2026-10-27T0256Z-intel

Verification & coverage notes

Window of 26 h (gap 24.0 h) on a Tuesday with one dominant story: CISA's KEV listing of the PHP2Shell flaws on 2026-10-26 and the first documented code execution against honeypots. The container clock agreed with the network date (skew 0 s); the previous fire (2026-10-26T0256Z-intel, publish ok) was on origin/main. A container restart at about 03:13Z killed the first four research sub-agents before any returned; they were re-spawned once at 03:15Z (their progress and checkpoint files are kept as *.attempt1.* under work/<run-id>/, used as leads only) and all four returned by 03:35Z, so the restart cost about eighteen minutes and no entry depends on the lost work.

• Published (new, three): the TCS Camping and Camping.Care booking-data theft that SRF and Blick tie to the PHP flaws (notable, PD-11(c): the first Swiss-linked victim report of the exploited PHP flaws, a supplier-borne exposure with a transferable lesson for public bodies whose portals run on PHP suppliers; single-source-victim, TCS's own confirmation, B2); Wiz Research's Gheist campaign, stolen GitHub tokens planting secret-dumping workflows, with GitHub's own changelog confirming that its approval hold covers public repositories on github.com only (notable, PD-11(a) and (d)); and a PHP2Shell vendor-notice entry for industrial, building and network-access products, led by NetModule NRSW (router software of the Bern-headquartered NetModule AG, all versions, no fix, web interface to be disabled) and macmon 6.x/7.x, with Schneider Electric, B&R, HMS, Wibu-Systems, Johnson Controls and Oracle (notable, PD-11(b): no fix and an out-of-band response on an exploit-listed flaw; one entry per estate class as for QNAP and Synology, not one per vendor).
• Updated (eight changelog records): the main PHP2Shell entry (update: KEV listing and Karimi's honeypot report; the statements that neither flaw is in KEV and that no source ties a confirmed compromise to the flaws were replaced where they stood, the 2026-10-26 section's sentence was narrowed to production systems, the main analysis was held at its previous 1,977 words); PAN-OS (update: nine hotfixes released, one action added); NetScaler (update: KEV listing, no fixed build in Citrix's bulletin); QNAP (update: QVR Surveillance and TVR OS resolved, QuMagie no longer listed); the Brotli entry (update: NCSC.ch advisory 13105, PAN-OS firewalls with Brotli inspection and decryption, PHP for Windows, Ubuntu; one action added); Apple CVE-2026-86950 (update: iOS 18.7.11 fixes iPhone XS, XS Max, XR and iPad 7th generation); ARTEX (update: Seoul police arrest of a criminal group's leader, BleepingComputer names the framework); ConnectWise Cloud Backup (improvement: Huntress's analysis, detections and the Graph logging gap).
• KEV sweep: CVE-2026-109618 and CVE-2026-109619 (COVERED-STALE on four store entries) are dispositioned by the four updates above plus the new vendor-notice entry; no NOT COVERED or MENTION-ONLY row and no RANSOMWARE row (CISA marks ransomware use unknown). The KEV remediation deadline is not carried in any entry.
• Backlog: the ARX Group SA row stays held, unchanged and unappended: S4 re-checked it and the ransomware.live record still shows no press link, with no ARX, SBB or ASTRA/USTRA statement and no Swiss press report; the 2026-11-07 expiry stands.
• Single-source: gheist-stolen-github-tokens-secret-dumping-workflows (Wiz telemetry, B2), original lab research; pan-os-panorama-php2shell-mgmt-interface-no-fixed-release (vendor's own product, A).
• borderline-drop: PK Softech and Publica, EDÖB head Lobsiger's SonntagsBlick interview relayed by Inside IT and Ticinonline (2026-10-25 and 26) and Publica's re-stated "no darkweb publication", a conditional possible widening of the proceeding, a re-confirmed status and a breach-notification count; the entry already carries the formal investigation (S2 and S4, same drop as the previous fire).
• borderline-drop: Medienwerkstatt Sulgen TG (Akira claim, victim confirms ransomware and copied data), private print firm, no public-sector customer stated, no vector or behaviour beyond the impact (incident floor), the only link is the actor already in the Publica entry; University of Copenhagen test-environment breach, out of nexus, no vector.
• borderline-drop: Cisco Talos on attackers using 25+ legitimate platforms to mail the lure under the brand's own DKIM and DMARC (2026-10-21, first coverage from a rotational lookback), drafted as an entry and dropped after the first verifier pass: six-day-old vendor research with a vendor tally and consumer-retail examples, the lesson is a generic gateway-inspection point and a Tier 2/3 responder changes nothing in the next seven days because of it (PD-11, awareness only).
