2026-11-14T0255Z-intel

Verification & coverage notes

Window: standard 26 h (gap to the previous fire 24.0 h). KEV sweep: two additions in the window. CVE-2026-123039 (Check Point) is covered by an entry that already says exploited, so the listing is bookkeeping and became an internal record that adds the cisa-kev status; CVE-2026-114713 (UnrealIRCd) is a borderline-drop below. No ransomware-flag flips on covered entries. No closed-source drops present (S5 not spawned). Five new entries and five changelog records (four updates, one internal improvement); no deep dive and no critical. The will-publish set exceeded eight items, so the Phase 4 deep read was delegated to five scoped cti-research workers (DR-A to DR-E, saved bodies under work/<run-id>/dr/); three of them did not report call telemetry (null above). Phase 0 deviations: the entity registry (738 KB) was searched with grep rather than read whole, and of the 100 prior-coverage records the 48 newest were read in full and the older 52 as title, headline and key projections (those were last active before 2026-11-11).

Backlog: the ChimeraZ / Hainaut-Est (ZOHE) row stays held; S2 and S4 searched in French, Dutch and German and found no confirmation, expiry 2026-11-17 unchanged.

Inclusions with reduced confidence or carve-outs:

• Luna Moth token handoff (notable): single vendor source (ReliaQuest, which sells the platform it recommends), no independent confirmation; credibility B3, verification: single-source; admitted through the rotational-lookback rule (d) and PD-11(d).
• CyberStrikeAI against AWS (notable): Elastic is the only source for the intrusion, Team Cymru documents only the tool; Elastic does not know how credentials were obtained.
• Kaspersky BlackNevas vCenter case (notable): single vendor source; victim, sector, country and vector unstated; kept distinct from the 2026-11-07 Kaspersky case in references[].
• Red Hat Quay (notable): vendor CNA records plus NCSC.ch restatement; a third-party repository claims a lab proof of concept for CVE-2026-110697 and is not linked; exploitation: unknown.
• GitLab critical patch and Git 2.56.1 (notable): admitted under the out-of-band limb of PD-11(b) (GitLab's ad-hoc critical patch release); CVSS 7.5 in GitLab's CNA record against a Critical label on its patch page, printed as stated.
• Ivanti EPM update: NCSC-NL's statement of public PoC code is the only source and names none; the only repository found is a third party's lab model; priority kept at notable.

borderline-drop lines:

• borderline-drop: CVE-2026-114713 UnrealIRCd 6.0.0 to 6.2.7 (KEV 2026-11-13, vendor says exploited), no constituency nexus (IRC networks with two or more linked servers); doubt about relevance resolves to drop.
• borderline-drop: PostgreSQL 18.7/17.12/16.16/15.20/14.25 (52 CVEs, 32 at 8.8; PostgreSQL 14 final release), scheduled minor release inside the regular cycle, 43 of 52 need a low-privileged SQL role, no exploitation or public PoC.
• borderline-drop: Node.js November 2026 security releases (16 CVEs, 7 high), regular release; each high needs a specific handler pattern; no exploitation.
• borderline-drop: AXIS Camera Station CVE-2026-13312 (9.9), dropped again: no mechanism published, no exploitation, fix for Camera Station 5 planned for November.
• borderline-drop: Fortinet FG-IR-26-268 revision (IPS virtual patch), no exploitation and no material delta for a flaw the entry already tells readers to upgrade for.
• borderline-drop: Microsoft Patch Tuesday "Exploitation More Likely" network RCEs (Schannel CVE-2026-119952, NAT CVE-2026-113862, 8.1, high complexity), would not change the decision (install the November cumulative update).
• borderline-drop: Operation Endgame round against Gootloader, CastleRAT and StealC (Europol 2026-11-12), no Swiss agency or victim named; narrow defender consequence.
• borderline-drop: Microsoft 365 / Exchange Online global outage of 2026-11-12/13, not an attack; root-cause report pending.
• borderline-drop: Saxony emergency-service pager exposure, out-of-window: heise 2026-11-12T15:19Z precedes the window start 2026-11-13T00:57Z, already dropped by the previous fire's verification; Swiss pager status unverified.
• borderline-drop: Quantum Systems QBase update-server compromise, no Swiss customer shown, access route and malware function unpublished, no actor named, core facts rest on unnamed sources; re-check on a Swiss nexus or a technical disclosure.
• borderline-drop: Elastic and Talos agentic-framework internals (ARTEX, CyberStrikeAI, Cairn, PentAGI, HexStrike), no campaign news; ARTEX behavior already covered; the concrete hunt is in the CyberStrikeAI entry.
• borderline-drop: Huntress fake crypto-exchange sessions on 118 self-hosted ScreenConnect servers, no malicious activity observed; the bait hypothesis for CVE-2026-84869 is unobserved.
• borderline-drop: FaceStealer (FBI FLASH / DOJ), DPRK crypto-theft scheme against developers; Swiss public-sector nexus only indirect.
• borderline-drop: SOCRadar XaocMail, Phantom53 and Havoc, single C-reliability vendor source, no victims, no corroboration.
• borderline-drop: GeoVision camera software abuse (Huntress, 13 organisations), initial exploit unnamed, no CVE, cryptominer impact.
• borderline-drop: Project Zero "Full 90" disclosure policy, vendor policy effective 2027, no near-term patch or hunt decision.
• borderline-drop: Sysdig on CVE-2026-119618; the covered entry already states the public crash test without code execution.
• borderline-drop: Cisco BroadWorks CVE-2026-20320 and Openwave CVE-2026-111793 (KEV 2026-11-10), drop stands; Cisco's v1.2 of 2026-11-13 says no direct evidence of exploitation.
• borderline-drop: Mitel MX-ONE MISA-2026-0011, Zoom ZSB-26023/-24, Adobe AEM APSB26-189, OneNote CVE-2026-126526, .NET November servicing, Chrome 157/158 rows, the Siemens and CISA ICS November set, Synology, Zammad, n8n, NATS, OpenCTI, Linksys, Edito CMS, Palo Alto Low and Medium batch, S1 dispositions stand: authenticated, user-interaction, LAN-only, already dropped by earlier fires, or below the bar.
• borderline-drop: Poland ePUAP, Maileva 22M claim, Mittwald MCP intrusion, Softway Medical, CHU de Reims, French communes, Trezor, Widerøe, TSMC, Curious Worm, ICO Somerset, S4 dispositions stand: out of nexus, no vector or actor, single-outlet claims, or not a breach.

