2026-11-12T0255Z-intel
One pipeline fire, in full · intel run of 2026-11-12 · sub-agent allocation and telemetry, per-iteration verification verdicts and findings, source-list edits, coverage gaps, bridge invocations, and the run's own verification & coverage notes: what was published, what was dropped at the borderline or judged not relevant (and why), single-source carve-outs, and contradictions. Rendered from runs/2026-11-12/2026-11-12T0255Z-intel.md.
Run telemetry
2026-11-12T0255Z-intel
intel
prompt v4.24
publish ok
Claude Sonnet 5.5
(claude-sonnet-5-5)
main agent
S1
Claude Sonnet 5.5
(claude-sonnet-5-5)
- Items returned
- 23
- Duration
- 43m 37s
- Tool calls
- 11 WebFetch7 WebSearch190 bridge
- Cited sources
- 8 of 18 in slice
S2
Claude Sonnet 5.5
(claude-sonnet-5-5)
- Items returned
- 2
- Duration
- 19m 29s
- Tool calls
- 1 WebFetch29 WebSearch95 bridge
- Cited sources
- 2 of 27 in slice
S3
Claude Sonnet 5.5
(claude-sonnet-5-5)
- Items returned
- 13
- Duration
- 23m 58s
- Tool calls
- 9 WebFetch7 WebSearch75 bridge
- Cited sources
- 10 of 30 in slice
S4
Claude Sonnet 5.5
(claude-sonnet-5-5)
- Items returned
- 11
- Duration
- 23m 15s
- Tool calls
- 4 WebFetch20 WebSearch105 bridge
- Cited sources
- 3 of 8 in slice
Verification
#1 NEEDS_FIXES · Sonnet 5.5 · t=16 e=6 a=7 #2 NEEDS_FIXES · Sonnet 5.5 · t=7 e=6 a=6 #3 NEEDS_FIXES · Sonnet 5.5 · t=6 e=1 a=2 #4 NEEDS_FIXES · Sonnet 5.5 · t=2 e=0 a=3
Deep dive
·
Entries this run published (6) and updated (8)
- CVE-2026-54121, Windows Server AD CS 'Certighost': a low-privileged domain user forges a DC certificate to DCSync, public PoC since 2026-07-24 and attempted in real intrusions by the Citrus ransomware group (CVSS 8.8)
- CVE-2026-58115, Siemens SIMATIC IoT2050 Advanced, Basic, M.2 and SM ship a Node-RED interface with no authentication, so one unauthenticated HTTP request runs code with maximum privileges on an OT edge gateway (CVSS 10.0); VulnCheck's canary caught exploitation
- PK Softech, software supplier of Swiss pension funds: malware and a data outflow at Publica, with the City of Zurich fund PKZH saying its insured persons' test data was stolen, the Bernese funds BPK and BLVK and Pensionskasse Post also reporting the supplier incident, and the Federal Prosecutor's Office investigating
- eMudhra: the private keys of eight ECDSA intermediate CA certificates were trivially recoverable, so anyone could forge trusted HTTPS certificates, and eight RSA intermediates were revoked on 2026-11-07 for key handling eMudhra cannot show compliant; browsers block them, clients with their own trust store or no revocation checking need an update (CVE-2026-111943 in Go)
- Fortinet coordinated security hardening release: the advisories published on 2026-11-10 carry unauthenticated FortiMail, FortiAnalyzer, FortiManager, FortiOS and FortiAuthenticator flaws rated CVSS up to 9.8; FortiAnalyzer and FortiManager 8.0 have no fixed build for the JSON API flaw, FortiOS 7.0 and FortiMail 7.2 are left out of the October fixes
- CVE-2026-109618 / CVE-2026-109619, PHP2Shell in management servers and storage: Trend Micro released critical patches for Apex Central and Apex One server on 2026-11-11 while Mobile Security for Enterprise and Deep Discovery Analyzer still await theirs, Quest KACE SMA and SDA have fixes and should block ports 80, 443 and 52230 until patched, and NetApp ONTAP 9 is affected by CVE-2026-109618 only, inside the PHP jail
- CVE-2026-111497, Brotli decoder flaw in Siemens industrial and software products (Desigo CC, SIMATIC WinCC, Industrial Edge, Teamcenter and Opcenter among them), Mitel MiVoice Business and OpenScape, with Cisco listing Duo Network Gateway and RoomOS in its combined advisory: Desigo CC takes the .NET updates, while most Siemens products, the Mitel updates and the Industrial Edge Common Configurator fix are still pending
- CVE-2026-125350, Google Chrome before 157.0.8103.50: a use-after-free in the XML component is exploited in the wild and listed by CISA; Edge for Android carries the fix, Edge desktop and other Chromium browsers are still to follow
- Belgium's CCB warns that attackers abused Microsoft Entra ID SMS first-factor sign-in (phone number and one-time code, no password) to compromise several Belgian organisations; turning off 'Use for sign-in' is the priority step
- Falcon: Unit 42 describes a browser-resident command-and-control framework planted in government webmail and web applications, with a script tag in Roundcube at a Middle Eastern foreign ministry and a sideloaded 'PDF Viewer' extension elsewhere; it shares its core with PeckBirdy
- GSocket on compromised Linux web servers: Microsoft sees several unrelated actors install the open-source relay client after exploiting an internet-facing web application, so access outlives the patch; no inbound listener, no attacker-hosted infrastructure
