2026-11-13T0256Z-intel

Verification & coverage notes

Window: standard 26 h (gap to the previous fire 24.0 h). KEV sweep: no catalogue additions in the window and no ransomware-flag flips on covered entries. No closed-source drops present (S5 not spawned). Seven new entries (eight composed, one dropped by verification) and nine changelog records; no deep dive and no critical: nothing met the stop-and-act bar. The will-publish set exceeded eight items, so the Phase 4 deep read of the primaries was delegated to five scoped cti-research workers (DR-A to DR-E, saved bodies under work/<run-id>/bodies/); two of them did not report call telemetry (null in the block above), and the bridge-fetch counts of DR-A and DR-B are the workers' own approximations.

Inclusions with reduced confidence or carve-outs:

• Citrix NetScaler ADC/Gateway CTX697305 (high): vendor bulletin plus watchTowr credit, no exploitation reported; high because the default-configuration gateway role is the constituency's exposed edge (the verifier questioned the call because the vendor states a crash or denial-of-service impact and no source reports code execution or exploitation; kept, since an unauthenticated default-configuration flaw scored up to 9.3 on an internet-facing gateway decides a 7-day patch window, and the body states both limits). Citrix revised the bulletin on 2026-11-12 after the slice captured it, correcting seven mistyped CVE numbers (now CVE-2026-111333 to CVE-2026-111339); the verifier caught it in iteration 4 and the entry now carries all 29 records.
• PTC Windchill/FlexPLM CVE-2026-126325: the vendor's Trust Center and CNA record are the primary; NCSC Switzerland, BSI, ENISA and The Hacker News restate them and the fixed releases are behind a customer login, so confidence stays medium; references the two earlier Windchill entries.
• DarkLunnen (Group-IB): admitted through the rotational-lookback rule (d); cves[] left empty so the entry does not collide with the Gunra and Gentlemen entries that carry the same FortiOS ids; references the Gunra entry.
• SignDrop (CLFS LPE, public PoC, no patch): reproduction and detection tables from one research source plus the PoC publication; no CVE assigned yet, cves: [].
• Dixell/Copeland XWEB EVO: VulnCheck CNA cluster, seven records all no-patch; actions: [] because the earlier Danfoss entry already carries the do-now step.
• Check Point PHP2Shell update: priority raised notable to high on the vendor's new SK1000302 portal and VPN-gateway scope plus CVE-2026-123039; the main analysis was rewritten and stays above 550 words only by the structured record, flagged for the audit.
• N-able N-central / Confluence: the 4EverAble2Shell exploitation of CVE-2026-90436 is recorded on the N-able entry as an update and cross-referenced in prose on the Confluence entry; the Confluence exploited status is not changed (its own product is not shown exploited).

Borderline drops (PD-11 and the incident floor):

• borderline-drop: Siemens SSA-166980 PHP2Shell energy and building products: control-centre products, no Swiss public-body link, exploitation needs a reachable PHP portal
• borderline-drop: Azul Payara CVE-2026-110003 and CVE-2026-90908: admin interface not normally reachable, no exploitation
• borderline-drop: PwnEscape CVE-2026-99999: local guest-to-host vector, lab-only bundle, not on KEV, prior reopen conditions unmet
• borderline-drop: Ivanti CSA 5.0.8.1: relay-only and contradicted by its own table, Ivanti pages unreadable on every transport
• borderline-drop: Microsoft 365 outage MO1550821: outage, not an attack
• borderline-drop: Poland ePUAP: attack repelled per the ministry, no vector or actor
• borderline-drop: Mittwald MCP breach: out-of-nexus hosting provider, cause is the vendor claim alone
• borderline-drop: Operation Endgame Gootloader, CastleRAT and StealC takedown: commodity loaders, no Swiss defender step named
• borderline-drop: Symantec AI-assisted retailer intrusion, Unit 42 CL-STA-1238 Cairn AI framework: out of nexus or already saturated in the store
• borderline-drop: Elastic SANSAR Ray GPU cryptomining, Akamai StrikeStub: niche hosts or a single sample, no defender decision (StrikeStub delivers a ClickFix lure from a compromised Swiss site that Akamai does not name, and ClickFix delivery is already covered, so there is no named Swiss victim to act on)
• borderline-drop: React Flight CVE-2026-126187: application-code preconditions, no exploitation or PoC, advisory date discrepancy (2026-10-14 vs 2026-11-10)
• borderline-drop: Fireworks AI and Notion AI, FBI/DOJ FaceStealer: supplier read-across or a single secondary source with no constituency link
• borderline-drop: CNIL ten sanctions on French authorities: swept by the 2026-11-10 fire, outside the window, generic failings
• borderline-drop: Liechtenstein VwbP audit tender, Bitdefender Threat Debrief November 2026: governance-only delta or periodic statistics
• borderline-drop: Patch Tuesday uncovered 9.8 rows (Xbox Live, Media Foundation, Color Management, DirectMusic, VFP): client-side, exploitation unlikely, fixed by the same cumulative update

