2026-10-29T0255Z-intel

Verification & coverage notes

Window 26 h (gap 24.0 h to 2026-10-28T0256Z-intel, normal cadence, no outage backfill). entities/registry.yaml (676 KB) was grepped per key instead of read whole; the 14-day prior_coverage.json (73 records) was read in full. Slice build: S1 took 6 essential and 14 rotation sources, S2 15 and 14, S3 14 rotation, S4 its 4-source pool; every slice ledger row came back attempted (20, 29, 14 and 4 records), and no continuation was needed. One Phase 2 follow-up agent (FU1) swept the PHP2Shell vendor status lists and the CERT-FR bulletins of 2026-10-28 and found the Check Point, F5 and Trend Micro, Quest KACE and NetApp gaps. No intel drops, so no S5.

Verification. Eight iterations ran: 1 to 4 and 6 returned NEEDS_FIXES, 5 and 7 returned CLEAN, and iteration 8, the confirmation pass of the iteration 7 CLEAN, returned NEEDS_FIXES at the 8-iteration cap, so the run publishes by the cap's fail-open with verification_residual_count 5 (truth 4, editorial 1; findings and remediations are in the record above). The iteration 8 wording fixes (the KeyDrift Cisco citation and fixed-release string, the VMware CISA and CrowdStrike order, the Machelen Detection absolute) were applied after the cap and were not re-verified. Left for the quality audit: the VMware vCenter and ESX 7.0 rows (extended-support fix only, in the Broadcom matrix since before this run), the legacy VMware em dashes and wording, and the Citrix NetScaler clause in the PHP2Shell entry (page unreadable on every transport). Declined with rebuttal in the iteration records: WatchGuard as an F7 include (three feature-dependent unauthenticated rows at 9.2 on perimeter firewalls; the store keeps comparable rows at notable; iteration 2 agreed) and the ConnectWise Trust Center anchor (the anchored URL answers 403 on every transport and raises a source-urls warning; iteration 4 accepted the decline). The status-page citation for ConnectWise is the incident permalink.

What this fire changed. Eleven new entries and nine changelog records. The two that matter most: Cisco's advisory for CVE-2026-20127 (version 2.1 of 2026-10-28 adds the Talos link; it says Cisco is aware of limited exploitation) is matched by Talos's description of the KeyDrift implant that UAT-11473 ran inside the SD-WAN controller process (new high entry, patch does not evict it); and CISA's KEV listing of the Linux kernel flaw CVE-2026-46300 on 2026-10-28, with its chaining to the PHP2Shell flaws and Dream Research's account of 24 rooted firewalls, moved that entry from notable to high and gave the critical PHP2Shell entry its first production-compromise chain. Three new entries close PHP2Shell vendor gaps (Check Point, F5 BIG-IP, and Trend Micro with Quest KACE and NetApp ONTAP).

KEV rows (kev-window.txt).

• CVE-2026-41709 (VMware ESX, KEV 2026-10-28): COVERED-STALE on the VMSA-2026-0006 entry, given an update record: its CVE record now carries exploited and cisa-kev, and CrowdStrike's claim of zero-day use by WARP PANDA is attributed to CrowdStrike.
• CVE-2026-46300 (Linux kernel, KEV 2026-10-28): COVERED-STALE on the Fragnesia entry, given an update record (exploited, cisa-kev, priority notable to high).
• No NOT COVERED, MENTION-ONLY or RANSOMWARE rows.

Backlog (state/coverage_backlog.md). ARX Group SA (Aurora leak-site claim of 2026-10-23): held, unchanged. S4 re-read the ransomware.live record and API, the Inside IT, Netzwoche and SRF feeds and ARX's own site and searched in four languages; no ARX, client or regulator statement and no Swiss press report exist, expiry 2026-11-07. Breachsense lists the claim and five infostealer logins for the ARX domain, an aggregator and not corroboration.

Supersessions and corrections. The PHP2Shell entry's "no source ties a named CVE to a production compromise" is replaced by Dream Research's recovered-artifact account (and its clause that Sansec's CVE attribution differs from the PHP advisories is cut to one half-sentence); the Oracle CPU entry's "none of the rows is reported exploited" now carries Defused's decoy telemetry for CVE-2026-101767 without marking the row exploited; the ZDI entry's "no fix merged upstream or shipped in a distribution kernel" is replaced by AlmaLinux's production kernels and TuxCare's networking-tree statement, and its evidence quote is replaced by one still on TuxCare's updated page; the Cisco PHP2Shell entry's "no fixed release before March 2027" for URWB becomes November 2026 (advisory version 1.9); the ConnectWise entry's advice to keep the old connections disabled until restoration instructions exist now says restoration runs through a new application each tenant must consent.

Contradictions and borderline includes.