- ScreenConnect: commands pushed through Run Command to at least 288 managed endpoints at 48 Huntress customers within 90 minutes on 2026-11-11 installed a rogue second client and the SCKit toolkit; Huntress links the activity to the RMM+ extension, whose versions 1.0.31 and 1.0.32 accepted a blank access key
- CVE-2026-119618, Apache HTTP Server 2.4.55 to 2.4.70: a race in mod_http2 assign_headers() corrupts heap memory and leads to remote code execution on servers with HTTP/2 enabled; fixed in 2.4.71, Red Hat calls it unauthenticated and claims public exploit research, no exploitation reported
- Plone security fix of 2026-11-10: a chain of missing security declarations and opened modules lets an anonymous visitor run code on the server in every supported Plone version and back to 4.3; a working proof of concept exists, no CVE ids yet, no exploitation reported
Sources changed (this run)
Edits this run made to sources/sources.json · promotions, demotions, new candidates, and fetch-method / category / reliability / url corrections (the run record's sources_changed[]). Paginated; 10 per page.
23 last_successful_fetch · 3 added (candidate) · 2 status · 1 fetch_method · 1 fetch_method / health_cmd · 1 health_cmd.
| Source | Change | From → To | Reason |
|---|---|---|---|
| bleepingcomputer | last_successful_fetch | · → 2026-11-12 | fetched and used |
| borncity | last_successful_fetch | · → 2026-11-12 | fetched and used |
| cash-ch-awp | last_successful_fetch | · → 2026-11-12 | fetched and used |
| ccb-belgium | last_successful_fetch | · → 2026-11-12 | fetched and used |
| datadog-security-labs | last_successful_fetch | · → 2026-11-12 | fetched and used |
| enisa-euvd | last_successful_fetch | · → 2026-11-12 | fetched and used |
| fortinet-psirt | last_successful_fetch | · → 2026-11-12 | fetched and used |
| github-advisory | last_successful_fetch | · → 2026-11-12 | fetched and used |
| hackernews | last_successful_fetch | · → 2026-11-12 | fetched and used |
| kaspersky-securelist | last_successful_fetch | · → 2026-11-12 | fetched and used |
| mozilla-mfsa | last_successful_fetch | · → 2026-11-12 | fetched and used |
| msft-ti | last_successful_fetch | · → 2026-11-12 | fetched and used |
| next-ink | last_successful_fetch | · → 2026-11-12 | fetched and used |
| nodejs-security-releases | last_successful_fetch | · → 2026-11-12 | fetched and used |
| oss-security | last_successful_fetch | · → 2026-11-12 | fetched and used |
| paloalto-psirt | last_successful_fetch | · → 2026-11-12 | fetched and used |
| report-uri-blog | last_successful_fetch | · → 2026-11-12 | fetched and used |
| socket-dev-blog | last_successful_fetch | · → 2026-11-12 | fetched and used |
| sophos-xops | last_successful_fetch | · → 2026-11-12 | fetched and used |
| specterops | last_successful_fetch | · → 2026-11-12 | fetched and used |
| therecord | last_successful_fetch | · → 2026-11-12 | fetched and used |
| unit42 | last_successful_fetch | · → 2026-11-12 | fetched and used |
| wiz-blog | last_successful_fetch | · → 2026-11-12 | fetched and used |
| apache-httpd-security | added (candidate) | · → status: candidate | primary for the Apache HTTP Server project; the 2026-11-11 critical mod_http2 RCE reached the pipeline only through oss-security and an unscored EUVD row, and became a published entry |
| plone-security-announcements | added (candidate) | · → status: candidate | primary for Plone security hotfixes and pre-announcements; contributed the Plone hotfix entry |
| mozilla-ca-compliance-bugzilla | added (candidate) | · → status: candidate | primary for CA incident reports; its full eMudhra incident report changed a published entry |
| synology-security-advisories | status | candidate → active | cited by published entries from at least three distinct runs |
| watson-ch-digital | status | candidate → active | cited by published entries from at least three distinct runs |
| ico-uk | fetch_method | blocked → bridge | the host answers again: `url --direct` reads the sitemap with dated items and the health recipe returns content, so the 403 outage that justified `blocked` is over |
| safeonweb-be | fetch_method / health_cmd | webfetch → bridge, health_cmd url https://safeonweb.be/en | WebFetch and the default probe get 403 while the bridge reads the HTML, so the health sweep kept flagging needs-bridge |
| netzwoche | health_cmd | · → feed https://www.netzwoche.ch/rss.xml | the homepage probe returned no security vocabulary; the RSS feed reads dated items |
Coverage gaps (this run)
Sources this run's brief needed that returned no usable content via any documented recipe. Bridge-recovered or quiet-day sources do NOT appear here. (Distinct from the independent source-accessibility probe at the foot of this section, which probes all active sources regardless of what any run needed.)
