2026-11-02T0256Z-intel

Verification & coverage notes

Quiet window (gap 24.0 h, window 26 h, the Sunday-into-Monday stretch): CISA KEV has no addition after 2026-10-30 (S1 read catalog 2026.10.30 and the mechanical sweep agrees), none of the Swiss, EU or national-CERT records published inside the window, and the yield came from rotational lookbacks and the 72 h developing-window sweep. Coverage window: standard (gap 24.0 h, previous run 2026-11-01T0256Z-intel).

Published. New: the Android telephony "SMS of Death" crash (S3, in window); the Xerox and Fiery PHP2Shell printer estate (S1, recovered after verifier iteration 1 under PD-7 (c): an advisory for a flaw whose exploitation is in-window news, with fixes still unreleased); the Dahua Easy4IP camera takeover (S3, lookback: true from the securityaffairs 168 h record, PD-7 d); NIK C2 (S3, lookback: true from the talos 168 h record, PD-7 d, routine and short). Changelog records: Synology-SA-26:14 revisions 3 and 4 added to the QNAP/Synology PHP2Shell entry (S1); rbb24's report of the Berlin departments' own answers added to the Berlin Landesnetz entry (S4); the US military commissary freezer investigation added to the Danfoss refrigeration entry (S2).

Recency note (PD-7 against PD-11). The Berlin and Danfoss records rest on sources older than 26 h (rbb24 of 2026-10-21, surfaced inside the developing window by Born's relay of 2026-10-30; Reuters of 2026-10-29 and Nextgov of 2026-10-30). I applied the update exemption (a changelog record carrying a delta new to the store inside the 72 h developing window) to those two and held every new entry to the 26 h window, a rotational lookback, or PD-7 (c). Verifier iteration 1 (F10) flagged the dropped Xerox and Fiery bulletin as a blind spot for a public-sector reader; I accepted it and published it under PD-7 (c). The other S1 PHP2Shell vendor estates stay dropped as out-of-window with weaker constituency nexus (Siemens energy, Delta Controls, pfSense and OPNsense): the next audit may recover them.

Source tension. The Berlin entry's sourcing note said BSI "now independently confirms" TerminalFix as the Berlin vector. rbb24 (2026-10-21) says BSI does not confirm that to rbb, and BSI's advisory BITS-2026-287419-1032 never names Berlin; the link rests on heise's reading of BSI's Mastodon post. The sourcing note is corrected in the changelog record; verifier iteration 1 (F16, F17) then led me to move the entry's priority to notable (a 66-day-old single-victim event whose new section adds a governance lesson), confidence to medium and credibility to 2, because the phishing click rests on Der Tagesspiegel alone and the TerminalFix link on heise's reading of BSI.

