2026-W26-b78503e7

• Single-source / attributed claims. The "second extortion group" in the Klue/Icarus item (§ 2) and its claim of ~195 listed organisations rest on a single primary (The Next Web, relaying a private Klue customer update obtained by TechCrunch); the allegation that Klue paid the original Icarus operator is unverified and is attributed as a claim, not stated as fact. The NAIC 3.1 TB figure is ShinyHunters' own claim relayed by tech press; NAIC confirms the breach and the rating-feed pause but not the volume. The "Switzerland is the second-most-targeted European country" ranking for The Gentlemen (§§ 0, 8) rests on a single source (inside-it.ch relaying Check Point data); the co-cited ESET paper does not state a European country ranking, and inside-it.ch returns 403 to the routine's fetcher, so the specific ranking could not be independently re-verified this run — it is attributed, not asserted as established fact.
• Unresolved contradiction. Texas Parks & Wildlife (§ 5): the daily flagged a discrepancy between the public statement and the state AG filing over whether SSNs were exposed; unresolved this week, carried as a confidence caveat.
• Items considered and dropped (may resurface). RoguePlanet (CVE-2026-50656) — carried in the W25 looking-ahead but no fresh in-window source on a Microsoft fix, so dropped rather than re-asserted stale. eBanking IPv4-mapped-IPv6 phishing (06-22), the Brazil Cell Broadcast hijack (single-source, beyond audience nexus beyond the § 4 mention), Arystinger botnet (06-22), Prinz Eugen ransomware (06-21) and Payouts King/Edgecution (06-25) did not clear W-PD-1 (inaction-=-incident / cross-day pattern / strategic horizon) and were left to the dailies. The MISP 2.5.42 CVEs (06-25) and ILIAS SQLi (06-23) are folded into §§ 3–4 rather than given standalone roll-up entries.
• Reduced confidence. StrikeShark China-nexus attribution is Kaspersky's low-confidence assessment and is reported as such (§ 6).
• libssh2 patch-status caveat (§ 3). The GHSA references an upstream fix commit and NCSC-NL NCSC-2026-0210 is titled as a fix advisory, so the item is marked patch-available; however, tagged-release availability lags across the binding/appliance ecosystem, so a given deployment may still be effectively unpatched pending its embedding vendor's release. Treat patch-available as "fix exists upstream," not "your appliance is fixed."
• Sub-agents. Both horizon sub-agents (W1 threat-actor/campaign/research; W2 strategic/policy) returned within cap. No coverage axis was abandoned.
• Verification iterations: 5 · residuals: 0 — verdict CLEAN on iteration 5, with model rotation across iterations (opus on 1/3/5, sonnet on 2/4). Iterations 1–4 remediated ~21 findings (URL corrections, an MSG→ShinyHunters attribution overclaim, a Miasma quantifier inflation, a Netherlands NIS2 "transposition done" factual overclaim, and several date/citation-anchor gaps); iteration 5 found no truth or editorial defects.
• Coverage gaps: databreaches-net (transport-403, 3rd consecutive run — content reached via GTIG/SecurityWeek primaries instead); mandiant-gtig (RSS feed returned IncompleteRead, content obtained via WebSearch + the GTIG blog directly); inside-it-ch (Cloudflare-challenged for the W2 sub-agent UA, but the 06-26 Gentlemen article was reachable and is cited). W2 "outside-window" sources (cert-eu, edpb, bsi-de, enisa-nis360, cisa-directives) were quiet in-window, not failed fetches. The end-of-run tools/source_health.py accessibility probe did not complete inside its budget in this container (slow under the egress proxy) and was stopped so it would not block publish; the prior committed snapshot (from the 2026-06-28 daily run) stands and the next run re-probes.

Migrated from briefs/weekly/2026-W26.md (v2).