| Source (uncovered) | URL tried | Method chain | Status / class | What the agent did instead |
|---|---|---|---|---|
| connectwise-trust-center | https://www.connectwise.com/company/trust/advisories | bridge:extract → bridge:url → bridge:url --direct → WebFetch | 403 transport-403 advisories page answers 403 on extract, url, url --direct and WebFetch | S1 searched for a bulletin newer than the last one on record and found none in the window; 403 never demotes |
| sygnia | https://www.sygnia.co/blog/ | bridge:url → bridge:extract → WebFetch → bridge:jina → WebSearch | 403 transport-403 blog answers 403 on every transport | WebSearch found no in-window post; listed as a coverage gap; 403 never demotes |
Bridge invocations (this run)
7 bridge calls this run · these are successful bridge fetches (separate from "Coverage gaps" above).
7 other
- tools/fetch_source.py cisa-kev ×1
- tools/fetch_source.py ncsc-csh recent ×1
- tools/fetch_source.py enisa-euvd ×1
- tools/fetch_source.py extract ×1
- tools/fetch_source.py url --direct ×1
- tools/fetch_source.py sec-edgar ×1
- tools/fetch_source.py jina (last rung) ×1
Verification findings · all iterations
Per-iteration finding detail. Each table is one verifier pass · what was flagged, how the main agent remediated it, and the outcome. Walking the tables top-to-bottom shows the verifier's debugging trail across iterations.
Iteration #1 NEEDS_FIXES · 29 findings (truth=16, editorial=6, advisory=7) · Claude Sonnet 5.5 · 26m 11s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F3 claim-not-supported | · | Both Download Center pages carry only a release date, file name and size (Apex One: 'This Critical Patch applies to Apex One Service Pack 1'); neither says PHP, PHP 8.2.35 or PHP2Shell. The PHP 8.2.35 | fixed: the update section cites the Download Center for the release date and the two readmes for the PHP 8.2.35 fact, says the Apex One readme does not name the flaw; headline, summary, actions[0] and the record summary… | |
| F3 claim-not-supported | · | The cited Stable post covers only 157.0.8103.78/.79 (83 fixes, five Critical). Extended Stable 156.0.8078.100, the 72 fixes and the four Critical bugs are on a different page, ... | fixed: the Extended Stable 156.0.8078.100 page added to sources[] and cited at that clause (read live: 72 fixes, four Critical) | |
| F3 claim-not-supported | · | The MSRC record (read via the Update Guide API) carries the description, the 8.8 base score and the July release, but not the researcher names or the PoC publication date; the names appear only inside | fixed: researcher names and PoC clause now cite CybersecurityNews and the Defender post | |
| F3 claim-not-supported | · | CybersecurityNews says 'this access enabled a DCSync attack extracting sensitive secrets including the krbtgt account hash' and separately that 'A proof-of-concept is available on GitHub'; nowhere doe | fixed: reworded to what the page states (the access enabled a DCSync of the krbtgt account hash) | |
| F3 claim-not-supported | · | In the preceding sentence 'that account' reads as the newly created GHOST account; Kaspersky writes 'the domain controller name in its SubjectAlternativeName field lets the attackers authenticate as t | fixed: "as the domain controller account" | |
| F3 claim-not-supported | · | The Plone post says 'Details are public from today, and with current AI tools it may not take long to turn them into a working exploit.' That is a possibility, not an expectation that an exploit will | fixed: the team's own wording (with current AI tools it may not take long to build an exploit) | |
| F3 claim-not-supported | · | Huntress: 'The kit is delivered as an encrypted payload, but the infected machine provides the actual decryption key ... it passes the UUID ... The server returns header data that include an encryptio | fixed: toolkit delivered encrypted, decryption values issued by the server against the UUID | |
| F3 claim-not-supported | · | The cybercrimepolice.ch page is conditional throughout ('könnten Kriminelle abgeflossene Personen- und Finanzdaten nutzen', 'könnten auch Informationen zu Löhnen und Vorsorgeguthaben betroffen sein') | fixed: body and summary say criminals could use the leaked data, as the page does | |
| F4 hallucinated-fact | · | SSA-678870 (the 28 software products) gives Teamcenter 'For Teamcenter manual mitigation instructions can be found here: .../PL8869204' and the Opcenter rows 'The vulnerability can be mitigated on the | fixed: Brotli-disable and IIS rule scoped to the SSA-242944 products; Teamcenter and Opcenter point at the login-gated KB articles, HyperLynx/PADS/Xpedition at the firewall block, and the four products with none are… | |