Notes for the next audit: the GitLab work-item pages that DR-D fetched returned site boilerplate containing instructions addressed to AI agents; the worker ignored them and nothing from those pages was used or cited. The Danfoss entry's main analysis was rewritten from 702 to under 550 words (the recap of earlier waves lives in its update sections). Danfoss, ScreenConnect and N-able entries were already at or near the 550-word bound, so each delta replaced earlier sentences instead of adding to them. postgresql-security was proposed by S1 as a candidate source and not added. Midnight Blue's own post is not cited as primary on the Danfoss entry because it is a discoverer's report relayed by two authorities.

Verification: three iterations of the single cold-reader definition, none CLEAN. Iteration 1 returned 13 truth, 3 editorial and 4 advisory findings (attribution drift, a dropped hedge, citation dates, one mis-parented process claim), iteration 2 returned 3 truth and 2 advisory, iteration 3 returned 1 truth and 1 advisory with no F1 or F4; every claim of the ledger was walked on each pass and the full gate was green before the first spawn. The loop ended under the low-residual early exit (truth plus editorial at most 2, no F1 or F4): the one remaining finding, a GitLab clause that needed the maintainers' announcement cited next to GitHub's, was fixed after iteration 3 and the entry was not re-verified, so verification_residual_count is 1. The Ivanti priority finding (notable against high) was declined with a rebuttal recorded above and accepted by the iteration-2 verifier. Two advisory findings stand unchanged: the N-able and ScreenConnect titles and summaries have accreted across records, and the Danfoss second action is long.

Self-evolution: the end-of-run health sweep flagged cisa-news (a fetch_method: webfetch record) as needing a bridge because its content check was read through the reader while reachability was ua-blocked, which the v4.18 webfetch-only rewrite does not cover. tools/source_health.py gained _webfetch_reach_wall, tools/test_source_health.py a test (15 of 15 pass), and a second sweep ended with no unsolved record. No prompt, agent definition or site file changed, so no prompt version bump applies.

Coverage gaps: connectwise-trust-center (403 on every transport; the CNA disclosure repository was read instead); sygnia (403 on every transport again); lab52 (every direct transport reset the connection); belden-psirt (403); schneier atom feed (403, recovered through extract of the home page); ox-security article pages (403, feed readable); uptime.n-able.com (script shell: N-able statements after 2026-11-10 are as relayed); quantum-systems.com statement (403); ico-uk was absent from S2's slice and was attempted by S4 (recipe ico-uk enforcement 15 works again).