2026-11-05T0255Z-intel

Verification & coverage notes

• Coverage window: standard, 26 h (previous intel run 2026-11-04T0256Z-intel, gap 24.0 h); no outage backfill. Source rotation ranked on the cursor; the previous two fires' attempts excluded 27 (S1), 31 (S2) and 37 (S3) standard records, and the exclusion was waived for S4 because all 14 breach-domain sources had been attempted by those fires.
• The entity registry (704 KB) was grepped by key and alias, not read whole; the 14-day coverage index, the state digest and the taxonomy were read in full. S5 intake: no closed-source drops.
• Backlog: the ARX Group SA row stays held (S4 re-checked the ransomware.live record, a breach tracker, the ARX site, German and Italian searches and the Inside IT, Netzwoche and SRF feeds: no confirmation; expiry 2026-11-07 unchanged). The ChimeraZ row stays held (no commune, canton, zone or Swiss press confirmation; FrenchBreaches still calls the hack unconfirmed; expiry 2026-11-17 unchanged). Neither row changed state, so nothing is appended to them. The Amadeus hold of 2026-11-04 stays dropped (six Asian carriers, no European confirmation).
• KEV sweep (work/2026-11-05T0255Z-intel/kev-window.txt): one addition in the window, CVE-2024-27834, NOT COVERED, published as the new entry on the Sekoia APT29-linked watering hole. No RANSOMWARE row for a covered CVE appeared in the window. S1's diff against the 2026-07-29 snapshot found 26 older flips; the one that touches covered ground, CVE-2025-8088 (WinRAR, ClamAV's bundled UnRAR), is a borderline-drop below.
• borderline-drop: S2-2 Federal Supreme Court blocking ruling: no obligation change for defenders
• borderline-drop: S2-3 EFK audit of BACS reporting platform: oversight, no change to reporting obligation
• borderline-drop: S2-4 Eye-Able supplier incident: no public-sector customer shown, no vector
• borderline-drop: S2-5/S4-2 Holcim + Emperador: private multinational, no vector or TTP (incident floor)
• borderline-drop: S2-6 SiK-N motion 26.4717: filing-stage motion, no obligation
• borderline-drop: S3-1 BSI/Apple threat notifications: out-of-window (BSI 2026-11-02, heise 2026-11-03), no Swiss recipient reported
• borderline-drop: S3-2 Trellix CyberThreat Report: vendor telemetry and leak-site counts, no new defender decision
• borderline-drop: S3-5/S4-3 AI platform credential-theft wave (WorkOS, Chainstack, Wiz, CSA, Mandiant LLMjacking): no constituency victim, platform-by-platform root causes
• borderline-drop: S3-6 Elastic threats etc report: landing page only readable, claims not verifiable
• borderline-drop: S3-7 Report URI Polymarket/DebugBear: crypto platform, out-of-nexus, generic SRI/CSP lesson (lookback, dated 2026-10-30)
• borderline-drop: S3-8 DHS Acronis order: US measure, no Swiss or EU obligation, dated 2026-10-30
• borderline-drop: S3-9 Calif.io Lockdown Mode bypass: video only, no technical detail or second source
• borderline-drop: S1-4 Xen XSA-523: guest-to-host needs prior guest compromise, no exploitation, normal patch cycle
• borderline-drop: S1-5 APT CVE-2026-109518: needs on-path attacker or malicious mirror, no exploitation, normal patch cycle
• borderline-drop: S1-6 HPE Fabric Composer HPESBNW05172: internal-management niche product, fixed, no exploitation
• borderline-drop: S1-7 WatchGuard AuthPoint Gateway: availability and replay impacts, no RCE, no exploitation
• borderline-drop: S1-12 Rails Active Storage CVE-2026-122006: three exposure conditions, no exploitation
• borderline-drop: S1-13 NoMachine CVE-2026-114549: ZDI disclosure of 2026-10-22, fixed since July/October, no exploitation
• borderline-drop: S1-14 Quest Foglight for Databases: ZDI sole source, no vendor advisory read, niche
• borderline-drop: S1-15 Android November bulletin: published 2026-11-02, no exploitation noted, monthly cycle
• borderline-drop: S4-1 Solnet webmail logs: single outlet, unnamed flaw, no public-sector customer shown (incident floor)
• borderline-drop: S4-4 Japan MOFA: primary dated 2026-10-30, outside window
• borderline-drop: S4-5 Credit Mutuel Arkea: financial sector, single outlet, no constituency nexus
• borderline-drop: S4-6 Iceland Inna school system: single secondary source, early-stage, no Swiss link
• borderline-drop: Amadeus booking-display compromise: Asian carriers only, no European confirmation
• borderline-drop: Chrome 157/Edge 213 fixes none exploited; Dameware, GLPI, ManageEngine, Dell, StorageGRID, WSO2 etc: normal patch cycle (S1 drops)
• borderline-drop: CVE-2025-8088 ransomware flag, the KEV record reads Known in catalog 2026.08.07 and Unknown in 2026.07.29 (FU4 bracketed the flip from committed snapshots), so it is not a development of this window; CISA names no group, and no source names a ransomware actor using the flaw. Four store entries cite the CVE and none mentions ransomware; the 2026-10-29 MDaemon and ClamAV entry is the natural home if the audit judges it worth a line. FU4 also found two older defects for the audit: the 2026-06-02 Sekoia/Gamaredon entry dates the WinRAR 7.13 fix to "August 2025" while ESET says 2025-07-30, and the 2026-06-27 Turla STOCKSTAY entry says "Patch WinRAR to 7.11+" while ESET names 7.13 as the fix.