| F4 hallucinated-fact | · | No cited source supports Multi-hop Proxy (T1090.003). Microsoft's own ATT&CK section maps the relay to 'T1090.002 Proxy: External Proxy | GSocket clients were launched with options that establish outb | fixed: T1090.003 replaced with T1090.002 | |
| F4 hallucinated-fact | · | The body correctly says the project 'names no fixed standalone release', but the structured field asserts that none exists. The project page only lists 'Affected releases of mod_h2 from GitHub: from 2 | fixed: "no fixed standalone mod_h2 named by the project" | |
| F4 hallucinated-fact | · | The 11-11 section lists CVE-2026-126164/126147 (FortiMail 7.2: 'Migrate to a fixed release') and CVE-2026-126253 (FortiOS 7.0: 'Migrate to a fixed release') and then says the October builds fix them; | fixed: the 11-11 sentence now says the October builds fix most rows but not on every branch, pointing to the correction | |
| F5 missing-citation | · | The cited Red Hat CVE page lists the errata only as advisory ids with state Fixed and no package versions. The NVRs are correct but come from RHSA-2026:98981 (RHEL 9, mod_http2-2.0.26-7.el9_9.1) and R | fixed: RHSA-2026:98981 and RHSA-2026:98978 added to sources[] and cited for the NVRs (read live) | |
| F5 missing-citation | · | Presented as the telemetry to hunt, but no cited source describes crashes, error-log signatures or request bursts; it is the composer's inference. Label it as an inference (as the PHP2Shell entry does | fixed: the detection line is labelled an inference and the burst clause dropped | |
| F8 needs-more-research | · | BleepingComputer (cited) quotes Huntress: 'Sequential attacker-assigned tags suggest other MSPs may have been compromised earlier, so ScreenConnect users should check their Run Command history even if | fixed: actions[0] no longer bounded at 2026-11-11; the earlier-compromise indication and the July batch script added with a BleepingComputer cite | |
| F8 needs-more-research | · | The cited CybersecurityNews page gives a mitigation for CAs that cannot patch at once: 'disable the vulnerable chase fallback with: certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC' (tempo | fixed: the interim certutil step (clear the chase-fallback flag) added to actions[0] and the Defender takeaway | |
| F9 surface-contradiction | · | Google's own Extended Stable post of 2026-11-09 (cited in the entry) still lists 'High CVE-2026-125346' (bug 572578603) and 'High CVE-2026-125350' (bug 582442907) as separate rows, while the Stable po | fixed: the update section now says the Extended Stable page still lists the separate row and that Google pages disagree | |
| F11 editorial-advisory | · | Field-name record-keeping narration inside a reader-visible record summary; end the summary after 'Microsoft's record still lists no confirmed exploitation'. | fixed: internal narration removed from the record summary | |
| F11 editorial-advisory | · | Counted as check_run._main_words does (text above the first '## ' heading, link targets stripped), deep_dive is false on both, so the bound is 550 and the run trimmed 3 and 12 words while rewriting th | declined for this fire: both bodies were trimmed or held below their prior length this run (1102 to 1100, 907 to 895); a rewrite to 550 words is a larger restructure left for the audit | |
| F11 editorial-advisory | · | The contract is 1-3 self-contained sentences (TL;DR bullet, RSS description, notification text). This summary is a changelog of the whole story, including the new ransom-letter clause; cut to the thre | fixed: Publica summary cut to three sentences | |
| F11 editorial-advisory | · | Microsoft says the sector shares 'do not indicate that threat actors selected these sectors deliberately' (the body says so), yet the structured sectors field presents them as targeted sectors on the | fixed: sectors emptied; T1090.002, T1564.001, T1222.002 added and the hidden staging described in the body | |
| F11 editorial-advisory | · | The body states the CCB 'does not say how the codes were obtained'; its only phishing statement is generic ('SMS and voice can be phished, intercepted or SIM-swapped'). The phishing tag implies a find | fixed: phishing tag removed | |
| F11 editorial-advisory | · | Huntress's post opens with 'In September 2026, Huntress stood up a Rapid Response to similar worm-like activity that spawned rogue ScreenConnect clients ... ConnectWise later released a security updat | fixed: references[] now carries the September ScreenConnect worm entry | |
