@blamejs/exceptd-skills 0.18.29 → 0.19.0

package/data/cwe-catalog.json

@@ -243,6 +243,7 @@
       "CVE-2026-30624",
       "CVE-2026-30625",
       "CVE-2026-42271",
+      "CVE-2026-8037",
       "MAL-2026-3083"
     ],
     "framework_controls_partially_addressing": [
@@ -1771,7 +1772,8 @@
       "CVE-2026-45247",
       "CVE-2026-45659",
       "CVE-2026-50522",
-      "CVE-2026-58644"
+      "CVE-2026-58644",
+      "CVE-2026-63077"
     ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",

package/data/exploit-availability.json

@@ -87,11 +87,11 @@
     "poc_description": "Chain component — exploits ESP/IPsec subsystem. Requires combination with CVE-2026-43500 or independent gadget chain.",
     "weaponization_stage": "partially_weaponized",
     "ai_discovery_confirmed": true,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "bug_bounty_ai_augmented",
     "ai_assist_factor": "high",
     "ai_discovery_notes": "Disclosed by Hyunwoo Kim; AI-assisted discovery assessed as likely by Sysdig + Help Net Security given 9-year exposure gap (ESP path landed Jan 2017) and same primitive class as AI-discovered Copy Fail.",
     "exploit_complexity": "moderate",
-    "last_verified": "2026-05-15",
+    "last_verified": "2026-08-08",
     "verification_source": "NVD references, researcher (Hyunwoo Kim) disclosure, Sysdig analysis, Help Net Security"
   },
   "CVE-2026-43500": {
@@ -99,11 +99,11 @@
     "poc_description": "Chain component — RxRPC subsystem. Used with CVE-2026-43284.",
     "weaponization_stage": "partially_weaponized",
     "ai_discovery_confirmed": true,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "bug_bounty_ai_augmented",
     "ai_assist_factor": "high",
     "ai_discovery_notes": "Co-disclosed sibling of CVE-2026-43284; same AI-assisted-discovery assessment applies.",
     "exploit_complexity": "moderate",
-    "last_verified": "2026-05-15",
+    "last_verified": "2026-08-08",
     "verification_source": "NVD references, researcher (Hyunwoo Kim) disclosure, Sysdig analysis"
   },
   "CVE-2026-45321": {
@@ -141,7 +141,7 @@
     "exploit_class": "deterministic LPE primitive",
     "maturity_tier": "PoC",
     "ai_discovery_confirmed": true,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "bug_bounty_ai_augmented",
     "ai_assist_factor": "very_high",
     "ai_discovery_notes": "Discovered by William Bowling (Zellic.io / V12 security team) with assistance from Zellic's AI-agentic code-auditing tool. Anchor case for AI-driven autonomous discovery in 2026; cycle-5 backfill correction to the originally-tagged ai_discovery_confirmed=false.",
     "ai_assisted_weaponization": false,
@@ -150,7 +150,7 @@
     "active_exploitation": "none",
     "discovered_at": "2026-05-13",
     "poc_observed_at": "2026-05-13",
-    "last_verified": "2026-05-14",
+    "last_verified": "2026-08-08",
     "verification_source": "NVD CVE-2026-46300, V12 security team disclosure, AlmaLinux + CloudLinux advisories, Microsoft Security Blog (Dirty Frag family analysis)"
   },
   "CVE-2024-21626": {
@@ -162,9 +162,9 @@
     "ai_assist_factor": "low",
     "ai_assisted_weaponization": false,
     "exploit_complexity": "low",
-    "active_exploitation": "confirmed",
-    "last_verified": "2026-05-15",
-    "verification_source": "NVD, CISA KEV, Snyk Labs Leaky Vessels disclosure"
+    "active_exploitation": "none",
+    "last_verified": "2026-08-08",
+    "verification_source": "NVD, Snyk Labs Leaky Vessels disclosure, CISA KEV catalog (checked 2026-08-08: not listed, and never listed — the catalog carries no entry added on the previously-claimed 2024-04-08)"
   },
   "CVE-2024-3094": {
     "poc_status": "public",

package/data/framework-control-gaps.json

@@ -1169,7 +1169,9 @@
       "CVE-2026-58644",
       "CVE-2026-60137",
       "CVE-2026-63030",
+      "CVE-2026-63077",
       "CVE-2026-6973",
+      "CVE-2026-8037",
       "MAL-2025-AI-FOUND-FFMPEG-BIGSLEEP"
     ],
     "atlas_refs": [],
@@ -1751,6 +1753,7 @@
       "CVE-2026-42897",
