2026-11-06T0255Z-intel

Verification & coverage notes

• Coverage window: standard, 26 h (previous intel run 2026-11-05T0255Z-intel, gap 24.0 h); no outage backfill. Source rotation ranked on the cursor; the previous two fires' attempts excluded 108 standard records in total (24 for S1, 25 for S2, 40 for S3, 19 for S4). The exclusion was relaxed for S4 because 19 of the 21 breach-domain sources had been attempted by those fires (10 of its 12 slice records came from the excluded set), and sygnia, the oldest cursor in S3's pool and a failed fetch on 2026-11-04, was added to S3's slice explicitly.
• The 14-day coverage index (90 records: the first 18 in full, the rest as id, title, summary and last development per record, because the full file overflows one Read) and the state digest were read; the entity registry was grepped by key and alias, not read whole. S5 intake: no closed-source drops (intel/ holds only its README).
• Backlog: ARX Group SA stays held (S4 re-checked: ransomware.live still shows the Aurora claim with no press link, German, French and English searches and the Swiss feeds carry nothing; expiry 2026-11-07 unchanged, so the next fire strikes the row unless a confirmation appears). ChimeraZ stays held (no commune, canton, zone or Swiss press confirmation; the FrenchBreaches alert is unchanged; expiry 2026-11-17 unchanged). Neither row changed state, so nothing is appended to them.
• KEV sweep (work/2026-11-06T0255Z-intel/kev-window.txt): no addition in the window. S1 confirmed the feed is live (catalog 2026.11.04, newest dateAdded 2026-11-04, CVE-2024-27834, already covered) and the CISA alerts listing shows no 2026-11-05 alert, and found no ransomware-flag flip for a covered CVE.
• Scheduled releases: none of Microsoft, Fortinet, SAP, Adobe or Oracle landed in the window (next cycle 2026-11-10). S1 also checked Chrome 157, the Cisco trio of 2026-11-04, the MSRC revised-CVE list and Firefox 159.0.1: nothing exploited or at CVSS 9.0 and above. Revised advisories checked without a record: Xerox XRX26-016 (still revision 5 of 2026-11-03, fixes due 2026-11-06), Cisco ESA revision 1.2, Ivanti, Zyxel, SonicWall SMA1000, Citrix XenServer, WatchGuard, Trend Micro KA-0024802 and Ubuntu's tracker for CVE-2026-98432.
• Published: six new entries (OpenSSH CVE-2026-123158; FreeSWITCH CVE-2026-116779; Kaspersky's Storm-2603 fileless SharePoint intrusion; the Entra application-credential campaign from Microsoft and Todyl; Microsoft's Q3 email report; Seqrite's Qilin October build) and two changelog records (Barracuda ESG, priority notable to high after watchTowr's public unauthenticated chain; the refrigeration incident, first Swiss cases and the joint CISA, FBI, HHS, USDA and DOT fact sheet).
• Single-source: FreeSWITCH CVE-2026-116779 rests on the vendor advisory alone for the exploitation claim, the score and the affected range (BSI relays it); the GHSA page dates itself 2026-10-28 and BSI relayed it on 2026-11-05 (BSI's CSAF dates its release 2026-11-04T23:00Z, 1 h 55 min before this window opens, while the portal carried it on 2026-11-05); the store had never covered it, so it ships on the in-window relay with event_date 2026-10-28. The Kaspersky Storm-2603 entry, the Qilin entry and the Microsoft Q3 report are single-source by nature (their publishers alone).
• Merged item: Todyl's campaign (S4-2, dated 2026-11-03, about 26 hours before the window opens) and S3-1's Microsoft report on ARTEX secret hunting (2026-11-05) were published as one new entry anchored on Microsoft's in-window post, with Todyl as corroboration and references to the ARTEX and ConnectWise entries; Todyl treats its operator as separate and unattributed, so an update on the ARTEX entry would have mis-stated the link. The S1, S2 and S4 refrigeration items were folded into one update record.
• Contradiction: Microsoft and Todyl differ on where the stolen application secrets came from (GitHub search against Todyl's seed secrets that point to a file store or live backend); the entry carries both with attribution. The Barracuda record's earlier "administrative interface" framing is superseded by watchTowr's reproduction (no account needed); Barracuda itself changed CVE-2026-116606's authentication field to not required on 2026-11-05, and CVE-2026-111560 stays admin-required.
• Included with a stated gate: the Microsoft Q3 email report clears PD-11(a) on the override audit (precedent: the Q2 entry); the Qilin entry clears PD-11(d) on vCenter and Safe Mode hunt hooks, with a rotational-lookback sighting (Seqrite, 2026-11-03, seqrite-labs slice) rather than an in-window one.