| F11 editorial-advisory | · | The live Cisco advisory is at version 1.11 (2026-NOV-10; 1.9 and 1.10 also landed since). The listed facts I re-read (Duo Network Gateway 3.4.2, Spaces 24.22.1, RoomOS 11.41.2.3 / 26.7.4.3, PoC statem | fixed: Cisco revision label now version 1.11 of 2026-11-10 (read live) | |
| F14 ? | · | Unit 42: 'We observed a total of 39 Roundcube instances being affected within the target country. We have no evidence of any instances affected outside of the target country, suggesting this was a hig | fixed: "none observed elsewhere" | |
| F14 ? | · | Huntress/BleepingComputer say 'multiple cloud-hosted ScreenConnect panels' and 'targeting cloud-hosted ScreenConnect instances'; no source says every case was cloud-hosted, and ConnectWise's instructi | fixed: "in every reported case" dropped | |
| F14 ? | · | The same summary-versus-metadata contradiction appears on more than two of the cited pages: FG-IR-26-202 (summary: reset the password of an arbitrary IBE webmail user and take over the account; Impact | fixed: sourcing_note says several pages contradict themselves and names the pattern | |
| F15 ? | · | The store carries product:crowdstrike-falcon (the EDR) and five entries that mention CrowdStrike Falcon; an alert-matching agent or SOC reader seeing 'Falcon' will reach for the EDR. The registry key | fixed: body says Falcon C2 is not the CrowdStrike Falcon sensor and that the sources read do not link the PDF Viewer extension to the Jewelbug one | |
| F17 ? | · | The only source is the Microsoft Security Blog threat-intelligence post, which sources.json rates msft-ti = B (the MSRC records msrc-blog / msrc-update-guide are the A tier), and the other 11 entries | fixed: reliability B |
Iteration #2 NEEDS_FIXES · 19 findings (truth=7, editorial=6, advisory=6) · Claude Sonnet 5.5 · 25m 53s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F4 hallucinated-fact | · | VulnCheck (https://www.vulncheck.com/blog/exploitation-targeting-node-red): '(Note that VulnCheck Canaries have not observed exploitation of this vulnerability in Siemens products.)'; the entry's own | fixed: headline now says the flaw hit a VulnCheck canary, not a Siemens device | |
| F3 claim-not-supported | · | BleepingComputer (live read): 'BleepingComputer found an earlier malicious batch script that references one of the rogue ScreenConnect client IDs listed by Huntress ... first uploaded to VirusTotal on | fixed: the July 2026 batch script is attributed to BleepingComputer with its link to this campaign stated as unclear | |
| F4 hallucinated-fact | · | The structured fixed field lists the Apex One build as the fix for the two CVEs with no hedge, while the Apex One readme says only 'This Critical Patch updates the PHP module to version 8.2.35 to prot | fixed: cves[].fixed notes the Apex One readme names no flaw | |
| F4 hallucinated-fact | · | The structured field still folds SSA-242944's mitigations into a parenthetical for 'the other products' without scoping it. SSA-678870 (https://cert-portal.siemens.com/productcert/html/ssa-678870.html | fixed: cves[].fixed scoped per advisory (SSA-242944 mitigations; SSA-678870 KB articles, firewall block, none listed for four products) | |
| F3 claim-not-supported | · | FG-IR-26-209 (CVE-2026-126157) says 'may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests' and never says IBE or webmail; the other thre | fixed: CVE-2026-126157 described as a secure-email account access flaw and split out of the IBE group | |
| F3 claim-not-supported | · | Unit 42 states only 'We are currently unaware of how an operator is deploying these browser extensions.' For the script-tag placements it is silent (the body correctly says 'how the tag got in is not | fixed: summary says Unit 42 does not say how the script tags were placed and is unaware how the extensions are deployed | |
| F3 claim-not-supported | · | Microsoft: 'These figures reflect the share of affected organizations and do not indicate that threat actors selected these sectors deliberately. Exposure is the more likely factor'. The entry drops t | fixed: Microsoft's hedge restored (exposure more likely than deliberate selection) | |
| F8 needs-more-research | · | The cited page pairs the command with 'Restart-Service CertSvc -Force' and warns 'Test this in staging first, since any legitimate workflows relying on the chase fallback will break.' Without the Cert | fixed: actions[0] and the takeaway add the CertSvc restart and the staging caveat | |
| F8 needs-more-research | · | Red Hat's CVE page gives the reason: 'The mod_http2 packages shipped in Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 allocate each HTTP/2 stream from a separate allocator, which substant | fixed: body and actions[0] carry Red Hat's separate-allocator reason for the Important rating | |