       "CVE-2026-42945",
       "CVE-2026-45321",
+      "CVE-2026-8037",
       "MAL-2026-3083",
       "MAL-2026-MOIKA-DEPCONFUSION",
       "MAL-2026-NODE-IPC-STEALER",
@@ -3059,6 +3062,8 @@
       "CVE-2026-58644",
       "CVE-2026-60137",
       "CVE-2026-63030",
+      "CVE-2026-63077",
+      "CVE-2026-8037",
       "CVE-2026-9082"
     ],
     "atlas_refs": [],
@@ -5172,8 +5177,10 @@
       "CVE-2026-58644",
       "CVE-2026-60137",
       "CVE-2026-63030",
+      "CVE-2026-63077",
       "CVE-2026-6973",
       "CVE-2026-7473",
+      "CVE-2026-8037",
       "CVE-2026-9082"
     ],
     "atlas_refs": [],
@@ -9596,9 +9603,11 @@
       "CVE-2026-58644",
       "CVE-2026-60137",
       "CVE-2026-63030",
+      "CVE-2026-63077",
       "CVE-2026-6973",
       "CVE-2026-7473",
       "CVE-2026-7482",
+      "CVE-2026-8037",
       "CVE-2026-8398",
       "CVE-2026-9082",
       "CVE-2026-9198",
@@ -9942,6 +9951,7 @@
       "CVE-2026-31229",
       "CVE-2026-31230",
       "CVE-2026-48027",
+      "CVE-2026-63077",
       "CVE-2026-8398",
       "MAL-2025-PYPI-COLORAMA-SOLANA-STEALER",
       "MAL-2026-MOIKA-DEPCONFUSION",

package/data/zeroday-lessons.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.1.0",
-    "last_updated": "2026-08-06",
+    "last_updated": "2026-08-08",
     "last_threat_review": "2026-05-17",
     "purpose": "Zero-day learning loop output. Each entry maps a CVE to: attack vector, defense chain analysis, framework coverage, new control requirements generated, and exposure scoring. v1.1.0 (2026-05-15): every entry now carries ai_discovered_zeroday boolean + ai_discovery_source enum + ai_discovery_date + ai_assist_factor ladder, per AGENTS.md Hard Rule #7.",
     "note": "Never delete entries. Closed gaps are marked status: closed. History is data.",
@@ -17,7 +17,7 @@
       "rebuild_after_days": 365,
       "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
     },
-    "entry_count": 1023
+    "entry_count": 1025
   },
   "CVE-2026-31431": {
     "name": "Copy Fail",
@@ -1139,7 +1139,7 @@
         "id": "NEW-CTRL-028",
         "name": "CONTAINER-RUNTIME-PATCH-SLA-24H",
         "description": "Container-runtime CVEs (runc, containerd, CRI-O) listed in CISA KEV require a 24-hour mitigation SLA. Container restart is a hard requirement — runc patches do not apply to already-running containers.",
-        "evidence": "CVE-2024-21626 — KEV-listed 2024-04-08 with confirmed active exploitation; patch requires container restart, not just package update.",
+        "evidence": "CVE-2024-21626 — a container-escape flaw in runc, the runtime under Docker, containerd, Kubernetes and podman, where remediation means replacing the runtime binary and restarting every container rather than applying a package update. Not CISA KEV-listed, so no federal deadline forces the restart; the SLA has to come from the organisation's own runtime-patch policy.",
         "gap_closes": [
           "NIST-800-53-SC-39",
           "CIS-Kubernetes-Benchmark-5.7"
@@ -3591,7 +3591,7 @@
         "id": "NEW-CTRL-001",
         "name": "CISA-KEV-RESPONSE-SLA",
         "description": "4h KEV-listing mitigation SLA applies; breach-confirmed exploitation makes this load-bearing.",
-        "evidence": "CVE-2025-1094 — KEV-listed 2025-02-13; BeyondTrust + US Treasury breaches.",
+        "evidence": "CVE-2025-1094 — used in the BeyondTrust Remote Support intrusions reported by Rapid7, chained with CVE-2024-12356 (KEV 2024-12-19) and CVE-2024-12686 (KEV 2025-01-13). The KEV response clock reaches this flaw through those chain partners rather than through a listing of its own, which is exactly the case a KEV-triggered SLA has to cover: the unlisted link in a listed chain.",
         "gap_closes": [
           "NIST-800-53-SI-10",
           "PCI-DSS-4.0-6.2.4",
@@ -58371,5 +58371,186 @@
         ]
       }
     ]
+  },
+  "CVE-2026-63077": {
+    "name": "JetBrains TeamCity Deserialization of Untrusted Data Vulnerability",
