2026-11-07T0256Z-intel

Verification & coverage notes

Standard 24.0 h gap, 26 h window; seven new entries and six changelog records. No deep dive and no critical today: nothing met the stop-and-act bar. The will-publish set exceeded eight items, so the Phase 4 deep read of the 18 primaries was delegated to three scoped cti-research follow-ups (FU1 to FU3, labelled DR1 to DR3 in their work files) that saved every body under work/2026-11-07T0256Z-intel/bodies/; the claim tables they returned were literal-substring verified by those agents, and the main agent composed from them.

• KEV sweep: kev_window_diff.py listed one addition in the window, CVE-2026-19868 (SonicWall SonicOS SSLVPN), NOT COVERED; published as 2026-11-07/cve-2026-19868-sonicwall-sonicos-sslvpn-saml-mfa-bypass-kev. S1 confirmed with the catalogue (2026.11.06) that nothing else was added; no RANSOMWARE rows. Cross-check of the catalogue against the store since 2026-08-15 found the four Plex Media Server CVEs and SiteGuard CVE-2026-106931, both previously dropped (below), and four old CVEs added on 2026-08-26 (CVE-2015-3246, CVE-2015-5287, CVE-2022-0995, CVE-2019-1068) that S1 lists as absent from the CVE index and that the 2026-08-30 audit covers in prose.
• Backlog rows: ARX Group SA (Aurora leak-site claim) struck, unconfirmed at its 2026-11-07 expiry after DE/FR/IT/EN searches. ChimeraZ row: Ebikon, Gersau, Meggen and Wil struck as a non-incident (their provider found only public Open Government Data content), Solnet and Destination Davos Klosters struck below the incident floor (confirmed data, no stated access route), the Belgian rescue zone Hainaut-Est held to its 2026-11-17 expiry.
• Updates and what each moved: danfoss refrigeration entry (NCSC Switzerland edit of 2026-11-06, Ransom-ISAC controller log, Unit 42 exposure counts), OpenSSH CVE-2026-123158 (Previdian's exploitation attempts and one honeypot compromise reported by one telemetry vendor; status poc-public, not exploited, because CISA does not list it), WordPress CVE-2026-119977 (the update that installs the fix is itself exposed; block wp-content/upgrade/ first), Cisco Secure Email Gateway (public Metasploit modules for two injections: one merged 2026-11-05 and matched at medium confidence to the exploited CVE-2026-76461, which needs URL Filtering and URL Retrospective Service enabled, and an S/MIME one believed to be CVE-2026-76443; CVE-2026-76461 gains poc-public; Cisco names no fixed 16.0 build), SIMATIC IoT2050 CVE-2026-58115 (Siemens V1.1 lists Basic, M.2 and SM beside Advanced; fix string is V4.3.4-1), ARTEX (Storm-3358 and Check Point's operator-console count).
• Single-source: 2026-11-07/bossai-ai-agent-mesh-emergency-services-data-taiwan (Acronis TRU only; reliability B, credibility 3, confidence medium; included under the emergency-services nexus, out-of-nexus gate clause (b)/(d): AI-agent TTP transferable to dispatch and records systems); 2026-11-07/kaspersky-esxi-proxmox-ransomware-monitoring-root-password (Kaspersky only; neither case states the initial access); 2026-11-07/aargau-infosiv-adopted-information-security-law-2027-01-01 (single-source: the canton's own communiqué, primary for its own legislation); 2026-11-07/tum-mytum-legacy-portal-credential-harvest-tumonline (single-source-victim: TUM's own notice, heise relays a spokesperson).
• Borderline includes and their org-relevance in one clause: TUM (public university in DACH, transferable legacy-portal credential-capture lesson, MFA held; routine), Aargau InfoSiV (cantonal public-sector governance, the standing policy watch; routine), Brotli vendor wave (Desigo CC and Mitel telephony are common in public buildings and administrations; the flaw is CISA-listed; notable), Oneconsult File System Access API research (new technique with browser-policy levers; notable).
• Contradiction handling: the ARTEX update gives Check Point's three different exposed-panel figures only as its body counts (2,557, 1,608, ten); the SonicWall exploitation wording stops at "potential exploitation" and the exploited status rests on CISA's listing, stated in the sourcing note; Cisco's hardening advisory lists CVE-2026-76443 in the injection class it says contains one exploited flaw, so the Cisco record says Rapid7's mapping is the author's belief and does not say whether the exploited injection is the one either module uses.
• borderline-drop: Plex2Shell (CVE-2026-96652/-96654/-96655/-96656) QNAP NAS compromise notice, consumer media server, no public-sector deployment shown; dropped by 2026-10-21/22 fires and 2026-10-25 audit; QNAP QTS/QuTS hero themselves not affected
• borderline-drop: Windows Paint CVE-2026-83844, not exploited, not publicly disclosed, AC:H, Exploitation Less Likely; Store-delivery blind spot is awareness-level, regular update path applies
• borderline-drop: Siemens PHP2Shell SSA-166980 V1.3 (Spectrum Power, AMIS TS, Energy Engage, blueplanet), grid/energy-utility software outside the constituency estate, no exploitation against these products
• borderline-drop: UNC6671 vishing restatement (CCCS AL26-028, eSentire), low-delta restatement of covered campaign
• borderline-drop: Citrix NetScaler CVE-2026-88771 Metasploit module, exploited zero-day already at top urgency, module changes no decision