| F8 needs-more-research | · | SSA-242944 lists four more no-fix products with the identical Brotli-disable mitigation (COMOS Walkinside, Project Server Web Administration Tool, SIMATIC WinCC Companion; the Profiling Tool has 'no f | fixed: actions[1] lists every SSA-242944 product without a fix and the Process Preparation X mitigation sits in the update section and body | |
| F16 ? | · | Pre-auth RCE (Red Hat CVSS 9.8) in the most widely deployed web server with a project-rated critical, a fixed release out and a public-exploit claim from Red Hat (Wiz says none at publication) is argu | declined: no exploitation is reported (Wiz: none at publication) and Red Hat rates its RHEL 9 and 10 packages Important; the store treats unexploited pre-auth RCEs as notable | |
| F10 missed-angle | · | Live KEV catalogue (dateReleased 2026-11-10T19:03Z) lists all three, and neither state/cves_seen.json, prior_coverage.json nor any entry mentions them. They pre-date this run's 26 h window (so possibl | declined for this fire: CVE-2026-20320, CVE-2026-102895 and CVE-2026-111793 were dispositioned as borderline-drops in the 2026-11-10 and 2026-11-11 run records (footprint); left for the audit sweep | |
| F18 ? | · | Both actions restate body Detection/hardening guidance as one compound task list (check 10b(b)); keep the single start-now task (Certighost: confirm the July update on every Enterprise CA, else clear | fixed: Certighost actions[0] reduced to the one start-now task; Brotli actions merged to three | |
| F11 editorial-advisory | · | Garbled leftover text renders as a stray 'paloaltonetworks.com/falcon-c2-browser-compromise/))' fragment in the published body (line 61). Delete it. Also 'a name shared with the Jewelbug entry's exten | fixed: stray text removed, Jewelbug named instead of referring to the store entry | |
| F11 editorial-advisory | · | Eight registry keys created for these entries are linked from no entry, so the entity and product pages stay empty. Add them to entities[] (Brotli via an internal record or the existing update record' | partly fixed: product links added where they raise no dedup warning (Plone, Apache, Roundcube, Brotli's seven Siemens products); the Entra ID and ScreenConnect product links were dropped because they overlap older… | |
| F11 editorial-advisory | · | The summary contract is 1-3 self-contained sentences; the eMudhra summary is a running changelog of the whole story (the same fix was applied to Publica's summary this run). The two main analyses rema | fixed (summary): eMudhra summary cut to three sentences; the two main analyses stay over the 550-word bound for the audit to restructure | |
| F11 editorial-advisory | · | The section adds ten new critical rows (including the unauthenticated 9.8 JSON API flaw with no 8.0 fix) and a new workaround, which is genuine new information on a high-priority entry; as a correctio | fixed: the 2026-11-12 Fortinet record is now typed update (ten new critical rows and a no-fix item) and the entry re-floats | |
| F11 editorial-advisory | · | CybersecurityNews says only 'A proof-of-concept is available on GitHub' and Microsoft 'A public proof of concept was released on July 24, 2026'; 'full' and 'working' are not in either. Use 'a public P | fixed: title and summary say public PoC | |
| F11 editorial-advisory | · | Composition narration about the entry's own earlier wording, which the reader no longer sees; the disagreement itself is stated correctly in the two sentences before it. Cut the sentence or end after | fixed: the Chrome update section ends on the disagreement itself |
Iteration #3 NEEDS_FIXES · 9 findings (truth=6, editorial=1, advisory=2) · Claude Sonnet 5.5 · 25m 40s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F4 hallucinated-fact | · | The entry's own primary, https://www.huntress.com/blog/sckit-worm-rogue-screenconnect, now opens with 'Update: 11/11/26 @ 11:34pm ET': 'Huntress has learned that the activity seems to be related to on | fixed: the entry now carries Huntress's update (RMM+ 1.0.31 and 1.0.32 accept a blank access key, no login activity, commands linked to RMM+), attributed to Huntress alone; title, headline, summary, body, actions[0] and… | |
| F8 needs-more-research | · | Same Huntress update gives the discriminator an on-prem or MSP operator needs: RMM+ 1.0.31 and 1.0.32 accept a blank access key when 'RMMPlus.AccessKey' was never set, and RMM+ 'bypasses ScreenConnect | fixed: Exposure, Detection, actions[0] and the takeaway carry the RMMPlus.AccessKey and version discriminator | |
| F3 claim-not-supported | · | Live Cisco advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u, version 1.11, 2026-NOV-10; read as extract and as raw HTML with ta | fixed: Cisco fix dates now "November 2026 to March 2027" | |