• borderline-drop: S1-3/S3-9 APT CVE-2026-109518: needs an on-path attacker or a malicious mirror, no exploitation, normal patch cycle
• borderline-drop: S1-4 Apache OFBiz 24.09.08 (46 CVEs, three unauthenticated RCEs): no scores, no exploitation, no Swiss public-sector exposure shown; a flagged lead for the audit
• borderline-drop: S1-5 zlib 1.4 memory-safety fixes: library awareness, no exploitation
• borderline-drop: S1-8 WordPress core exploit-attempt volume (Wordfence): volume only, no material delta on the covered entry
• borderline-drop: S1-9 Android Security Bulletin November 2026 (CVE-2026-58868): monthly cycle, NCSC-NL says no exploitation known
• borderline-drop: S2-2 EFK audit of the BACS reporting platform: oversight report, no change to reporting obligations or to what defenders do
• borderline-drop: S2-4 DHS FASCSA order on Acronis: US procurement measure, no vulnerability, compromise or Swiss obligation, dated 2026-10-30
• borderline-drop: S2-5 Federal Supreme Court ruling on prosecutor-ordered DNS blocking: legal-procedure item, no defender decision
• borderline-drop: S3-2 trojanised ARTEX Docker image (Badbyte, The Hacker News repeats it): single-source, an offensive-tool image, marginal to this constituency
• borderline-drop: S3-5 CrowdStrike PoC-to-exploitation timeline: vendor statistics and a rehash of the covered CrowdStrike hunting-report entry
• borderline-drop: S3-6 Microsoft on-premises security initiative: a roadmap with future-dated plans, no vulnerability or campaign
• borderline-drop: S3-7 Symantec Anubis and Backdoor.Lindnor: US victim, no vector, no constituency nexus (the hunt hooks do not outweigh the incident floor)
• borderline-drop: S3-10 Imperva PSK Agent on StyleSmuggler: third operator on a covered flaw, improvement-level, no new defender decision
• borderline-drop: S3-11 residential proxy exits on government networks (Layer3 Intel, Krebs): awareness item with a weak ATT&CK mapping
• borderline-drop: S3-12 CERT-AGID MCP-triggered LoRA backdoor: laboratory proof of concept, not observed in the wild, dated 2026-11-04
• borderline-drop: S4-3 Mittwald MCP-server incident: single-source victim disclosure, no Swiss customer shown, access route unknown
• borderline-drop: S4-4 DigiCert archived validation-data access: no certificate operations affected, no Swiss public-sector nexus
• borderline-drop: S4 and S2 incident leads (Holcim, Solnet, Eye-Able, Iperius, DreamHost, NSW Health, German municipal cases, CNIL items, Swiss Ransomware.live claims Labatec, HighTec, Erowa): each dropped on the incident floor or for no constituency nexus; reasons are in findings.S2.yaml and findings.S4.yaml
• borderline-drop: S1 considered-and-dropped (Sonatype Nexus privileged-user flaws, Apache ActiveMQ DoS rows, Firefox 159.0.1, Mitsubishi CC-Link IE TSN republication, Gogs, Linksys E5600, kaniko): reasons in findings.S1.yaml
• Coverage gaps: ico-uk (blocked on every transport; two WebSearch queries found no in-window ICO notice); connectwise-trust-center (403, status page read, nothing relevant); previdian (feed 403); sygnia (blocked, reader chain failed); proofpoint (feed's newest item 2026-10-14 and the listing unreadable, possibly stale); hackernews (the 2026-10-30 to 10-31 lookback edge was not swept); BSI portal and OX Security pages cited from the CSAF JSON and the full-text feed because the pages themselves were not fetched in-container.
• Audit leads (outside the window, not shipped): IBM MQ CVE-2026-10747 (unauthenticated heap overflow, CVSS 10, bulletin 2026-09-14) is in no store entry; the Next.js unauthenticated RCEs GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr (patched 15.5.28 and 16.4.1, 2026-10-22) are in no store entry; Drupal contrib SA-CONTRIB-2026-293 to -298 (BSI WID-SEC-2026-4352, 23 CVEs) was not drilled to per-CVE severity and Drupal is common in Swiss public web estates; the ESET APT Activity Report Q2 to Q3 2026 (2026-10-28) has no dedicated entry (the 2026-10-29 MDaemon and ClamAV entry cites it for one finding); the Cisco ESA entry and the PHP2Shell vendor notices need no action.
• Source lifecycle: enisa-cnw and specterops promoted to active (promotion_due); oss-security and cert-agid added as candidates; recipe notes appended for ox-security, theregister-security-feed, msft-ti, malware-news, inside-it-ch, srf-news, swissinfo-ger, cisa-advisories, chrome-releases and bsi-de. Candidate leads not registered (one post each, unproven): Badbyte, Layer3 Intel.
• Gate: the one WARN left (source-urls) is the OX Security blog page answering 403 to the check's transport; the page was read through its full-text feed, as the entry's sourcing note says. The harness's stop hook fired several times mid-run asking for a commit; the run held the single atomic commit after the gate and the verifier loop, as the prompt requires. The first slice build excluded recent attempts so strictly that S4 would have had two sources; it was regenerated with the relaxation above before any spawn.
• Verifier loop: six iterations of one cold-reader definition. Iterations 1 to 4 returned NEEDS_FIXES (truth 9, 7, 2, 1; every finding remediated or recorded as a declined advisory); iteration 5 returned CLEAN and the independent cold confirmation pass, iteration 6, returned CLEAN over all 159 claims, so the publish gate is a confirmed CLEAN. The headline catches: Barracuda changed its own advisory on 2026-11-05 (authentication not required for CVE-2026-116606), which the update now carries; a Restart Manager claim in the Qilin entry that Seqrite's detail section contradicted; and a 9.4.0.030 build no page names, replaced by Barracuda Campus's 9.4.0.029.
• Advisories left unchanged (optional, non-blocking): the long Danfoss title and summary; the Q3 email body points and a sourcing-note sentence about omitted totals; the Storm-2603 note's team wording; the ConnectWise incident key on the Entra entry; Alpine's own advisory as an additional OpenSSH source (OX Security carries the same table).