+    "lesson_date": "2026-08-08",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": "2026-08-05",
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "An unauthenticated attacker POSTs to TeamCity's agent-polling endpoint /app/agents/v1/register to enroll a synthetic build agent (agentAddress=127.0.0.1, agentPort=9090, a random authToken) and receives a TeamCity-AgentSessionId, then posts an XStream XML gadget chain to /app/agents/v1/commands/error carrying that session header. XStream 1.4.20.3 is configured with an allowlist that retained the library's default type permissions, so the document deserializes into a working chain that drives an in-memory HSQLDB SCRIPT command and writes a JSP polyglot to ../webapps/ROOT/<hex>.jspws. A single GET of the dropped file compiles the polyglot and runs java.lang.Runtime.getRuntime().exec() with the attacker's OS command as the TeamCity server process - one unauthenticated request chain from network reachability to code execution over the whole CI secret store and build-artifact surface.",
+      "privileges_required": "none - CVSS PR:N. The exploit mints its own agent session at /app/agents/v1/register, so no TeamCity account, API token or agent authorization token is required; the only precondition is network reachability to the server.",
+      "complexity": "low - AC:L/UI:N/S:U. The gadget chain is deterministic, there is no race and no user interaction, and Rapid7's 446-line Python PoC reduces the whole path to one command. CISA's SSVC decision records exploitation=active, automatable=yes, technicalImpact=total.",
+      "ai_factor": "Not AI-discovered - reported privately to JetBrains by external researcher Antoni Tremblay on 2026-07-10 and disclosed with a fix on 2026-07-27; the public exploit was hand-written by Rapid7's Stephen Fewer. No AI tooling is credited in the JetBrains advisory, the JetBrains active-exploitation update, the Rapid7 root-cause analysis, or the PoC, and no AI assistance is documented in weaponization."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade TeamCity On-Premises to 2025.11.7 or 2026.1.3, or install JetBrains' security patch plugin (available for 2017.1+, hot-loads without a restart on 2018.2 and later), and keep the agent-polling surface off untrusted networks so /app/agents/v1/register is unreachable from the internet in the first place.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 26-04 (KEV remediation, added 2026-08-05)",
+        "adequacy": "The upgrade removes the deserialization sink outright and needs no live-patch tooling, but the fix shipped 2026-07-27 and exploitation followed within days, so patching alone does not account for the window between disclosure and deployment: any server that was internet-reachable during it must be treated as potentially compromised rather than merely patched. TeamCity Cloud was mitigated by JetBrains and required no customer action."
+      },
+      "detection": {
+        "what_would_have_worked": "Grep teamcity-server.log for com.thoughtworks.xstream.converters.ConversionException (attempted or successful exploitation) and com.thoughtworks.xstream.security.ForbiddenClassException naming HSQLMetadataStorage$SchemaMismatchException (a blocked attempt on a patched server), alongside freemarker.core._TemplateModelException on the 'connection' property and org.hsqldb.HsqlException 'file input/output error' for .jspws paths; alert on build agents registering with 'scan'-prefixed names; and file-integrity-monitor webapps/ROOT for unexpected *.jspws files.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "These signals are high-fidelity and free to deploy, but on an unpatched server they are post-compromise: the ConversionException is only written once the gadget chain has already deserialized, and the .jspws artifact only appears after the webshell is on disk. The ForbiddenClassException on a patched server is the one pre-impact signal, and it exists only because the patch already blocked the class."