Contradictions and source conflicts: the ScreenConnect SCKit entry keeps the Huntress and Blackpoint explanations of the delivery path attributed to each source rather than merged; the CNA record CVE-2026-127063 was added as a structured field. The Citrix CVE-id collision above is the only structural data defect found.

Dropped by verification: the Saxony emergency pager entry (heise and Spiegel, one informant for the message content, no access vector or actor) fell below the incident floor and was removed before publish; it carried no CVEs, so no state needed unwinding.

Dedup: the four entity-overlap WARNs are deliberate decisions, not deltas: SignDrop shares the Windows entity with the Mark-of-the-Web zero-day and eMudhra entries, DarkLunnen the FortiOS entity with the October hardening-release entry, and the Huntress kit the Microsoft 365 entity with the Q3 email-landscape entry; each is a distinct finding on a ubiquitous platform.

Verification: six iterations, no double-CLEAN. Iteration 1 found 27 truth and editorial findings (18 truth, 9 editorial; the Saxony pager entry was dropped for falling below the incident floor), iteration 2 found 7, iteration 3 found 3, iteration 4 found 10 (the main one a Citrix bulletin revision that corrected seven CVE numbers, so the entry now carries 29 records), iteration 5 found 4, and iteration 6 returned NEEDS_FIXES with truth 1 (a citation split on the Check Point update section), editorial 0 and advisory 4, no F1 or F4, so decision rule 5 applied: the finding was fixed, the gate re-run clean (59 pass, 0 fail) and the fire published on that early exit without a seventh pass. The one residual truth finding is fixed but unverified by a further cold pass, as are two last advisory edits (the Citrix body wording and a BleepingComputer government-accounts clause on the WFX Phantom entry); the audit should give the Citrix, Check Point and WFX Phantom entries an independent read. Declined with rationale: the Citrix priority (kept high), the Cisco BroadWorks KEV item, the StrikeStub drop, the Copeland download-page citation date and the .NET Exposure Windows clause.

Operational notes: the jina reader pool is dead (every key HTTP 402, the anonymous tier 401), so pages that only the reader could serve were read by WebFetch or left unconfirmed. Research worker S1 left 18 stray scratch files at the filesystem root (/atlassian.*, /depthfirst.*, /nextjs.*, /picus.*, /qnap.*, /qnap_news.*, /ruby.*, /yeswehack.*, /znuny.*, each a .err plus a .txt, .json or .html); the sandbox safety check denied deleting them and the run did not work around it, so the operator may remove them. They hold fetch scratch output only and are not part of the repo.

Source health: all 314 records read clean after the sweep (UNSOLVED list cleared in the same run). Fixed: ahnlab-asec (WebFetch reads it, every in-container transport is refused with a bare 403; tools/source_health.py now classes a webfetch record whose direct transport is refused with 401/403/429/451 as webfetch-only, with a test in tools/test_source_health.py), schneier (health recipe now reads the home page through extract, the atom-feed titles alone carried too little vocabulary) and mozilla-ca-compliance-bugzilla (content_scope: general-news, the REST rows are CA incident titles). Recipe notes recorded for kaspersky-securelist, rapid7-research, huntress, checkpoint-support, citrix-netscaler-security-bulletins, picus-security-blog and connectwise-trust-center (working fetch target: the ConnectWise CNA disclosure repository on GitHub). Candidate sources added: cyderes-howler-cell, huntback, blackpoint-cyber (each with its reason in sources.json); arctic-wolf-labs, maire-info and dysruptionhub were proposed by the slices and left for a later run.

• Essential-coverage: every essential record was attempted. Coverage gaps: connectwise-trust-center (403 on every transport; GitHub disclosure repository substitutes), sygnia (403 on every transport), databreaches.net article pages (Cloudflare interstitial; feed pages only), Ivanti pages (unreadable on every transport), Atlassian bulletin index (stale extract), europol-newsroom (JS application, headline only).
• Watchlist: none configured.