2026-W22-da77963d

• [SINGLE-SOURCE] items carried into this summary: the Cisco Talos DICOM/Orthanc heap analysis (§ 4, single research-lab source — a technical study, not an incident claim); the Red Canary Entra Agent ID privilege-escalation detection (§ 2, single-vendor); Delta DIAView CVE-2026-9642 (§ 3 table / § 9, Tenable-only, no vendor patch). Each is attributed to its single source in place.
• Reduced confidence / single-primary: the EU CRA milestone item (§ 8) rests on the European Commission implementation factpage as a single primary — the dates are authoritative but uncorroborated by a second source this run. The Check Point Q1 2026 ransomware figures (§ 6) are single-vendor leak-site telemetry; group-share and victim-count numbers are treated as directional landscape signal, not precise measurement, and no vanity metrics were carried into the prose.
• Items dropped from this week's roll-up (cleared the daily bar, not the weekly W-PD-1 bar): the Underminr CDN domain-fronting research, Atos BYOVD-driver study, Google Cloud API-key deletion-latency, Tycoon 2FA AiTM detection-engineering, Lazarus RemotePE memory-only RAT, Wiz JINX-0164 crypto-targeting, and the SANS ISC Akira-from-syslog reconstruction were folded by reference or dropped — interesting in isolation but not inaction-=-incident / cross-day-pattern / strategic-horizon. The GitHub Enterprise SSRF (CVE-2026-9312) and the Rancher / Portainer / Veeam / GitLab patch clusters appear in the § 3 table without H3s (patched, no in-window exploitation). They may resurface if exploited.
• Carry-forwards resolved this week: the W21 watch on the UNC6671/BlackFile rebrand (GTIG profile + "shutting down under this name", § 7), on Shai-Hulud wave-6 registries (npm @antv ecosystem confirmed hit; Maven Central exposure via mvnpm reported in secondary sourcing but not confirmed against a primary this run; Cargo status unverified, § 7), and on the SECO/MSS sanctions question (Switzerland deferred the MSS ban, § 8) are all closed. The GitHub internal-repo post-incident report remains outstanding and carries forward to W23.
• Contradictions / open items: none unresolved this run. No European Commission interpretive guidance on the EU MSS-prohibition scope has been published, so a conservative reading stands (§ 8).
• Sub-agents: both horizon sub-agents (W1 long-horizon, W2 policy) ran on Claude Sonnet 4.6 and returned within budget (W1 311s, W2 387s). Both were cut off at the very end of their runs before emitting their closing Markdown return; their findings were recovered intact from the committed work/2026-W22-da77963d/findings.W1.yaml / findings.W2.yaml, the agents' completion summaries, and the url-liveness.tsv ledger (every cited primary verified 200 OK). No candidate sources surfaced this run.
• Verification iterations: 3 — iter-1 (Opus) NEEDS_FIXES (truth=3, editorial=1, advisory=1); iter-2 (Sonnet) NEEDS_FIXES (truth=4, editorial=1, advisory=1); iter-3 (Opus) CLEAN. Model rotation applied across iterations. Residuals: 0. Remediated across the loop: an unverified Maven/Cargo "confirmed" claim (downgraded to unconfirmed), an ENISA maturity-band miscategorisation, the Asocks name-attribution, the Samba config-dependence of both 10.0 paths, a CVE mislabel (CVE-2026-45585 is YellowKey, not MiniPlasma; MiniPlasma is CVE-2020-17103), the German-hackback per-agency overstatement, and an ESET "Sandworm vs NATO energy" overstatement (one rare Polish-energy incident).
• Coverage gaps: databreaches-net (403 — transport, bridge-routed); sophos-xops (503); inside-it-ch (Cloudflare 403); cert-fr-actu (feed stalled); ec-presscorner (SPA, no static content); bmi-bund-de (bridge returned empty); enisa-nis360-pdf (full PDF not fetched — analysis page used instead); GovCERT.ch (no Shai-Hulud developer advisory exists — confirmed absent, not a fetch failure).

Migrated from briefs/weekly/2026-W22.md (v2).