+      },
+      "response": {
+        "what_would_have_worked": "Remove every *.jspws file from the TeamCity webroot, delete attacker-registered agents (notably the 'scan'-prefixed ones JetBrains named), rotate all credentials the server held - VCS tokens, artifact-repository and cloud keys, signing material, agent authorization tokens - and review builds and artifacts produced during the exposure window for tampering before they propagate downstream.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Credential rotation is the only reliable containment, because execution as the TeamCity server process reads the entire CI secret store, and artifact review is the only way to bound downstream impact on the pipelines the server feeds. Nothing in scope mandates either step after a build-server compromise, so operators who treat the upgrade as closure leave stolen secrets valid and tampered artifacts unexamined."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "SI-2 had almost no slack to work with here. JetBrains shipped the fix on 2026-07-27, reports of in-the-wild exploitation of the unauthenticated agent-polling RCE followed within days, and CISA allowed three days on the KEV clock (added 2026-08-05, due 2026-08-08). An SI-2 flaw-remediation cadence measured in weeks - which is what most implementations actually attest to - leaves an internet-facing TeamCity server exploitable for the entire period an automatable, PoC-backed pre-auth RCE is being weaponized."
+      },
+      "NIS2-Art21-supply-chain": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Art.21's supply-chain clauses point outward at supplier vetting and third-party assurance, but the injection point here is the organization's own build server. Code execution as the TeamCity process reads the CI credential store, tampers with build artifacts and reaches every downstream pipeline the server feeds - a supply-chain compromise originating inside internal build infrastructure that no amount of supplier due diligence detects or prevents."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "CAF B4 secure-configuration outcomes assume untrusted network input never reaches an unsafe deserializer, so the operator-side measures B4 drives - configuration baselines, hardening guides, firewalling - never inspect the XStream 1.4.20.3 allowlist that shipped with the library's default type permissions retained. The unauthenticated /app/agents/v1/commands/error path deserialized attacker XML into a working gadget chain by product design, and no B4 activity remediates that short of the vendor fix."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The 48-hour internet-facing patch requirement was technically satisfiable - the fix existed from 2026-07-27 - but Essential Eight never asks whether a CI server should be internet-facing at all. With no control requiring network isolation of the build plane, an instance still reachable while the 48-hour clock ran was exposed to a one-shot, automatable pre-auth RCE, and the maturity model records a compliant patching outcome either way."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A.8.8 programmes that rank remediation by score would have buried this: EPSS read 0.010 (58th percentile) on the KEV date even though JetBrains had already reported exploitation in the wild. A CVSS-plus-EPSS queue defers a 9.8 unauthenticated RCE behind higher-probability, lower-impact items; the KEV listing and the vendor's exploitation update were the real prioritization signals, and A.8.8 does not require them to override the probabilistic score."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For any CVE listed in CISA KEV: deploy verified mitigation (patch, live patch, or documented compensating controls) within 4 hours of KEV listing or patch availability, whichever is later.",
+        "evidence": "CVE-2026-63077 — JetBrains fixed it on 2026-07-27 and confirmed in-the-wild exploitation days later; CISA added it to KEV on 2026-08-05 with a 2026-08-08 due date while EPSS still read 0.010 (58th percentile), so score-driven queues deprioritized it. A KEV-triggered 4-hour clock — satisfied by the 2025.11.7 / 2026.1.3 upgrade, the 2017.1+ security patch plugin (no restart on 2018.2+), or documented isolation of the agent-polling surface — is the only cadence that beats a one-shot, automatable pre-auth RCE with a public 446-line PoC to an internet-facing build server.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "ISO-27001-2022-A.8.8",
+          "AU-Essential-8-Patch"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-125",
+        "name": "SERVICE-INTERNAL-PROTOCOL-DESERIALIZATION-HARDENING",
