2026-10-30T0255Z-intel

Verification & coverage notes

A moderate window: six new entries and six changelog records. No deep dive and no critical entry: nothing met the stop-and-act bar, and the one candidate for a priority raise (GitLab CVE-2026-97229, now on CISA KEV) stays high: exploitation is reported by one observer (Alpine Linux, attempts against its own instance on 2026-10-20 to 26 with no confirmed code execution; CISA lists it and NCSC Switzerland restates the report), and the demonstrated path needs an account that can push to a public project. Reopen as critical on mass exploitation or a confirmed compromise.

• KEV sweep (work/2026-10-30T0255Z-intel/kev-window.txt): CVE-2026-76418 (Cisco ASA/FTD) is a new entry; CVE-2026-97229 (GitLab, COVERED-STALE) is an update record that moves its CVE status to exploited. No RANSOMWARE row.
• Backlog: the ARX Group SA row (Aurora leak-site claim) stays held. S4 re-checked it on 2026-10-30 (Ransomware.live press field empty, no victim, SBB, USTRA or Swiss press report in DE, FR, IT or EN); expiry 2026-11-07, struck then if unconfirmed.
• Window: the previous intel run started 24 h earlier, so gap 24.0 h and window 26 h. The two earlier fires' attempts excluded 89 standard records from the slices; the breaches pool (20 records) was so small that S4 took its 12 oldest-cursor records without the exclusion, which is why bleepingcomputer, cnil-fr and similar records were swept again.
• Mid-run stop-hook nudges to commit were noted and ignored: the run commits atomically in Phase 6.
• Dates: Lumen's Silent Train page carries the metadata date 2026-03-16, but its text covers events through July 2026 and The Hacker News reported it on 2026-10-28; the new entry uses 2026-10-28 and an internal record corrected the same citation date on the KeyDrift entry.
• Publica: its own newsletter of 2026-10-22 associates Akira with the attack, so a correction record replaced the entry's statement that Publica had not named the actor. The newsletter PDF extracts with broken line spacing, so the correction cites it inline and carries no evidence quote.
• Single-source: Silent Train (Lumen's own research; The Hacker News relays it), Talos IR trends (first-party report), VAPOR PANDA (CrowdStrike telemetry and recovered controller transcripts), privatim guidance (the PDF; DCOD summarises), Cisco ASA/FTD (vendor advisory; CISA restates the listing). All carry the matching sourcing_note.
• borderline-drop: Linux kernel CVE-2026-98432, patch-cycle class: NCSC Switzerland carried it on 2026-10-29 as a critical advisory with the exploitation status unknown, and Anthropic reports a lab remote-root exploit against MPTCP listeners with the code unpublished, but vendors rate attack complexity high (scores 5.9 to 8.1), no exploitation is reported, and no mitigation exists beyond the kernel update (Ubuntu and RHEL still unfixed on 2026-10-29). Reopen if exploitation or public exploit code is reported.
• borderline-drop: Sophos UTM CVE-2026-118633, out-of-window: primary source 2026-10-28, window_hours=26; the 2026-10-29 BSI and ANSSI relays add no development, and there is no exploitation report; a pre-auth root flaw on an end-of-life appliance that needs a manual patch, so reopen if exploitation is reported.
• borderline-drop: Progress WS_FTP CVE-2026-84295, unauthenticated CVSS 10.0 but no exploitation statement, and only CNA record text relayed by EUVD and GHSA (included with reduced confidence was considered and rejected: the vendor advisory is login-gated).
• borderline-drop: Juniper JSA112183 Session Smart Router and Conductor, no exploitation, the 9.8 router row is limited to devices not yet onboarded, constituency deployment unknown, vendor page unreadable.
• borderline-drop: Xerox and Fiery PHP2Shell (XRX26-016), out-of-window: primary source 2026-10-28, window_hours=26; no exploitation against printers, fixes from 2026-11-06.
• borderline-drop: Oracle E-Business Suite CVE-2026-101767 (Canadian Centre wording of 2026-10-28), an authority restating open-source reporting with no first-hand observation; the entry already carries the Defused decoy attempts.
• borderline-drop: OpenText Advanced Authentication CVE-2026-112256, a single CNA record via EUVD, vendor text unreadable, no exploitation statement.
• borderline-drop: Microsoft's report of Onyx Sleet and Pearl Sleet using ARTEX (update on the Storm-0940 entry), two more ARTEX users in trend reporting; the Storm-0940 entry is already past 1,900 words, so an update record would add bulk for a marginal delta. VAPOR PANDA's entry references it.
• borderline-drop: EFK audit of Microsoft 365 in the federal administration, recommendations on one tenant, no obligation or near-term action, primary 2026-10-21.
• borderline-drop: Sophos GOLD OGRE and Aur0ra AI-agent intrusions; standard Active Directory chain run with AI agents, first reported by Gambit and CloudSEK in August; adds no new technique.
• borderline-drop: Group-IB MadApe, SOCRadar n0n, Arctic Wolf Teams external-chat impersonation, Talos NIK C2, Cyble INJ3CTOR3 FreePBX, covered techniques or commodity capability with no victimology, vector or constituency exposure.
• borderline-drop: OpenSourceMalware trojanized Claude Code extension, a single source that disclaims provenance; reopen on a vendor or second-source statement.
• borderline-drop: EDK II PXE CVE-2026-97631, out-of-window: advisory 2026-10-22, firmware class, no exploitation.
• borderline-drop: Binance theft (about 6.3 billion US dollars), global scale but nothing transferable beyond a preliminary "compromised engineer laptop"; reopen when the post-mortem names the vector.
• borderline-drop: Polymarket and DebugBear script compromise, no Swiss or public-sector customer known; reopen if DebugBear names scope or a root cause.
• Out-of-window items kept as developing stories (72 h window): the Silent Train report (2026-10-28), because it develops the KeyDrift story published on 2026-10-29.
• Lookback: the privatim guidance (document 2026-10-02, announced 2026-10-13) entered through the dcod-ch lookback and is first coverage for the reader.
• Coverage gaps: ox-security (article bodies 403 on every transport, lead-only); lab52 (feed SSL EOF, reader listing undated); resecurity (empty JavaScript shell on extract); golem-security (cookie wall, titles only); edoeb-ch-press (listing stale, sitemap recipe found); Juniper support portal, Progress and OpenText advisories (script shell or login wall).
• Source health and recipes: S2 and S1 returned working recipes for ec-digital-strategy-newsroom (extract), edoeb-ch-press (sitemap), le-monde-info, github-advisory, enisa-euvd and ransomware-live; they are in the notes of those records. Three candidates added (privatim-ch, ncsc-nl-php2shell-tracker, infostealers-hudson-rock) and three promoted to active (veeam-kb-security, dream-research, safedep).
• For the next audit: the GitLab, PAN-OS and Publica entries are 600 to 1,160 words in the main text although earlier records grew them; this run shortened the GitLab and Publica text but did not rewrite them to the 550-word bound.
• Verification: four iterations; iterations 1 to 3 returned NEEDS_FIXES (23, 10 and 4 findings, all remediated or declined with a reason) and iteration 4, a post-fix pass over 111 of 241 claims plus the full text of all twelve entries, returned one editorial finding (the WordPress firewall wording), which was remediated before publication under the low-residual early exit (truth plus editorial 1). No CLEAN iteration ran, so this publication rests on the early exit, not on a confirmed double-CLEAN; the next quality audit should give these twelve entries an independent pass.