2026-10-28T0256Z-intel

Verification & coverage notes

Window 26 h (gap 24.0 h to 2026-10-27T0256Z-intel, normal cadence, no outage backfill). entities/registry.yaml (672 KB) was grepped per key instead of read whole; the 14-day prior_coverage.json (70 records) was read in full. Slice build: S1 and S2 excluded 0 sources by the two-previous-fires rule, S3 excluded 1, S4 took its whole 14-source pool. No intel drops, so no S5. Every slice ledger row came back attempted (17, 22, 14 and 14 records); no continuation was needed.

Verification. Iterations 1 to 7 each returned NEEDS_FIXES (their findings and remediations are in the record above) and the first CLEAN landed at the 8-iteration cap, so no confirmation pass was possible: the run publishes on that single CLEAN as a fail-open and the waiver is recorded. Open advisories, all pre-existing wording or length from earlier fires and left to the quality audit: the Gridbox entry's legacy em dashes, its re-floated high priority and the CVE-2026-61425 CNA score difference (9.4 against the discloser's 10.0), and the PHP entry's length on a non-deep-dive.

What this fire changed. Five new entries (Cisco PHP2Shell advisory, HPE ClearPass PHP2Shell, the CISA-listed Adobe Commerce upload flaw CVE-2026-48356, ARA-Region Lyss-Limpachtal, DeadTag) and nine changelog records. The two that matter most: Palo Alto's advisory of 2026-10-27 now states active exploitation against internet-exposed PAN-OS management interfaces (PAN-OS entry notable to high, PHP entry stays critical with the statement added), and CISA's KEV listing of the Brotli decoder flaw CVE-2026-111497 on 2026-10-27 moved the Node2Shell entry to exploited and high.

KEV rows (kev-window.txt).

• CVE-2026-111497: COVERED-STALE on two entries, both given update records (Node2Shell entry; the .NET entry, whose CVE record now carries exploited, cisa-kev and says Microsoft's own record still read not exploited on 2026-10-25).
• CVE-2026-48356 (Adobe Commerce and Magento upload flaw, KEV 2026-10-27): NOT COVERED, shipped as a notable entry. It was first held back as borderline (CISA's listing and Adobe's bulletin give no exploitation detail, no constituency nexus); the verifier then found Sansec's PolyShell reporting, which the CVE record itself links: attacks since 2026-03-19, a mass wave on 2026-03-30 and the fix timeline (2.4.9 on 2026-05-12, supported-line backport 2026-07-14). The entry now rests on Sansec, Adobe and CISA together, and the store already carries four Adobe Commerce or Magento entries.
• No RANSOMWARE rows.

Backlog (state/coverage_backlog.md). ARX Group SA (Aurora leak-site claim): held, unchanged: S2 and S4 searched in German, Italian and English and read Inside IT, Netzwoche, SRF, Blick, ICTjournal, NZZ, RTS and swisscybersecurity.net; no ARX, SBB or ASTRA/USTRA statement and no Swiss press report exist, expiry 2026-11-07. The 2026-10-14 strike of the ARA Lyss row is overtaken by Inside IT's report of 2026-10-27 and the new ARA Lyss entry.

Supersessions and corrections. Palo Alto's statement replaces the PAN-OS entry's "no malicious exploitation" text and its availability-only score (8.7 to 9.2); the PHP entry's "no source ties a named CVE to a production compromise" now carries the Palo Alto exception. Camping.Care: a second customer's notice says the supplier is investigating the cause and does not mention PHP, so the entry now says the PHP link rests on SRF, Blick and TCS. Manno: the entry's "claim could not be corroborated, no dataset" statements are replaced by Inside IT's report that about 30 GB were published (single source, Risikomonitor's analysis unverified, rating B3). IDC Frontier: the seventh report names the cause, so "intrusion route not public" is replaced.

Contradictions and borderline includes.

• Contradiction: Palo Alto's exploitation wording. An Internet Archive copy of the advisory taken 2026-10-27 17:10 UTC says "very limited exploitation", the page read 2026-10-28 says "active exploitation ... exposed to the internet", and the vendor timeline records no such change; the PAN-OS and PHP entries state both and tie neither to the 16:40 UTC revision.
• Contradiction: Adobe's bulletin APSB26-73 (2026-07-14, updated 2026-08-11) says no exploits are known for CVE-2026-48356, while Sansec reports attacks since 2026-03-19 and CISA lists the flaw as exploited; Adobe's CVE record scores it 9.3 where the bulletin says 9.6. The entry states both.
• Contradiction: HPE HPESBNW05171 names ClearPass 6.14.1 and 6.11.16 as versions "providing some level of mitigation" in its workaround text, while its affected list covers 6.14.1 and 6.11.16 and below and its remediation names hotfix patches for both; the entry quotes the bulletin and does not resolve it.
• Borderline include: Balbooa Gridbox CVE-2026-102788 and CVE-2026-102789, an unauthenticated read-side SQL injection with no exploitation report, folded into the July Gridbox entry as an update record (the store's pattern for later Gridbox batches, which moved its action to 2.20.4.2). Kept under the "otherwise" limb of PD-11 (b), the leg that holds being a two-file fix diff that hands over the technique; the July Gridbox flaws were exploited, these two are not reported exploited, and no Swiss nexus is established.

Single-source and reduced-confidence inclusions.

