2026-10-31T0256Z-intel

Verification & coverage notes

A moderate window: six new entries and five changelog records. No deep dive and no critical entry: nothing new met the stop-and-act bar, and the one existing critical entry that moved (BeyondTrust CVE-2026-102764, where Rapid7 reports a Metasploit module on 2026-10-30) stays critical.

• KEV sweep (work/2026-10-31T0256Z-intel/kev-window.txt): both additions of 2026-10-30 are Ivanti Connect Secure. CVE-2026-118527 (NOT COVERED) and CVE-2026-111357 (COVERED, but not yet cisa-kev or patch-available) are one update record on the covered chain entry, which also moves the fixed-build targets to 25.1.1.3, 25.1.3.1 and 22.8R2.6 on the Canadian Cyber Centre's affected-version lists. No COVERED-STALE and no RANSOMWARE row.
• Backlog: the ARX Group SA row (Aurora leak-site claim) stays held. S2 and S4 re-searched in DE, FR, IT and EN and read the Swiss press feeds: ransomware.live still has no press field, and no statement from ARX, SBB, ASTRA/USTRA, BACS or Swiss press exists. Expiry 2026-11-07, struck then if unconfirmed.
• Window: the previous intel run started 24 h earlier, so gap 24.0 h and window 26 h. The two earlier fires' attempts excluded 92 standard records from the slices; the breaches pool was small enough that S4 took its seven oldest-cursor records without the exclusion (bitdefender-threat-debrief, piyolog, ransom-isac, venarix, bleepingcomputer, cnil-fr, cyberinsider), so some were swept again.
• Completeness follow-up: S1 dropped Progress WS_FTP Server and Veeam Management Pack on the strength of BSI's 'high' rating while CSIRT Italia counted 6 critical flaws including an authentication bypass, so one scoped follow-up (FU1, one continuation) read the vendor CNA records. WS_FTP clears PD-11(b) on its own mechanics: an unauthenticated network path to administrative credentials (CVSS 10.0) on a file-transfer server used with external partners, in a product whose 2023 flaw is in KEV with known ransomware use; no exploitation found, so it ships as notable with its fixed builds (2024.0.7, 2025.0.4). Progress's own bulletin is a script-rendered page no transport could read, so the entry's sourcing note says so.
• borderline-drop: Veeam Management Pack for Microsoft System Center 9.x (KB 4961 of 2026-10-29), one unauthenticated RCE (CVE-2023-22793, CVSS 4.0 9.3, on servers running the Virtualization Extensions service) and two authenticated flaws; no exploitation, an internal management-plane add-in for System Center Operations Manager, and the fix is a move to 13.1.0.334 because 9.x gets no patch. Reopen on an exploitation report.
• Source repairs from the health sweep: ec-digital-strategy-newsroom now reads through its RSS feed (general-news scope), sygnia joined the handled transport-blocked set, bfv-verfassungsschutz-de is checked through its feed recipe, and socprime is demoted on the content axis (its 20 newest feed items are product how-tos); ncsc-nl-php2shell-tracker and wordpress-org-news were promoted by the digest's promotion list; one new candidate, phorion.
• Mid-run stop-hook nudges to commit were noted and ignored: the run commits atomically in Phase 6.
• Spawn message error: the FU1 follow-up was told the time was about 04:40Z when it was about 03:55Z; its in-window anchor (2026-10-30T00:56Z) was stated explicitly and unaffected.
• Single-source: Teams-to-AD CS (Microsoft Threat Intelligence is first-hand on both intrusions), Broadcom endpoint-security servers (Broadcom is the disclosing party; the SEPM fix builds rest on NCSC-NL's tracker and are marked unverified), and the Cisco, Trend Micro and QNAP revisions (vendor advisories for their own products). Each carries the matching sourcing_note.
• Reduced confidence: Linux kernel CVE-2026-98432 carries confidence: medium because severity ratings disagree (9.8, 8.1, Critical for RHEL, 5.9 as BleepingComputer reported) and the exploit claim is Anthropic's alone; Broadcom SEPM fix builds as above. The drupal.org advisory answers a client challenge to extract, so its wording was read with WebFetch and the two quotes cited from it are not machine-checkable.
• Dates: the Phorion post is dated 2026-10-30 with a 2026-10-31 update widening the version guidance from 2.1.313 to 2.1.312 and 2.1.313; Cursor's notice, Microsoft's analysis and Sophos agree. Broadcom's knowledge article 459982 shows a placeholder date (2026-01-01) in the extracted text; its structured data gives the publication date 2026-10-22, which the entry cites.
• Contradiction: the Cursor extension entry. NCSC Switzerland's post 13121 places the backdoored extension on Open VSX and says Anthropic pulled npm and VS Code versions of 2.1.313; Microsoft says the packages were never published to the Visual Studio Marketplace or npm, and Cursor and Phorion name the Cursor marketplace only. The entry follows Microsoft, Cursor and Phorion and states the difference in its Exposure paragraph and sourcing note.
• Contradiction held, not resolved: the Berlin Landesnetz entry records BSI's own confirmation that TerminalFix was the vector, while rbb24 writes that BSI did not confirm that pattern to it; no record was written (see the borderline-drop for that item).
