2026-11-04T0256Z-intel

Verification & coverage notes

Coverage window: standard (gap 24.0 h, previous run 2026-11-03T0256Z-intel; window 26 h; the 24.003 h gap is daily-cadence jitter, not an outage, so no outage-backfill sweep). Four new entries and six changelog records (5 update, 1 improvement); no deep dive (no candidate met the bar), no critical. The four new entries are Barracuda ESG (CVE-2026-116606 and CVE-2026-111560, notable), the cPGuard update-channel compromise (notable), Binance's own account of the 2026-10-29 theft (notable) and the 3AM affiliate intrusion into a UK school estate (notable).

Changelog records. update: CISA's KEV listing of CVE-2026-119977 on the WordPress core entry (the mechanical sweep's one COVERED-STALE row; priority notable to high); Cisco's re-release of the 15.5.5-014 fix and revision 1.2 on the Secure Email Gateway entry (critical stays; the exploit-code statement is Cisco's alone, and the pre-existing KEV-deadline wording in that entry was removed under the zero-warning rule, with immediate_action declared on the record); the arrest of a 16-year-old pupil on the Vaud school entry; the German cases, SentinelLABS' "responsibility not established" assessment and Le Canard enchaîné's blood-service cold-room report on the refrigeration entry (main analysis 737 words before and 736 after, so no growth; the entry stays over the 550 bound and is a candidate for the audit's trim); PKZH's suspended migration, PK Softech's non-pseudonymised-data statement and the Federal Prosecutor's addition of the case to its Akira proceeding on the Publica entry (the analysis is 1,148 words after 1,158, so it was not grown, the superseded PKZH sentence was rewritten in place). improvement (no float): CVE-2026-118527's CNA record and CERT-FR's confirmation that Ivanti calls all three chain flaws exploited, on the Ivanti Connect Secure entry.

KEV disposition. CVE-2026-119977 (COVERED-STALE) shipped as the update above; no RANSOMWARE rows and no NOT COVERED or MENTION-ONLY rows. Backlog. ARX Group SA / Aurora and the ChimeraZ commune claims were re-checked by S2 and S4: no victim, client, regulator or Swiss-press confirmation, so both stay held under their stated conditions (expiry 2026-11-07 and 2026-11-17) and no note was appended.

Source tension. Barracuda's Campus page names firmware 9.4.0.029 as the gateway fix while the CVE record lists builds before 9.4.0.030 as affected; the entry states both and resolves neither, and the mechanism and the per-product affected ranges come from Mandiant's per-vulnerability disclosures (the EUVD record returned an application-unavailable page). The vendor table calls CVE-2026-116606 pre-authentication while listing administrative access as the requirement, as NCSC Switzerland points out. cPGuard's earlier advisory estimate (32 retrieved files) and the spokesperson's 2,946 servers are kept only in the sourcing note, superseded by the vendor's later disclosure (about 2,950 servers and about 7,900 billing-portal accounts). The blood-service report rests on one weekly (Le Canard enchaîné); the 110 degrees is a programmed set-point. A composed BSI/Apple mercenary-spyware entry was withdrawn before the gate to match the 2026-11-03 incident-floor drop (see below).

