2026-11-10T0255Z-intel

Verification & coverage notes

Window 26 h (gap 24.0 h to 2026-11-09T0255Z-intel). Four new entries (N-able N-central, SAP, IBM Aspera Faspex, BluePhishing) and seven changelog records (OpenSSH, Barracuda, SonicWall, the French refrigeration attacks, the PK Softech funds, AhsayCBS, FreeSWITCH). Phase 1 returned 10, 4, 5 and 7 items; all four source ledgers were complete (19, 26, 14 and 10 records), so no continuation was needed. No intel/ drops.

• KEV sweep dispositions (work/<run-id>/kev-window.txt): CVE-2026-123158 OpenSSH (COVERED-STALE) shipped as an update record moving it to exploited; CVE-2026-123218 IBM Aspera Faspex (NOT COVERED) shipped as a new entry; CVE-2026-116779 FreeSWITCH was classed COVERED, but verifier iteration 1 showed its body still called the exploitation claim the vendor's alone, so it also shipped as an update record moving it to cisa-kev; borderline-drop: CVE-2026-102895 GPUStack, KEV-listed unauthenticated admin takeover, but a niche self-hosted AI-infrastructure product with no established footprint in the constituency, so doubt about relevance resolves to drop. The KEV RANSOMWARE rows were empty.
• Priority calls: N-able N-central is high, not critical: the vendor itself tells on-premises customers to power servers down and PoCs are public, but it reports no exploitation and no source reports scanning, and the bar's imminent-mass-exploitation limb needs verified scanning; the next fire re-checks the status page and the hotfix. Barracuda ESG stays high with exploitation now vendor-confirmed for a small number of organizations, no flaw named, and the admin-interface reachability precondition. OpenSSH stays notable (niche exposure: musl, no PAM, password logins on) despite the KEV listing.
• borderline-drop: Citrix NetScaler first monthly bulletin pre-announcement (2026-11-12 12:00 UTC), no vulnerability content; the bulletin itself is covered when it lands.
• borderline-drop: Arista advance notice of bulk advisories (2026-11-10), no content yet; the advisories are for the next fire.
• borderline-drop: Symantec Backdoor.Lindnor / Anubis ransomware intrusion (2026-11-05, lookback), US victim, encryption blocked, behaviors (BYOVD kernel-callback removal, AnyDesk registered for Safe Mode) are known classes.
• borderline-drop: Layer3 Intel and Krebs on residential-proxy exits inside the White House network, awareness only, no exploitation, no constituency data point.
• borderline-drop: Vaud Grand Conseil interpellation 26_INT_155 on the school IT-support platform, a deputy's questions, not findings; the Conseil d'Etat's answer is the item worth waiting for.
• borderline-drop: BACS phishing warning in the name of the federal tax administration (2026-11-09), citizen-facing lure with no technical content (precedent: BACS phishing notices are dropped).
• borderline-drop: BYOD ransomware group (Vanderbilt, UNM Health, Texas HHSC claim); outside the Swiss and European nexus and the claims are the group's own.
• borderline-drop: CNIL's ten fines against French local authorities for cybersecurity failings (2026-11-09), enforcement that changes no Swiss obligation; the findings repeat well-known audit points.
• borderline-drop: Landkreis Oberspreewald-Lausitz recovery (2026-11-09), single regional outlet, cause undisclosed, no actor or vector.
• borderline-drop: Medizinisches Zentrum Gleis D, Chur (Cloak claim, first reported 2026-11-06), a private practice, outside the window and the public-sector core; no new fact in the Netzwoche repeat.
• Scheduled releases: Microsoft Patch Tuesday, SAP Patch Day, and the monthly cycles of Fortinet, Ivanti, Adobe, Siemens and Schneider Electric are dated 2026-11-10 and publish after this run's clock. SAP's CNA records appeared early and are covered; the MSRC early-release set (134 rows) held nothing exploited or publicly disclosed. The next fire picks up the rest.
• Backlog: the 2026-11-03 ChimeraZ row stays held on its named condition (Belgian rescue zone Hainaut-Est, ZOHE; a confirmation by the zone or Belgian press); S4 searched in French and Dutch again and found nothing; expiry 2026-11-17 unchanged, so no note is added to the row.
• Contradictions and source notes: Proofpoint's BluePhishing page carries 2026-11-07 in its metadata while its feed item is dated 2026-11-09, which the entry uses. The CERT-FR report PDF extracts with broken spacing inside words, so the French attribution quote is taken from the foreign ministry's page and the report is cited in paraphrase. N-able's own status page is script-built and could not be read in this phase; the entry rests on Huntress, Field Effect, Censys and BleepingComputer and does not link the researcher's exploit repository.
• Single-source: 2026-11-10/sap-november-2026-cna-records-four-unauth-cvss-10-rows (SAP is the CNA for its own products and its Security Notes and Patch Day page were not readable; 2026-11-10/bluephishing-entra-agent-blueprint-consent-phishing-poc) Proofpoint's own research on a proof of concept.
• Registry: actor:shahid-kaveh and incident:n-able-n-central-able2shell-disclosure-2026-11 added; the French refrigeration incident gains attributed-to Shahid Kaveh and a CyberAv3ngers persona edge (related-to); three product entities came from tools/sync_products.py.
• Verification: four verifier iterations, each a cold read of every in-scope claim (252, 272, 220 and 140 claims; the later three were post-fix passes). Iterations 1 to 3 returned NEEDS_FIXES (truth 10, 9 and 7) and each was followed by a full fix round; iteration 4 returned NEEDS_FIXES with one low-confidence truth finding (no F1 or F4), fixed in the same round, so the run took the low-residual early exit and ran no confirmation pass. The residual count of 1 is that finding's iteration count. Declined with reasons: the SAP patch-day relevance doubt, the GPUStack drop, raw EUVD API links, the BSI portal's script-built page (confirmed instead from BSI's CSAF record), and condensing the long Publica summary.
• Coverage gaps: connectwise-trust-center (403 on every transport), sygnia (403 on every transport), ico-uk (403, eighth fire), kaspersky-securelist (feed reset; listing undated), databreaches-net (article pages 403).