• borderline-drop: Pentagon commissary freezer failures (update-of the Danfoss refrigeration entry); attribution rests on two anonymous-source reports (Reuters via four officials, Nextgov via two people), no vector is stated, the lesson of the entry is unchanged, and the entry's analysis (1,291 words) is already far past the length bound, so a rewrite would be needed to carry it.
• borderline-drop: Request Tracker 6.0.4 and 5.0.11, RTIR (30 CVEs), stored XSS from unauthenticated email and an authenticated code-execution bypass, no exploitation, and no source shows Swiss public-sector use; patch-cycle.
• borderline-drop: Dell PowerProtect Data Domain DSA-2026-416, first published 2026-10-01 and last revised 2026-10-19, only NCSC-NL's relay of 2026-10-30 falls in the window; internal-facing backup appliance, no exploitation reported.
• borderline-drop: Canonical LXD CVE-2026-112816 (CVSS 4.0 10.0, mTLS validation), niche stack, no exploitation, fixed 2026-10-29; patch-cycle.
• borderline-drop: Siemens SSA-166980 revision 1.2; the revision predates the window and the energy products named have mostly no fix by design of the wave; the PHP2Shell OT entry already carries Siemens.
• borderline-drop: GitLab 19.5.3 and the other 2026-10-29 patch releases removing the eight eMudhra intermediates (CVE-2026-111943), patch-cycle, no exploitation; the eMudhra entry's action already covers updating CA bundles and Go.
• borderline-drop: Linux kernel PwnEscape CVE-2026-99999 (S1 bundled it with CVE-2026-98432), guest-to-host flaw, fixed since 2026-10-15, local vector; the expectation of exploits within weeks is the discoverer's, not an observation. It would be a separate entry if exploitation or a hypervisor exposure statement appears.
• borderline-drop: Android 'SMS of Death' CVE-2026-58882, zero-click DoS on telephony, public PoC, fixed in the October bulletin; patch-cycle, status rests on heise alone.
• borderline-drop: ReliaQuest victim-matched residential proxies in vishing-led SaaS intrusions, single vendor, the vishing pattern is covered by the Talos IR, Huntress and new Microsoft entries.
• borderline-drop: TeamViewer TV-2026-1011 (CVE-2026-111585, viewer-side code execution), no exploitation, bulletin of 2026-10-28 outside the window; patch-cycle.
• borderline-drop: CrowdStrike 2026 Legal Threat Landscape Report (annual-report candidate), legal sector outside the constituency, report gated; the transferable content (IT-impersonation vishing into remote tools) is covered.
• borderline-drop: Binance (about USD 6.36 billion, largest crypto theft on record; S3 and S4 returned it), clears breach limb (a) on scale only; no Swiss public-sector nexus, the stated vector (a compromised DevOps engineer's laptop) is covered ground, so an entry would be awareness only. Reopen if a post-mortem names a transferable technique.
• borderline-drop: Berlin Landesnetz detection gap (rbb24, attack-detection licences covering 5 percent of devices); the rbb24 primary is 10 days old and only a blog relay is in the window; an organisational lesson that changes no detection decision.
• borderline-drop: RMS Cloud and feratel Deskline booking-platform breaches, no Swiss customer named at either vendor; same WhatsApp booking-fraud pattern as the covered Camping.Care entry.
• borderline-drop: SIHF and Swiss Basketball member-portal incidents, private associations; the 2026-10-30 fire dropped SIHF for the same reason, and the basketball claim rests on FrenchBreaches alone.
• borderline-drop: Fehmarnbelt contractor FLC, Leipzig University and Charité, Ruag MRO law-firm investigation, FortiBleed 2.0 (Hudson Rock), no Swiss entity or no vector or actor (incident floor), the Ruag item is insider fraud without an intrusion, and the FortiBleed data is dated February with no new vector.
• borderline-drop: S2's policy and enforcement candidates (Federal Council e-evidence transitional rule, DVS Microsoft 365 exit study, BACS WhatsApp fake-vote update, Qilin arrest, INTERPOL Serengeti III); no change to what the constituency's defenders are obliged or advised to do, or outside the window. Canton Bern's ICSG enters into force 2026-11-01 and is already in the store.
• S3 left three out-of-window leads for the audit to weigh, none fetched as a primary: Microsoft Authenticator CVE-2026-80097 (2026-10-28), EDK II PXE flaw CVE-2026-97631 (seen only in a search summary), and the 2026-10-29 research posts from Talos (NIK C2), Securelist (NetamLoader) and Group-IB (MadApe).
• Coverage gaps: ivanti advisory hub (login shell on every transport; per-CVE fixed builds unconfirmed); connectwise-trust-center (403, WebSearch only); ox-security (article bodies 403); resecurity, onapsis, openjdk-vulnerability-advisories, zimbra-security-advisories (listings unreadable or empty); broadcom advisories 39411 and 39421 (login-gated). Recipe findings are recorded in the sources_changed notes: schneier, blick-ch, qnap, synology, siemens, the NCSC-NL tracker change log.
• Verification: iteration 3 returned NEEDS_FIXES with 2 truth and 0 editorial findings (none F1 or F4) on full coverage (238 of 238 claims); all five of its findings were fixed in the entries and the run published on the low-residual early exit without a fourth pass, so the two truth fixes are unconfirmed by a later cold read (residual count 2).