+        "description": "A server product that exposes an internal coordination protocol — build-agent polling, cluster membership, node replication, management RPC — must not deserialize input arriving on it without both authenticating the peer and constraining the deserializer to an explicit allow-list of expected types, and the listener must be bound to the coordination network rather than to all interfaces. Default-permissive type handling in the serialization library counts as no allow-list at all. The distinguishing test: from an unauthenticated host on a segment that can reach the coordination port, send a serialized object of a type the protocol never legitimately carries and confirm the connection is refused or the type rejected before any object is constructed — a product whose internal protocol is documented as trusted, but which listens on 0.0.0.0 and accepts whatever the library will rehydrate, is exploitable by anyone who can reach the port.",
+        "evidence": "CVE-2026-63077 — TeamCity's agent-polling protocol accepts XML from an unauthenticated caller and hands it to an XStream instance still carrying the library's default type permissions, so a gadget chain writes a JSP polyglot into the webroot and runs as the build server. CVE-2026-34486 is the same shape one product over: the Tomcat cluster receiver forwarding a message whose decryption failed into an unfiltered ObjectInputStream. Both are internal coordination protocols the vendor documented as trusted and shipped listening to anyone who could reach the port.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "UK-CAF-B4",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
+  },
+  "CVE-2026-8037": {
+    "name": "Progress LoadMaster Command Injection Vulnerability",
+    "lesson_date": "2026-08-08",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_date": "2026-08-07",
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "An attacker who can reach the LoadMaster management API sends one unauthenticated POST to /accessv2 whose apiuser value is nothing but single quotes, forcing escape_quotes() to allocate an uninitialized heap buffer it never null-terminates, while dozens of sibling JSON keys in the same request spray a shell-metacharacter payload across freed chunks of the same size. The escaped username is then placed into a single-quoted shell argument that reads past its own bytes into the sprayed data, and the appliance executes the attacker's command.",
+      "privileges_required": "none — PR:N; unauthenticated, and the quote-only apiuser is a trigger rather than a credential guess",
+      "complexity": "low — AC:L, no user interaction and no race; the constraint is reachability (AV:A, and only when the management API is enabled) rather than exploit difficulty",
+      "ai_factor": "Not AI-discovered. Reported through Trend Micro's Zero Day Initiative by Syed Ibrahim Ahmed and Jacky Yang of TrendAI Research (ZDI-26-340/341/342, all published 2026-06-09); the 'TrendAI' name is Trend Micro's branding for ZDI's research arm and is not a claim of AI-assisted discovery. No AI involvement is credited in any advisory or in the public analysis."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Upgrade to Kemp LoadMaster 7.2.63.2 (GA) or 7.2.54.18 (LTSF), or 7.2.63.2 for ECS Connection Manager and Connection Manager for ObjectScale — and, independently of the upgrade, disable the management API where it is not needed or confine it to a management network the attacker cannot reach.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 26-04 (KEV remediation, added 2026-08-07)",
+        "adequacy": "The upgrade closes it, but the configuration-side control is the one that was available for the two months between the 2026-06-04 fix and the 2026-08-07 KEV listing, and it needs no maintenance window. Neither helps an appliance already reached: command execution on the ADC precedes any patch."
+      },
+      "detection": {
+        "what_would_have_worked": "Alert on any /accessv2 request whose apiuser field contains a single quote, and on request bodies carrying repeated undefined sibling keys with identical padded values — then treat a 200 text/json response containing command output rather than an API result as confirmation.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Detection is unusually clean here because the trigger is a malformed username rather than a plausible one, so the signature has almost no legitimate traffic to compete with. It only works if the appliance forwards management-API request logs somewhere the attacker cannot reach once they own the device."