• borderline-drop: EHRA phishing (BACS warning), generic lure aimed at companies, no transferable technique
• borderline-drop: Canonical LXD/MicroCloud CVE-2026-112816 (CVSS 4.0 10.0), needs a trusted client's public certificate and API reachability, no exploitation, regular patch cycle
• borderline-drop: Veeam Management Pack for System Center CVE-2023-22793/-107238/-107239, niche product, no exploitation, patch-cycle
• borderline-drop: cwpdoor (Control Web Panel), niche hosting panel, single vendor, spread vector unknown, no constituency exposure shown
• borderline-drop: ReliaQuest Q3 2026 ransomware report, statistics, vanity metrics
• borderline-drop: Alala Message (Japan) 81M addresses, out-of-nexus, vector unconfirmed, no transferable lesson beyond generic SaaS compromise
• borderline-drop: DigiCert validation-archive exposure, no certificate impact, no defender action
• borderline-drop: Eye-Able dashboard intrusion, single customer-mail relay by one outlet, no vector, no code-integrity impact stated
• borderline-drop: Solnet and Destination Davos Klosters confirmations (ChimeraZ), confirmed but no vector (a gap), incident floor; the four communes denied intrusion (public OGD content); ZOHE unconfirmed
• borderline-drop: Holcim/Emperador, Gleis D Chur/Cloak, Myriad Genetics 8-K, Maileva, French public-service claims, Swiss leak-site claims (Erowa, Labatec, HighTec), impact-only or unconfirmed; incident floor / PD-6
• borderline-drop: Dameware CVE-2026-28336, authenticated, no exploitation
• borderline-drop: Apache OFBiz 24.09.08, Rails Active Storage, Xen XSA-523, APT CVE-2026-109518, HPE Fabric Composer, Chrome 157, Next.js Nov release, Entra CVE-2026-109469, previously dropped or no customer action, no new development
• borderline-drop: SiteGuard CVE-2026-106931 (KEV 2026-10-20), Japanese WAF module, previously dropped, no new development
• reduced-confidence inclusion: BOSSAI and Kaspersky GERT, included on a single source (above); nothing else.
• out-of-window: none dropped on date alone; lookback items from rotational sources (Oneconsult, CCB-sourced items) were judged on relevance.
• Coverage gaps: connectwise-trust-center (403 on every transport, sixth run); sygnia (403, reader pool dead); ico-uk (403 on every rung including WebFetch, fourth run); prodaft (no dated listing on any transport); ag.ch listing pages (404; the sitemap recipe in the new ag-ch-medienmitteilungen record reaches the communiqués); cert.at HTML pages (403; its feeds read); apple-security (WebFetch returned a page that may be a cached copy; nothing in the lookback; KEV and the store cover the one Apple item of the week).
• Essential-coverage: all 21 essential sources were attempted (14 in S1, 7 in S2); none missed.
• Slice-completion: every slice record of S1 to S4 has a ledger row (26, 19, 14, 10); no continuation was needed. Rotation: the previous two fires' attempts were excluded from the rotational slices (115 records) as the belt-and-braces rule; for S4 the exclusion left one record of a 21-record domain, so S4 was ranked on the rotation cursor alone.
• Environment: the jina reader pool answered HTTP 402 on every key this fire; no read needed it (feed, extract, url --direct, WebFetch sufficed). entities/registry.yaml is 714 KB and was queried by key and alias instead of read whole; the prior-coverage index (89 records) was read in full for the 40 newest records and as headline, CVE and entity lines for the rest.
• Recipe findings logged in sources.json this run: sonicwall-psirt (PSIRT API feed and vulndetail JSON), crowdstrike (feed), synology-security-advisories (dead feed, listing recipe), blick-ch (news.xml), rapid7-research (malformed feed), msft-ti (raw listing), previdian, ox-security, esentire, inside-it-ch, qnap-security-advisories, zimbra-security-advisories; oss-security promoted to active on the digest's promotion_due; two candidates added (ag-ch-medienmitteilungen, picus-security-blog). S4 asked for piyolog to be promoted; the digest does not list it as due, so it stays a candidate.
• Source health: tools/source_health.py probed 298 of 298 sources; the two flagged records were fixed in this run (shadowserver: low-cadence publisher, max_staleness_days: 120, no moved blog; ec-presscorner-api: content_scope: general-news) and the re-run ended with no UNSOLVED entries.
• Verification outcome: the loop ran to the 8-iteration cap. Iteration 7 returned CLEAN (zero truth and editorial findings), the confirmation pass at iteration 8 returned NEEDS_FIXES (2 truth, 1 editorial, 1 advisory) and the run publishes under the cap fail-open with those three as residuals. The BOSSAI, OpenSSH and Danfoss fixes were applied after the final pass and the gate re-run (0 warnings); no verifier re-read them. The catalogue-feed citation finding on the Cisco entry is declined (pre-existing form, reasons in the iteration record).
• Notes for the next audit: the Danfoss refrigeration entry (13 records) and the ARTEX entry have main analyses well over the word bound (this fire only appended sections, none grew either analysis); the Plex2Shell chain was dropped a fourth time and the audit may want to confirm that call against the QNAP notice of 2026-11-06.