| F3 claim-not-supported | · | The cited Unit 42 page supports the extension name, developer-mode sideload, the 3-4 minute check-ins for more than 3 weeks and the exfiltration, but nowhere says Jewelbug's extension is also named PD | fixed: the Jewelbug note is its own sentence citing the Symantec report, with Unit 42 stated as listing it only as a further resource; Symantec added to sources[] | |
| F4 hallucinated-fact | · | Both Google pages list the second bug as fixed. Stable 157.0.8103.50 (https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html) has one row '[TBD][572578603][5824 | fixed: the Chrome section says both Google pages list the bug as fixed and differ only on its CVE id; record summary aligned | |
| F14 ? | · | The entry cites FG-IR-26-175 (https://fortiguard.fortinet.com/psirt/FG-IR-26-175), which says 'This has been reported to be exploited in the wild, customers are urged to apply the workaround below' fo | fixed: "none of the 2026-11-10 advisories states exploitation" | |
| F4 hallucinated-fact | · | FG-IR-26-268 (https://fortiguard.fortinet.com/psirt/FG-IR-26-268, CVE-2026-126254, Attack Type Authenticated) says the bgp daemon flaw 'may allow a configured ibgp neighbor to send malicious/malformed | fixed: detection names OSPF advertisements from unexpected hosts and unusual updates from iBGP neighbours | |
| F11 editorial-advisory | · | The 2026-11-12 record is now typed update with a '## Update' heading, so 'the correction below' points at nothing; reword to 'the update below'. The 11-12 section's last sentence narrates the entry's | fixed: "the update below"; the narration of the entry's earlier wording removed from the section and the record summary | |
| F11 editorial-advisory | · | The inserted parenthetical leaves the sentence hard to parse (the relative clause 'which ... do not tie to this one' hangs between two commas inside the subject) and uses composition language ('the so | fixed: see finding 4 |
Iteration #4 NEEDS_FIXES cap-breach · 5 findings (truth=2, editorial=0, advisory=3) · Claude Sonnet 5.5 · 21m 14s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F3 claim-not-supported | · | The cited BleepingComputer page (https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/, read as extract and raw HTML) carries the exte | fixed: the "initial access vector not yet identified" statement now cites Huntress; the sourcing_note no longer says every ConnectWise statement comes from BleepingComputer | |
| F14 ? | · | The entry cites Fortinet's own FG-IR-26-175 (https://fortiguard.fortinet.com/psirt/FG-IR-26-175, 'Known Exploited: Yes', CVE-2026-104286), which says 'This has been reported to be exploited in the wil | fixed: "none of the 2026-11-10 advisories states exploitation" in the summary and the body | |
| F11 editorial-advisory | · | Iteration 3 F11 named the same phrase in the Chrome sourcing_note; only the Falcon wording was changed. Say 'in the sources cited' (CVSS), drop 'when it was read' or state the date of the check, and ' | fixed: "the sources read", "when it was read" and "in what was read" replaced on the Chrome and PHP2Shell entries | |
| F11 editorial-advisory | · | The feed cap is how the pipeline collected rows, not provenance a reader needs (iteration 3 cut the same narration from the section and the record summary but the sourcing_note keeps it); 'than the ni | fixed: pipeline narration removed from the Fortinet sourcing_note and the 2026-11-12 section | |
| F11 editorial-advisory | · | 'transport' is fetch-pipeline vocabulary (say 'The ConnectWise advisory page was not retrievable, so its statements are taken from BleepingComputer's quotes and Huntress's summary'). In actions[0] the | fixed: sourcing_note wording and actions[0] order (RMM+ 1.0.31 and 1.0.32 first because they accept a blank access key) |
Verification & coverage notes
The run record's narrative body, verbatim. This is where the run accounts for its own judgement calls: every borderline drop and judged-not-relevant item with its reason, dedup decisions, single-source items and their carve-outs, contradictions, and per-source coverage gaps, so nothing the run considered disappears silently.
Verification & coverage notesrun record body
2026-11-12T0255Z-intel · Sonnet 5.5 · window 26 h · 6 entries published
Verification & coverage notes
Window: standard 26 h (gap to the previous fire 24.0 h). KEV sweep: no catalogue additions in the window and no ransomware-flag flips on covered entries. Held backlog row left untouched: zohe-hainaut-est (no source found, expiry 2026-11-17).