• borderline-drop: Control Web Panel CWP2Shell (ten VulnCheck CVEs, unauth chain to root, fixed 1.29), no constituency nexus established, no exploitation, niche hosting panel; marginal niche disclosure
• borderline-drop: HPE Networking Fabric Composer HPESBNW05172 (46 CVEs, three 9.6-9.8), fix in regular cycle, no exploitation, no exposure-driven urgency, no constituency nexus
• borderline-drop: Zyxel GS1900 CVE-2026-107441 and AP/FWA7 CVE-2026-76955, LAN-adjacent only (AV:A), no exploitation; regular patch cycle
• borderline-drop: Kaspersky CyberStrikeAI (LLM orchestrator on the C2, education sector in Africa and Latin America), published 2026-11-02 08:00Z, outside the window; no constituency nexus; LLM-operated intrusion already covered (ARTEX, VAPOR PANDA, the 3AM entry)
• borderline-drop: CERT-EU AI-agent harness backdoor lab experiment, lab experiment, no in-the-wild use; the in-the-wild analogue (Cursor marketplace extension) is covered
• borderline-drop: GTIG/Mandiant LLMjacking, stolen cloud tokens drive fraudulent LLM spend, no constituency nexus; generic cloud-identity detection; unresolved CVE-2026-40217 mapping
• borderline-drop: GTIG XCPE Android set-top-box botnet takedown, consumer/IoT residential-proxy botnet, no constituency nexus, no new decision for a SOC
• borderline-drop: ESET APT Activity Report Q2-Q3 2026 (PD-9 periodic report), periodic recap; highly relevant findings already covered (UAC-0099/Sandworm entry); no Swiss-public-sector nexus; only the summary page read
• borderline-drop: ESET Gorbag (Ukraine law-enforcement/defence targets), Ukraine-only victims, WinRAR CVE-2025-8088 already covered
• borderline-drop: Team Cymru Cl0p second edition, planning-grade pattern recap of covered campaigns (first published 12 Aug, updated October), no new finding
• borderline-drop: Check Point prompt adware (Codex jailbreak bundle), dual-use adware-style bundle, no constituency nexus
• borderline-drop: WorkOS internal sales-app breach (ARTEX named by founder), CRM/support data only, no access path stated, no constituency nexus; ARTEX is already tracked
• borderline-drop: Holcim confirms data theft, Emperador claim (~360 GB), incident floor: no access vector, actor behaviour or transferable lesson beyond the impact; private company
• borderline-drop: Ukraine and Russia emergency-alert apps hacked (false nuclear warnings), already dropped on 2026-11-03; no vector, AP primary not read; no new fact in window
• borderline-drop: Swiss GitLab exposure count (Inside IT relaying Shadowserver: 48 instances on CVE-2026-110264, 8 also on CVE-2026-97229), single secondary source, exposure count changes no action on an entry that already tells reader to patch now
• borderline-drop: SiK-N motion 26.4717 (digital dependencies in procurement), a submitted parliamentary motion, no obligation or deadline for the constituency
• borderline-drop: Federal Council transitional authorisation model for e-evidence to EU authorities, obligation concerns Swiss providers' legal handover, no defender-side consequence for the constituency
• borderline-drop: BACS week 44 review (Plex and home-network compromises), private home networks, no public-sector nexus; Plex2Shell KEV date rests on search snippets
• borderline-drop: Vaud CYBER26 crisis exercise 2026-11-12, an exercise invitation, not threat intelligence
• borderline-drop: Zimperium Coruna/DarkSword chains by iOS version (update-of DeadTag), no change to the patch decision, the entry already tells readers to update iOS
• borderline-drop: Android November bulletin (Framework RCE CVE-2026-58868 Critical), Chrome 157, Dell DSA-2026-416, Juniper JSA112183, Canonical LXD CVE-2026-112816, no exploitation reported or outside the window; regular patch cycle
• borderline-drop: Amadeus breach, hold condition (Swiss or European carrier confirmation) unmet
• borderline-drop: BSI: Apple mercenary-spyware threat notifications to Bundestag and government members (Apple: 99 countries), dropped on 2026-11-03 under the incident floor and nothing materially new in window beyond Apple's reach statement: no vector, actor or behaviour is public and no ATT&CK id is evidence-bound; the BSI guidance is individual-device hygiene and no source states a Swiss recipient or Swiss authority statement (composed as an entry in this fire, then withdrawn before the gate to stay consistent with the incident floor)

Source health: 291 probed; 287 relevant, 1 stale, 3 unreadable, every non-relevant record already handled (action breakdown 291 none), so no repair order was open. One new candidate, cert-eu-blog (S3: CERT-EU's own research blog outside the cert-eu advisories record); recipe notes added for zimperium-zlabs (working RSS feed set), bitdefender-threat-debrief, kaspersky-securelist, sentinellabs and nau-ch. extract fell back to the metered reader for the EUVD, CISA alert, Binance, FBI, SentinelLABS and Le Canard enchaîné pages in the deep read (eight reader calls: the three EUVD records, the CISA alert, Binance, FBI, SentinelLABS and Le Canard enchaîné); no WebFetch was needed by the main agent. The rotation ranked on the cursor (recent_attempts exclusion count 0, the cursor already spreads the pool).

Coverage gaps: ico-uk (403 on every transport, fourth run), connectwise-trust-center (403 on every transport; status page read), sygnia (blocked), rapid7-research (feed not well-formed, outside the slice), lab52 (SSL EOF, outside the slice), ox-security (feed lists dated items, bodies 403, lead-only), edoeb-ch-press (stale listing). Completeness note for the next audit: the 14-day prior-coverage index was loaded in full for its first 40 records and as an id/headline/CVE/entity/last-development projection for the remaining 47 to keep the main context compositional (the sub-agents read the whole file).

Operator note: an early command of this fire used a stale run id and overwrote three tracked files in work/2026-W26-b78503e7/ (prior_coverage.json, prior_coverage_keys.json, state-summary.json) in the working tree; they are not staged and are not part of this commit (restore with git checkout -- work/2026-W26-b78503e7/).

Verification. Eight iterations. Iteration 1 returned NEEDS_FIXES (22 findings, two truth-class rewrites: the cPGuard entry was rebuilt around the vendor's fuller 2026-11-03 disclosure, and the Barracuda entry around Mandiant's per-vulnerability records); iterations 2 to 6 closed the remaining truth findings (the iteration-2 spawn was lost to a container restart and respawned with the same scope; iteration 3 left 18 claims unanswered and was followed by a pass that covered them); iteration 7 returned CLEAN and the cold, full-scope confirmation pass of iteration 8 (231 of 231 claims) returned CLEAN, so the entries publish on a confirmed double-CLEAN with no residual truth or editorial finding. The advisory items left open, all low confidence: four Bitdefender-mapped technique ids unmapped on the 3AM entry, "five further internally-found vulnerabilities" counting CVE ids on the Cisco entry, Cisco's "proactively contacted" wording, the Wordfence Intelligence citation date on the WordPress entry, the 57-case figure's victim-statistic character on the Binance entry, and the attribution of the mechanism sentence in the Barracuda summary. Improvements noticed and not needed this fire, for the next audit: the refrigeration (736 words) and Publica (1,148 words) analyses are far over the 550-word bound and want a trim; a quality-audit pass could add OPSSHIELD to sources/sources.json.

Gate note: the one remaining source-urls warning is the two Mandiant disclosure pages on github.com answering 403 to the gate's own link check (a UA filter); the main agent and the verifier read both through extract and the raw files.