• borderline-drop: Arctic Wolf Labs on more than 400 Teams external-chat helpdesk-impersonation cases (2026-10-26); the store carries six Teams-vishing entries and three already carry the external-access allow-list lever; the new content is one audit event name (ChatCreated) and a tenant-pattern description.
• borderline-drop: CYFIRMA's PHP2Shell advisory (Lazarus-ecosystem actor, 216 hosts, closed I2P channel), single vendor, nobody can check the channel, confidence inconsistent between narrative and evaluation, no Swiss nexus (dropped by the previous fire too); Symantec's AI-honeypot "Skynet" capture and Semperis on Prince of Persia (both lookback), relevant only to bodies that expose model endpoints or indicator-led infrastructure tracking with no European case; Forever Security's planted AGENTS.md (2026-10-22), vendor-run reproduction, success rates are the vendor's claims, delivery of the file unknown.
• out-of-window: CrowdStrike's report on four actors running Claude Code as an intrusion operator (2026-10-23, recovered through a Hacker News recap of 2026-10-26; the crowdstrike record was not in any slice), primary source three days before the window start and not a rotational lookback; offered to the audit.
• borderline-drop: Risikomonitor's Swiss unpatched-domain figures (Inside IT, 2026-10-26); scope differs from the 2026-10-22 figure so it is not a trend; Fortinet FG-IR-26-186 and -187 revisions, Synology Hyper Backup "not affected", NetScaler Product Security (no new post readable), Tailscale "Tailworm", Wasmtime sandbox escapes, Chromium Mobile rows in MSRC, Sansec Magecart items, Plex and EG SiteGuard KEV additions (2026-10-20, out of window, consumer or Japan-specific), no delta for the reader or out of scope.
• Contradiction: S1, S2 and S3 each framed the KEV listing and the honeypot report as separate items; they were merged into one update. S2 read CISA's due date of 2026-10-29 as a signal; it is a US federal obligation and is not carried (PD-13). The Phase 4 re-fetch of two pages read with guessed URL slugs returned 404 (corrected to the URLs in the findings; nothing was cited from a guessed URL).
• Contradiction: the Palo Alto Brotli advisory (CVE-2026-111497) still shows 12.2.4-h1 and 12.1.7-h11 with 10/28 estimated dates while the PHP2Shell advisory, revised at 2026-10-27T04:03Z, lists both as released; the Brotli entry cites the Brotli advisory as stated and the PAN-OS entry the PHP2Shell one.
• Candidate sources added: belden-psirt (first-party NetModule and macmon advisories, on no slice source) and karimi-honeypot-data (packet-level exploitation ground truth). Not added: arctic-wolf-labs (its item was dropped), forever-security (no feed, vendor interest) and hacksnack-ch (derivative SME news, offered by S2 and S4). Recipe notes from the source ledgers were appended to the matching sources/sources.json records, among them the BACS card-markup change that breaks the documented split, the Fortinet RSS reset, the SSD Disclosure recipe and the Help Net Security extract behaviour.
• Reader credit: extract fell through to the metered reader for the CISA alert, the QNAP page and the Dark Reading articles; S4 reported two more on tcs.ch and news.ku.dk.
• Audit hand-offs: the IDC Frontier entry does not cite the provider's sixth report of 2026-10-18; Eichstätt (Germany, municipal ransomware through an unnamed third-party vulnerability despite two-factor authentication, statements of 2026-10-22 and 23) fell about twelve hours outside the lookback and is a municipal lesson; the main PHP2Shell entry's main analysis (1,977 words) and several others touched this fire remain over the 550-word bound as carried debt, none grown by this fire.
• Coverage gaps: connectwise-trust-center (403 on every transport, failing on every run since 2026-10-19); ec-digital-strategy-newsroom (403 on every transport); community.citrix.com Tech Zone NetScaler post (403 on every transport for S1; a later extract read it, last updated 2026-10-22 and still saying fixes are planned for 2026-10-27, so whether they shipped is unconfirmed); rapid7 and cisa.gov all.xml discovery feeds (unreadable); lumen-black-lotus-labs (landing page without a post listing); php.risikomonitor.com (figures render client-side).
• Watchlist: products checked=0, hits=0; suppliers checked=0, hits=0
• Essential-coverage: all 21 essential records of S1 and S2 were attempted; none missed.