- borderline-drop: Node.js 2026-11-11 security releases (seven high CVEs), scheduled release, no exploitation or PoC, regular patch cycle (PD-11 b)
- borderline-drop: Mitel MiVoice MX-ONE MISA-2026-0011, LAN-access prerequisite, CVE ids pending, no exploitation
- borderline-drop: Adobe Experience Manager APSB26-189, low-privilege rows, no exploitation, regular cycle
- borderline-drop: Arista EOS BGP stack overflow CVE-2026-121289, needs a BGP peer, no exploitation
- borderline-drop: PTC Windchill CVE-2026-126325, CNA record only, no fix or technical detail readable
- borderline-drop: Xen XSA-529/530, timing inference of the XAPI pool secret, no exploitation, primary 7 h before window
- borderline-drop: Red Hat Quay CVE-2026-123710, scores preliminary, no fixed build named, no exploitation
- borderline-drop: React Server Components CVE-2026-126187, vendor advisories of 14/22 Oct, narrow condition, no confirmed exploitation
- borderline-drop: PAN-OS November batch, Checkmk, Rails 8.0.5.2/8.1.4.1, git v2.56.1, Firefox 160/ESR, Zoom ZSB-26023, routine monthly releases or authenticated/user-interaction flaws, no exploitation
- borderline-drop: Ubuntu tracker status for CVE-2026-98432; Ivanti CVE-2026-121683 contradictory CNA record, incremental, no decision changes
- borderline-drop: France summons Iran's ambassador / Iran rejects Danfoss attribution, diplomatic track, no technical delta (would re-float a high entry)
- borderline-drop: ARTEX successor frameworks (Unit 42/Sophos/Arctic Wolf AntiFox), marginal delta on an entry already past its word bound
- borderline-drop: Build Card ClickFix kit (Report URI), single source, commodity technique
- borderline-drop: SpecterOps multi-tenant Entra app explainer, no new incident fact, audit step already in the ConnectWise and exposed-credentials entries
- borderline-drop: Poland ePUAP offline, vector and actor undisclosed, no Swiss link (incident floor)
- borderline-drop: MongoDB CVE-2026-118383, replica-set peer path, crash only reproduced, no exploitation
- borderline-drop: Report URI scan data on the APT29 watering hole, marginal delta
- borderline-drop: Kaspersky IT threat evolution Q3 2026, detection counts, no defender takeaway
- borderline-drop: PowerFolder cloud breach and /wopi/ server flaw, no CVE, no technical detail, no constituency deployment shown
- borderline-drop: CNIL ten sanctions on French territorial authorities, generic hardening failings, no Swiss obligation change
- borderline-drop: University of Tuebingen, Gleis D Chur (Cloak), INCERT eTourismus (Zermatt Tourismus), Maileva, Notion/Fireworks AI, Maersk, private or foreign victims without a stated transferable technique or vector (incident floor)
Verification: four iterations. Iteration 1 found 29 findings (16 truth, 6 editorial, 7 advisory), iteration 2 found 19, iteration 3 found 9 (one new upstream fact: Huntress updated its ScreenConnect post with the RMM+ blank-access-key finding), and iteration 4 returned NEEDS_FIXES with truth 2 and editorial 0 and no F1 or F4, so decision rule 5 applied: the five findings were remediated, the gate re-run clean (58 pass, 0 warn, 0 fail), and the fire published on that early exit without a fifth pass. No double-CLEAN was reached; the two residual truth findings are fixed but unverified by a further cold pass, and the audit should give the ScreenConnect and Fortinet entries an independent read.
Operational notes: the jina reader pool is dead (every key HTTP 402), so pages that only the reader could serve were read by WebFetch or reported as unconfirmed. Research workers FU2 left six stray stub files at the filesystem root (/A_chrome_android.md, /A_chrome_android.err, /A_chrome_extended_156.md, /A_chrome_extended_156.err, /A_edge_security.md, /A_edge_security.err); the sandbox safety check denied deleting them and the run did not work around it, so the operator may remove them. They hold fetch scratch output only and are not part of the repo.
Gate note for the audit: check_run.py citation-cve matches an id against a skeleton that joins the id to the digits of the next bug number on Chrome Releases rows, so a clause naming CVE-2026-125346 on the Extended Stable page reads as a miss although the id is on the page; the Chrome entry avoids naming the id there. The three KEV additions the verifier listed for 2026-11-09 and 2026-11-10 without entries (CVE-2026-20320 Cisco BroadWorks, CVE-2026-102895 GPUStack, CVE-2026-111793 Openwave Webtop) were dispositioned as borderline-drops by the 2026-11-10 and 2026-11-11 fires and are left for the audit sweep. The main analyses of the Publica (1100 words) and eMudhra (895) entries stay above the 550-word bound as before this fire, for the audit to restructure.
Source health: seven records stay UNSOLVED. Fixed this run: ico-uk, safeonweb-be, netzwoche (recipes in sources_changed). Left for a refilled reader pool or a changed host: schneier (blog and atom feed 403 on every free transport), belden-psirt (403 direct), ahnlab-asec (WebFetch reads it; bridge and extract do not), mozilla-ca-compliance-bugzilla (the REST recipe reads, its rows carry no security vocabulary the health check recognises).
- Essential-coverage: every essential record was attempted. Coverage gaps: connectwise-trust-center (403 on every transport), sygnia (403), Siemens knowledge-base articles (login-gated), news-admin-ch, srf-news and swissinfo-ger (shallow reach through the listing recipes), the NCSC.ch BACS card recipe, ictjournal-ch, and rapid7's RSS (malformed).
- Watchlist: none configured.
← Operations dashboard · run-record contract: docs/pipeline.md