• ARA Lyss-Limpachtal: Inside IT relays Risikomonitor's analysis; DeXpose carries the claim; C3, routine, no encryption mapped because no source states it.
• Cisco, HPE ClearPass, Balbooa (with mySites.guru, on the Gridbox update): vendor first-party; Cisco and HPE carry cvss: n/a or the vendor's score only.
• Adobe Commerce CVE-2026-48356: the exploitation history rests on Sansec's own telemetry and scans (a security vendor) with CISA's listing and Adobe's bulletin; confidence high, reliability B.
• DeadTag: Report URI and iVerify published jointly, so one account from two vantage points, credibility 2.

borderline-drop lines.

• Gotenberg CVE-2026-42589 (VulnCheck canary telemetry, 1,358 events): internal document-conversion service, five-month-old flaw, not in CISA KEV, no established constituency exposure.
• Oracle October CPU, 90 unauthenticated rows at CVSS 9.0 or higher (73 distinct CVE ids) against the 12 in the existing entry's title: the entry states the full tally, the CPU is applied as a whole and none is reported exploited; not widened. Oracle Alert CVE-2026-109618 rev 2 Oracle Communications rows: telecom signalling products, no nexus (Secure Backup and Solaris are already in the OT-products entry).
• Cisco eMudhra informational (revised 2026-10-27): vendor-status churn on a covered entry that already carries the Cisco rows.
• Chrome 156.0.8078.73/.74 (52 fixes, four Critical), Mozilla MFSA 2026-118 to 122, Apple iOS 27.2, 26.7.2 and 18.7.11 (162 CVEs), GLPI 11.0.9 and 10.0.27, Joomla extension releases of 2026-10-26/27, EUVD criticals (Pie Register, llama.cpp ggml-rpc, OpenRemote): none reported exploited, no constituency nexus.
• Tailscale and headscale audit by Cyberdione Labs ("Tailworm", fixed in v1.104.4): needs an approved peer whose policy allows forwarding, no CVE, no exploitation, constituency exposure not established.
• Yoba (Check Point, fake GitHub AI-app projects with DLL sideloading): commodity technique, no constituency specificity.
• Arctic Wolf on Microsoft Teams external-chat impersonation: known technique, primary dated 2026-10-26 outside the window, Swiss relay only.
• HMICFRS inspection of police and fire and rescue cyber posture: UK regulator report, awareness level, no Swiss obligation.
• Kaspersky managed-Kubernetes isolation chain (provider anonymised, fixed), EDK II CVE-2026-97631 (the 2026-10-25 audit's reopen conditions are unmet), Popcorn Time updater (sinkholed since March, no exploitation), Sysdig pickle research, Bishop Fox PHP2Shell guidance (marginal delta on an entry that already carries KEV, public exploit and hardening): no change to what a Swiss SOC does.
• Swiss Ice Hockey Federation MYSIHF (valid-account theft, private federation), BACS weekly review week 43 (WhatsApp account takeover, consumer fraud; week 42 was also not published): no public-sector nexus.
• Moldova government digital services (about 750,000 records through unauthenticated services, no service or flaw named), University of Copenhagen test environment, GMO Onamae Desktop Cloud (Japan), Navigate360 / Canadian Crime Stoppers (investigation opened by the Privacy Commissioner), UNM Health, ENGIE, Medienwerkstatt Sulgen: out of nexus or no vector, actor or behaviour beyond the impact. Leak-site claims without victim or A/B-press confirmation (ECOM, SunTechnics Fabrisolar, Bristol City Council, OCMW Machelen, Alliance Police Nationale) stay out (PD-6).
• Convertr / Plausible CE CVE-2026-8467 (Magecart skimmer, suspected entry): suspected only, out of nexus; a pointer for the next audit.

Sources. karimi-honeypot-data promoted to active (promotion_due). Two candidates added because published entries cite them: ellio-threat-research, jfrog-security-research. Not added: Eye Security Research and Eclypsium (S3 leads, unused), risikomonitor-news and hacksnack.ch (S2 and S4 leads, reliability C and D, relays only). Recipe notes recorded for hpe-networking-psirt (changes.csv), cisco-psirt (feed), paloalto-psirt (advisory JSON), inside-it-ch (__NEXT_DATA__), apa-ots, ransomware-live and databreaches-net. connectwise-trust-center and ec-digital-strategy-newsroom stay 403 on every transport; a 403 never demotes.

Registry. Added incident:ara-region-lyss-limpachtal-ransomware-2026-09, campaign:deadtag, tool:coruna and tool:darksword, the aliases Brotli2Shell, HTTP2Shell and Broccoli2Shell on tool:node2shell, and seven product entities through sync_products.py (five from the new entries, Bun and Istio from the Node2Shell update).

Watchlist: products checked=0, hits=0; suppliers checked=0, hits=0 (no watchlists configured).

Coverage gaps: connectwise-trust-center (403 on every transport); ec-digital-strategy-newsroom (403 on every transport, third run); resecurity (empty JavaScript shell, newest post 2026-10-14 by search); golem-security (cookie wall); apa-ots (feed holds only the 15 newest releases, no lookback sweep possible); nau-ch, push-security, novee-security (nothing in the horizon; novee-security marketing only, demotion candidate); Juniper PHP2Shell reference advisory (Salesforce shell on every reader) and QNAP QSA-26-18 (reader returned navigation only) were not re-read, so any QNAP revision after 2026-10-27 is unverified; the Citrix community post is 403 on every direct transport and was read only through the reader.