency to these flaws; S1 and S3 both found it, no other lane and no press outlet did). Priority stays critical: the 2026-10-22 record that set critical rested on attack traffic, public proofs of concept and VulnCheck's working exploit, none of which depends on the retracted report. The retracted claim was removed from the summary, immediate action wording, sourcing note, Detection paragraph, the 2026-10-24 section, the evidence quote and the techniques T1003 and T1557, which only that account supported. cve-2026-111497-node2shell-brotli-decoder-rce-nodejs-pypi (update: Envoy's own advisory of 2026-10-23 and the .NET release; Bun and Istio rest on The Hacker News alone and were not carried). pan-os-panorama-php2shell-mgmt-interface-no-fixed-release (correction: the statement that Unit 42 had seen a proof of concept is no longer on Unit 42's page, so statement, quote and citation were removed; S3 and S1 disagreed on whether this entry needed a change, the page grep settled it).
• KEV sweep: tools/kev_window_diff.py found 0 additions with dateAdded in the window and no ransomware-flag change on a store-covered CVE; S1 confirmed independently against catalogue 2026.10.23 (newest dateAdded 2026-10-23, CVE-2026-114625 and CVE-2026-110447, both covered). PHP2Shell is not in KEV.
• Backlog: the ARX Group SA row stays held, unchanged and unappended. S2 and S4 re-checked it today: the ransomware.live record is unchanged since 2026-10-23, there is no ARX, SBB or ASTRA statement and no Swiss press report; the hold condition is unmet and the 2026-11-07 expiry stands.
• Single-source: cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix, vendor advisory for its own product (Microsoft's blog, four dotnet advisories and the Security Update Guide are one assessor), A2.
• borderline-drop: Tailworm (Cyberdione Labs, 11 claimed Tailscale and headscale flaws, 2026-10-25); single uncoordinated report, proof of concept withheld, no independent reproduction, no CVE or fix, constituency use not established.
• borderline-drop: OpenAI frontier-training containment disclosure (2026-10-25), own-environment account with no defender decision beyond fixes already shipped.
• borderline-drop: Semperis on Prince of Persia (2026-10-22), single vendor, indicator-led, no European victim, no new endpoint behaviour.
• borderline-drop: OPNsense PHP2Shell hotfixes 26.7.7, 26.1.11 and 26.4.2p4 (2026-10-21), out of window by five days and not a rotational lookback, no exploitation against OPNsense; the PHP entry already says to update the runtime on every host and image.
• borderline-drop: CSIRT Italia alert AL01/261025 (2026-10-25), 81.9 % of Italian PHP services potentially vulnerable; a national exposure statistic that ACN says can include backported fixes; no new action.
• borderline-drop: EDÖB head Lobsiger interview in the Blick (2026-10-24), possible widening of the PK Softech proceeding to the federal bodies; the Publica entry already carries the 2026-10-22 formal investigation and the widening is conditional.
• borderline-drop: CYFIRMA PHP2Shell early warning v3 (24 October), single vendor, closed I2P channel nobody else can check, confidence inconsistent between narrative and evaluation, names the EU but not Switzerland.
• borderline-drop: Chrome 156 stable (2026-10-20), about 6 h outside the record's lookback, no exploited flag, no store coverage.
• borderline-drop: Drupal SA-CONTRIB-2026-253 (Monster Menus), needs an authenticated role, exploit maturity theoretical; PaperCut September bulletin additions, administrator-only; Atlassian October third-party bulletin, Atlassian rates the criticals lower risk.
• borderline-drop: Medienwerkstatt Sulgen TG (Akira claim, 2026-10-23), private sector, out of window; ECOM and White & Case Qilin listings (2026-10-25), leak-site claims without a victim statement (PD-6), no public-sector nexus.
• borderline-drop: French party and company leak wave of 23 to 25 October (PCF, La France insoumise, Renaissance, FSU, Alliance Police Nationale, Orange, Engie, ADMR, DEKRA), no shared vector or actor named, no Swiss nexus.
• borderline-drop: ABC wipes devices after AdFection ad exposure (2026-10-23) (victim-side corroboration of a covered entry, no new behaviour; Quest Diagnostics, Capcom, Railway, Parkview, Yamato, Bathurst RSL and the Oberspreewald-Lausitz district administration) out of nexus, out of window or impact-only.
• Candidate sources added: dotnet-blog (first-party .NET servicing channel; surfaced the out-of-band release that no slice source did), nict-cynex-lettice (named the app-to-backend attack, cited by JPCERT/CC) and datadog-security-labs (dated RSS, primary cloud-identity and supply-chain research); the S3 candidates macnica-security-research and S4's cyfirma-research were not added (Macnica is context for an entry that did not cite it; CYFIRMA's item was dropped). Twenty-one recipe notes from the source ledgers were appended to sources/sources.json. The transluce record is a single report, not a feed, and is a candidate for the next lifecycle review.
• Jina reader credit: extract fell through to the reader on the two MSRC per-CVE pages in this run and, in S2, on three European Commission and Council of Europe pages.
• Contradiction: S1 and S3 reported the PHP2Shell retraction as a correction; it was recorded as an update because it is an exploitation-status change in the world (Unit 42 withdrew its own claim on 2026-10-25), not an error in the entry as written.
• Coverage gaps: connectwise-trust-center (403 on every transport, seventh consecutive failing run; status page read instead); ox-security (article bodies 403, feed only); schneier (feed 403); digital-strategy.ec.europa.eu (403 on every transport, not in slice); arx-group.ch and arxgroup.ch (no readable victim site); community.citrix.com Tech Zone NetScaler post (403, its 2026-10-27 fixed builds are not out yet); news.admin.ch /de/nsb (403).
• Verification: three iterations of the single cti-verification definition, each covering every claim in scope (152, 152 and 151 claims checked). Iteration 1 found two truth findings (the retraction worded as an intrusion withdrawal; an unsupported "independently" about NICT), one missing citation, one Visual Studio gap and a priority question on the PHP entry; iteration 2 found four low-confidence wording findings; iteration 3 found two low-confidence unsupported-citation findings. All truth and editorial findings were fixed in the same iteration's remediation; the PHP priority challenge (F16) was declined with a recorded rebuttal and the verifier accepted it as a judgement call in iteration 2. The first spawn of iteration 3 was lost to a container restart at about 04:30Z (the working tree survived) and the iteration was re-spawned clean. The final verdict is NEEDS_FIXES with two truth findings, both fixed afterwards, so the fire published on the low-residual early exit (decision rule 5) and no confirmation pass followed; verification_residual_count is 2, the two F3 findings applied after the last pass and not re-checked by a fresh verifier. The next audit should give the PHP, Japan and .NET entries an independent pass.
• Essential-coverage: all 21 essential records of S1 and S2 were attempted; none missed.