• Contradiction: Dream's headline says 25 servers rooted, its text says 24 firewalls rooted in the batch and a third government server exploited through the tunnel; the entry carries the 24 firewalls and the management server separately and says Dream could not confirm the outcome of the Active Directory attack.
• Contradiction: NCSC-NL's PHP2Shell list gives 2026-11-11 for Check Point's Jumbo fix, while sk1000302 lists hotfixes since 2026-10-23 and calls the Jumbo fix planned for 2026-11-11; the entry follows the vendor page and says so.
• Contradiction: Defused and BleepingComputer report exploit attempts against decoys for CVE-2026-101767 while Oracle has not tagged it exploited and no production compromise is reported; the row stays patch-available, not exploited.
• Borderline include: Veeam Backup & Replication CVE-2026-108142 with the Backup for Microsoft 365 and ONE rows (no exploitation reported), kept under the "otherwise" limb of PD-11 (b): an unauthenticated authorization bypass on backup-server infrastructure of a product family that ransomware operators target, relayed by the NCSC.ch hub. After the first verifier pass the cves[] records are held to six rows, the lowest scored 6.9 (the unauthenticated REST API bypass in Backup for Microsoft 365); the three lowest rows (two medium path traversals needing the Restore Operator role, an installer file-write) stay in the prose only.
• Borderline include: WatchGuard Fireware 2026.4 (three pre-auth rows at 9.2 in perimeter firewalls, configuration dependent, no exploitation reported); the store keeps comparable perimeter-firewall rows at notable.
• Borderline include: testmetest npm worm, first coverage through the rotational lookback (SafeDep 2026-10-27 update, JFrog 2026-10-26), included because installing with --ignore-scripts no longer protects and the wiper fires when the stolen token is revoked.
• Borderline include: Machelen municipality (routine): its own timeline names the foothold method and a 22-day dwell, satisfying the incident floor; Moldova's e-government extraction (PD-11 c) is the transferable parallel to the Swiss cantonal e-autoindex harvesting entry.

Single-source and reduced-confidence inclusions.

• Check Point, Trend Micro, Quest KACE, NetApp and F5: each vendor is the disclosing party for its own products. F5's advisory K000163821 could not be read, so the F5 entry rests on F5's release notes for the fixed builds and NCSC-NL's record of the exposure scope, confidence medium; NetApp's advisory page renders only in a browser and was read from the advisory data behind it.
• Veeam: vendor first-party, three KB pages, relayed by NCSC.ch and heise; single-source in the entry's frame.
• Moldova: the agency's own account with MOLDPRES and The Record; Machelen: the municipality's own timeline with ITdaily; the Rhysida listing is the group's claim as Ransomware.live records it.
• Huntress MDM enrolment: one vendor's research, single-source.
• KeyDrift: the implant analysis is Talos alone; Cisco and Lumen are independent for the flaw and for Volt Typhoon's exploitation of it.

borderline-drop lines.

• Cisco Secure Firewall ASA, FTD and FMC hardening CVE-2026-20329 to 20336: the Cisco primaries date from 2026-09-16 and 09-18, outside the window, only NCSC-NL's relay is inside it; authenticated rows, and the exploited ones are already covered.
• Amadeus reservation data (Korean Air, Asiana, JAL): out of nexus, no Swiss entity, no vector beyond a supplier account credential, Amadeus silent; reopen if a Swiss or European carrier confirms.
• Belgium FPS Finance cyberattack: incident floor not met (no vector, no actor, no data theft indicated).
• SoftwareOne and The Gentlemen: single paywalled source, leak-site claim with partial denial, no listing seen (PD-6).
• BACS weekly review week 43 (WhatsApp account takeover): published 2026-10-27, consumer fraud, no public-sector victim; Swiss Ice Hockey Federation MySIHF portal: private federation; Vaud CYBER26 exercise invitation and the Federal Council AI-regulation status report: no obligation or technical consequence; OFAC DPRK IT-worker designations: policy watch, four IT-worker entries already carry the lesson.
• Acronis TRU Qilin encryptor analysis, Enclave AuthMask CVE-2026-80097 (fixed in September), EPICS Base CVE-2026-114595 to 114598, Tailscale Tailworm (needs an authorised peer, patched in 1.104.4), TeamViewer 15.83, 123 Reg AI-driven intrusion, Socket Searchjacked, Check Point Yoba, Eclipse Vert.x CVE-2026-102479, Zscaler Node2Shell decoy telemetry: below the bar (single source, narrow exposure, patch-cycle item or low delta, no exploitation, no constituency nexus).
• CrowdStrike 2026 Legal Threat Landscape Report: US legal sector; its CVE-2026-41709 claim is carried in the VMware update record. Canadian Cyber Centre AL26-028 help-desk vishing: the store already carries two help-desk impersonation entries and no new Swiss-relevant mechanism appears.
• PK Softech and Publica (BLVK, BPK notification details): minor delta on an entry with 12 records. Hudson Rock FortiBleed 2.0 (1,703 further FortiGate configuration reports): single-source record counts, not working credentials; the 2026-06-18 and 2026-10-22 entries already carry the reset and configuration-review actions.
• FU1 vendor sweep, no item: Juniper JSA112681 (page unreadable; NCSC-NL records Junos OS as vulnerable to CVE-2026-109618 but not exploitable and SRX off PHP from 25.2R1), Broadcom Symantec Endpoint Protection Manager and Carbon Black App Control (umbrella advisory only, per-product pages login-gated), Splunk SVD-2026-1013 (only Smartlook, remedied), Sophos (no product affected), N-able (vendor-hosted, secured), Securepoint, Cleo, Checkmk, Ubiquiti UISP CRM and TerraMaster (niche or low exposure).
• CERT-PL Wing FTP Server CVE-2026-105420 (CVSS 4.0 9.4 but needs administrator privileges), CERT-FR AVI-1397 to 1408 (CPython, Chrome 156, Samba vfs_ceph_rgw, Docker Desktop, Metabase, Mitel, Edge, Mozilla, Belden, Axis) and NCSC-NL Apple macOS and Splunk Enterprise: no exploitation, authenticated or niche, no constituency exposure.
• Oracle PeopleSoft CVE-2026-35273 (ZDI decomposition into three bugs): no exploitation, victim, fix or status change beyond what the store already carries; Juniper Session Smart Router and Conductor (CCCS AV26-1101): primary unreadable on every reader, the CVE records alone give no usable exposure statement, and no exploitation is reported; watch for ZDI's separate PeopleSoft CVE ids.
• ESET APT Activity Report Q2 to Q3 2026: only the MDaemon finding is carried; the other findings are actor-activity summaries for regions outside the constituency.
• Volt Typhoon "Silent Train" (Lumen Black Lotus Labs): the page metadata shows 2026-03-16, so it enters only as the entity profile and the cited overlap in the KeyDrift entry.