• Single-source and carve-outs: the Vaud device-code notice (single-source, first-party cantonal authority, no corroboration found in nine German and French searches and the NCSC.ch hub); SEPPmail (single-source: NCSC.ch is the CNA and the vendor page describes the same flaws, one assessor); the APT29-linked watering hole (single-source Sekoia; The Hacker News and BleepingComputer relay it); the Windows iSCSI Target Server research (single-source SpecterOps, Pen Test Partners 2016 only for the port); Sophos RCA INC-2026-002 (single-source-victim); SonicWall GMS (single-source vendor, CERT-FR relays it).
• Contradictions disclosed in the entries and not resolved: Zyxel calls the attacker LAN-based while Binarly and BleepingComputer say network access suffices, and Binarly, with BleepingComputer repeating it, calls CVE-2026-107441 an exploited zero-day on the strength of the exploit match while Zyxel and CISA do not connect the activity to it; Vates, XCP-ng and WatchGuard say a public exploit exists or circulates while Akamai knows of none and the MPTCP exploit does not run on XCP-ng or Fireware OS; SEPPmail's vendor page lists the CVSS scores of CVE-2026-114420 and CVE-2026-114421 the wrong way round against the NCSC.ch CNA records.
• Advisory items left for the next quality audit (low-confidence F11, each marked may-be-left by the verifier): the Vaud wording of the notice's company placeholder, the CloudLinux and AWS date labels on the kernel entry, the iSCSI sourcing note's Pen Test Partners remark, the APT29 CVE-2025-43529 fixed-field wording, the kernel sourcing-note capital, the SEPPmail 'two are unauthenticated' phrasing and the four vendor tasks bundled in Node2Shell actions[1].
• Reduced confidence: none. Entries whose primary needed a non-default transport: the Binarly pages (rendered from the page payload), the SonicWall PSIRT tables (reader, html mode) and the Sophos RCA analysis sections (raw page; extract truncates them), so a verifier reading them with extract will not see those passages.
• Deep read: the will-publish set was 12 items (6 new, 6 changelog records), above the eight the prompt names, so the deep read ran as four scoped cti-research follow-ups (FU1 to FU4) after Phase 1 returned; the main agent composed from their claim tables. One follow-up (FU2) reports a classifier stop on its first write of the SpecterOps attack steps and rebuilt the item at awareness level, which is the level the entry keeps.
• One planned changelog record was dropped after the deep read (CVE-2025-8088, above), leaving 5 updates: Danfoss (update), Zyxel GS1900 (update), CVE-2026-98432 (update), Node2Shell/Splunk (update) and the Xerox PHP2Shell entry (update: bulletin v5 of 2026-11-03 is a post-publication development, so it floats).
• Entry rewrites replaced text instead of adding it: the Danfoss (736 to 735 words), Node2Shell (549 to 539), CVE-2026-98432 (546 to 546) and Zyxel (641 to 613) analyses did not grow.
• Sources: three new candidates (seppmail-gateway-revision-history, enisa-cnw, binarly-blog), each with its reason in sources_changed[]; cert-eu-blog promoted to active on the digest's promotion_due (10 contributing runs); recipe notes appended for ox-security, sekoia, cisa-advisories, sonicwall-psirt, xerox-security-bulletins, fuitesinfos, netzwoche, cyberinsider, bitdefender-threat-debrief, ransomware-live and trellix. The CISA recipe note records that WebFetch returned 403 on every cisa.gov HTML path today, so the 2026-10-21 and 2026-10-23 notes that WebFetch reads the listing no longer hold.
• Coverage gaps: ico-uk (403 on every transport, WebSearch found nothing in the window); connectwise-trust-center (403, status page substituted); cisa-advisories HTML pages (403; cisa-kev and cisa csaf-recent worked and WebSearch found no AA-series advisory); ibm-support-security-bulletins (not attempted, no listing transport; a relay sweep through BSI found only a QRadar XSS and a WebSphere DoS); Inside IT body (paywalled, in the page's embedded data); cyber.gouv.fr RSS (XML parse failure); securityweek and therecord feeds too short for the 168 h lookback; crowdstrike feed carries product news only; Rapid7 feed unparseable.