• out-of-window: Siemens Spectrum Power, AMIS TS, Energy Engage and KACO blueplanet PHP2Shell (SSA-166980 V1.2), primary source 2026-10-29, window_hours=26; energy-utility nexus only.
• out-of-window: Delta Controls enteliWEB and V4 controllers (SecB0015 rev 3, SecB0016 rev 2), primary source 2026-10-22 and 2026-10-28, window_hours=26; no Swiss deployment established.
• out-of-window: pfSense and OPNsense PHP2Shell fixes, primary source 2026-10-21 and 2026-10-22, window_hours=26; GUI is LAN-only by default.
• out-of-window: Dell PowerProtect Data Domain DSA-2026-416, Juniper Session Smart Router and Conductor JSA112183, TianoCore EDK II CVE-2026-97631, TeamViewer TV-2026-1011, newest sources 2026-10-19 to 2026-10-30, window_hours=26; none exploited.
• borderline-drop: Canonical LXD, MicroCloud and Incus CVE-2026-112816 (CVSS 10.0 certificate-chain authentication bypass), in window (The Hacker News 2026-11-01) but PD-11 relevance doubt: the HTTPS listener is opt-in, no constituency deployment established, no exploitation; revisit on exploitation or a KEV listing.
• borderline-drop: Siemens Industrial Edge Management applications, Node2Shell (SSA-443410, 2026-10-30), industrial-edge OT niche, no constituency nexus, no exploitation against Siemens products reported.
• borderline-drop: CVE-2025-8088 ransomware-use flag on the MDaemon/ClamAV entry, metadata only; CISA's flag is undated and attached to the WinRAR record, and it changes no decision on the covered mail-server path.
• borderline-drop: BSI tells German MPs and ministers to assume their iPhones are compromised (ARD, heise, 2026-11-01), incident floor: no vector, actor or behavior, no Swiss case; revisit if a Swiss authority or Apple notices reach Swiss officials.
• borderline-drop: Ukraine's Air Alert app pushing false radiation and chemical alerts (BBC, Fox News, BNO, 2026-11-01), no Swiss nexus, analogy to civil-protection alerting only, no vector.
• borderline-drop: WIRED's report of a contractor's AI coding agent on a DoD NIPRNet environment (2026-10-29), single anonymous source contested by Accenture, low confidence.
• borderline-drop: Talos VOLTA infostealer (2026-10-31), a distinct finding from NIK C2 (separate entry under item granularity), commodity crimeware with no sector, actor or vector; the LLM-API egress detection concept is carried by the NIK C2 entry.
• out-of-window: ARTEX thread delta, Microsoft on DPRK Onyx Sleet and Pearl Sleet using ARTEX (2026-10-29) and CrowdStrike's gated report on four agentic actors (2026-10-30), older than the 72 h developing window, CrowdStrike detail gated; the audit may fold the DPRK sentence into the ARTEX entry.
• borderline-drop: Swiss municipal forum claims (ChimeraZ selling data attributed to ebikon.ch, gersau.ch, meggen.ch, stadtwil.ch and davos.ch), FBI attribution of the Binance theft to TraderTraitor, Chainalysis breach, Universität Leipzig outage, French communes Cholet and Verrières-en-Forez, Holcim claim, Alpine Linux GitLab attempt, Ruag tank-fraud inquiry, per S4: PD-6 not cleared (single tracker relaying a forum advert, sample looks public), incident floor, not new, or not a cyber incident.
• Single-source: 2026-11-02/android-sms-of-death-wap-push-telephony-crash; the researcher is the origin; BleepingComputer and Security Affairs restate it; which release carries Google's fix rests on the researcher's word. BleepingComputer's CVE-2026-58882 does not resolve (MITRE CVE API: record does not exist), so cves[] is empty.
• Single-source: 2026-11-02/dahua-easy4ip-p2p-cloud-camera-takeover-cert-ua; CERT-UA's alert page is script-rendered; verifier iteration 3 read it through the reader and the entry now cites it as primary (its text carries no date, 2026-10-23 is Security Affairs' dating), with The Hacker News, Security Affairs and eSecurity Planet restating it (one assessor, four publishers). Dahua's 2021 advisory read directly for CVSS 8.1 and the per-model fixed builds.
• Single-source: 2026-11-02/xerox-fiery-php2shell-printers-fixes-due-6-to-23-november, Xerox's own bulletin XRX26-016 (version 4), read through the PDF reader; CISA KEV listing read from the catalog (version 2026.10.30), which covers the PHP runtime and not these devices.
• Single-source: 2026-11-02/nik-c2-go-implant-sends-prompts-to-openai-from-victim-host, Cisco Talos only; Infosecurity Magazine restates it. S3's suggested link to CAIRN and CLOSEDQUORUM was left out because the Talos post does not state it.
• Backlog: ARX Group SA (Aurora leak-site claim, row surfaced 2026-10-24), held, state unchanged: S4 re-checked on 2026-11-02 (ransomware.live press: null, no victim statement, no Swiss press in DE, FR, IT or EN, name clash with an unrelated thermal-management company noted); hold condition unmet, expiry 2026-11-07, nothing appended to the row.
• Candidate sources added: rbb24-recherche, xerox-security-bulletins. Left for a later fire: onyphe-blog, signalandsilence-substack, varonis-threat-labs, delta-controls-security (each flagged by one sub-agent; recipes verified only for varonis and the two Delta and Xerox pages).
• Recipe changes from sub-agent findings: securityaffairs rss_url pinned (paged feed), resecurity moved to the bridge, notes appended for lumen-black-lotus-labs, cnil-fr, ncsc-nl-php2shell-tracker, ico-uk and ec-digital-strategy-newsroom.
• Pre-existing history noted, not touched: the Danfoss entry's main analysis (about 1,290 words) and the Berlin entry's (about 710 words) exceed the 550-word bound; this fire's records did not grow either analysis, and trimming them is audit work.

Coverage gaps: ico-uk (every transport 403, host outage as on 2026-11-01); connectwise-trust-center (403 on every transport, status page read, no security item); ox-security (feed parses, every article body 403); databreaches-net (site catching up after its own outage, newest post 2026-10-29); F5 K000163821, Check Point sk1000302, the Fiery Communities article and Juniper's support portal (script-only pages, revision stamps not comparable with covered entries).

Verification: six iterations of the single cti-verification definition, confirmed CLEAN at iterations 5 and 6 (two consecutive independent cold passes, each covering all 155 claims), final residual 0. Iterations 1 to 4 returned NEEDS_FIXES with 9, 5, 3 and 4 truth findings and 7, 1, 2 and 1 editorial findings; iteration 1 produced the Xerox and Fiery entry (F10), a Berlin recalibration (priority notable, confidence medium, credibility 2) and a corrected Berlin sourcing note, and iteration 3 turned CERT-UA's own page into the Dahua entry's primary source. Two iterations (4 and the Triage hedge before it) caught defects my own fixes introduced. Declined: the Danfoss update-versus-new suggestion (the section states the only stated link to the US commissary case is the investigators' contact; regions and sectors untouched) and the Dahua carve-out host remark (cip.gov.ua is now in NATIONAL_CERT_HOSTS, with the tool tests passing). Left as pre-existing: em dashes and a few "this entry" cross-references in the older Berlin sections, and Berlin's T1567.002 (BSI's TerminalFix-general sentence); the next audit may take them.