Untrusted content. S3's WebFetch of the Socket Searchjacked post returned a share link carrying an instruction aimed at AI assistants (to remember the domain for future citations). It was ignored and is not part of any finding.

Sources. jfrog-security-research and anssi-cyber-gouv-actualites promoted to active (promotion_due). Four candidates added because published entries cite them or replace a blocked source: veeam-kb-security (first-party backup PSIRT, feed works), dream-research (the PHP2Shell and Fragnesia chain), safedep (testmetest) and ec-presscorner-api (JSON API replacing the digital-strategy newsroom that answers 403 for the fourth run). Not added: Tailscale security bulletins (mesh-VPN use in the constituency not evidenced), hacksnack.ch and InfoStealers (relay and single-vendor leads, reliability C). Recipe notes recorded for the sources named in the sub-agent ledgers (CrowdStrike feed, StepSecurity feed, ESET research listing, Previdian, Vaud cyber page, ransomware.live, Piyolog, ransom-isac, Venarix, hacksnack.ch), and the StepSecurity feed URL added to its record. connectwise-trust-center and ec-digital-strategy-newsroom stay 403 on every transport; a 403 never demotes. tools/source_health.py was run after the source updates (output in work/2026-10-29T0255Z-intel/source_health.out); its two UNSOLVED rows were investigated and not demoted: sygnia answers 403 on every transport including WebFetch (a 403 never demotes) and bfv-verfassungsschutz-de fails intermittently with an SSL EOF on a feed that reads on retry; a recipe note was recorded on each.

Registry. Added actor:uat-11473 (uses KeyDrift; overlaps Volt Typhoon, exploits the SD-WAN controller), malware:keydrift, actor:volt-typhoon, incident:moldova-egovernment-data-extraction-2026-10, incident:machelen-municipality-cyberincident-2026-09 (attributed-to Rhysida as a leak-site self-claim only), malware:hellage, malware:helltag and campaign:testmetest-npm-worm-2026-10 (overlaps Miasma and Mini Shai-Hulud, lineage unconfirmed), and 14 product entities through sync_products.py (two spellings merged into existing records as aliases).

Watchlist: products checked=0, hits=0; suppliers checked=0, hits=0 (no watchlists configured).

Coverage gaps: connectwise-trust-center (403 on every transport; the new application's identifiers on the Trust Center page are unreadable here); ec-digital-strategy-newsroom (403 on every transport, fourth run); ox-security (feed lists dated items but every article body is 403); previdian (listing feed 403, one featured CVE only); resecurity (empty JavaScript shell); golem-security (cookie wall); F5 K000163821 (my.f5.com is a JavaScript shell on every reader, so F5's exposure, mitigation and exploitation wording is unread); Juniper support portal (JavaScript shells); Broadcom per-product PHP2Shell pages (login-gated); the Cisco advisory's Snort rule links were not re-read after version 1.9; Palo Alto's PAN-OS hotfix status was re-read before the commit (19 of 20 released, only 11.1.7-h12 still carries an estimated date, 2026-10-30), so that build is the one to re-read at the next fire.