+      },
+      "response": {
+        "what_would_have_worked": "Treat a confirmed hit as full appliance compromise: rebuild from known-good firmware rather than patching in place, rotate every TLS private key and certificate the LoadMaster terminated, invalidate the API key store, and review the balanced applications for onward access gained through the device.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "Rebuild is the only reliable eviction path for an edge appliance, and key rotation is the part most often skipped — the attacker had code execution on the device holding the private keys for everything behind it."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "SI-2 is satisfied by a documented remediation cadence, and a monthly or quarterly appliance-patch cycle is a defensible one. It left roughly two months between Progress shipping the fix on 2026-06-04 and CISA's 2026-08-07 listing, during which watchTowr had published the patched function byte for byte and a Nuclei template was in the public catalog."
+      },
+      "EU-CRA-Art13": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Art.13 places the duty on the manufacturer to ship without known exploitable vulnerabilities, which does nothing for a deployer running an appliance already in the field. No CRA obligation tells the operator to treat their own edge ADC as an attack surface with its own patch clock, so a compliant purchase leaves the exposure exactly where it was."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "B4 records the appliance as hardened on the strength of its data-plane configuration and never asks the question that decides this CVE: is the management API enabled, and who can reach it. The single control that turns pre-auth RCE into an unreachable code path is outside what a B4 assessment routinely inspects."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The 48-hour band applies to internet-facing services, and a LoadMaster management API on a management network is often not classified as one, so the appliance inherits a slower target. The classification tracks network position rather than consequence, while CISA's SSVC rates the technical impact of this flaw as total."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "A.8.8 ranks by risk score, and here the score was loud enough — EPSS 0.85 at the 99.7th percentile. What it cannot express is that the asset is a control plane: compromising the ADC hands over the TLS keys, the traffic and the WAF that other A.8 controls assume are intact, so ranking it alongside an ordinary server patch understates the blast."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-001",
+        "name": "CISA-KEV-RESPONSE-SLA",
+        "description": "For any CVE listed in CISA KEV: deploy verified mitigation (patch, live patch, or documented compensating controls) within 4 hours of KEV listing or patch availability, whichever is later.",
+        "evidence": "CVE-2026-8037 — KEV-listed 2026-08-07 with a three-day due date against an appliance whose fix had been public since 2026-06-04 and whose patched function watchTowr had published byte for byte on 2026-06-29. The KEV clock's compensating-controls limb is what covers this case, because disabling or network-confining the LoadMaster management API removes reachability immediately and needs no maintenance window, while the firmware upgrade needs one.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "EU-CRA-Art13",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "Compliance frameworks must define a distinct patch SLA tier for pre-auth RCE on perimeter-trust-boundary devices (firewalls, VPN concentrators, WAFs, edge load-balancers). Tier requirement: vendor-mitigation deployed within 4 hours of KEV listing OR isolation of the vulnerable interface; standard 14/30-day SLAs do not apply because the device IS the trust boundary.",
+        "evidence": "CVE-2026-8037 — a pre-authentication command injection on a load balancer that terminates TLS for the applications behind it, rated EPSS 0.85 at the 99.7th percentile with a public Nuclei template. A standard 14- or 30-day appliance-patch SLA prices this like an ordinary server, which is exactly the mismatch a perimeter-device tier exists to correct: the device IS the trust boundary.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "EU-CRA-Art13",
+          "UK-CAF-B4"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "Pre-rehearsed IR runbook for any perimeter device that suffers a pre-auth RCE CVE in active exploitation MUST default to config-exfil + rebuild + credential rotation, not patch-in-place. Patch-in-place leaves attacker-installed implants intact.",
+        "evidence": "CVE-2026-8037 — exploitation yields OS command execution on the appliance holding the TLS private keys and API key store for everything it fronts, so patching in place leaves any implant and any stolen key material intact. Recovery has to default to rebuild from known-good firmware plus rotation of every certificate the LoadMaster terminated.",
+        "gap_closes": [
+          "NIST-800-53-SI-2",
+          "EU-CRA-Art13",
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   }
 }

package/lib/source-advisories.js

@@ -478,6 +478,16 @@ const ADVISORIES_SOURCE = {
   name: 'advisories',
   description: 'Primary-source advisory feeds (Qualys TRU, Red Hat RHSA, Ubuntu USN, Zero Day Initiative / ZDI) — surfaces CVE IDs disclosed at T+0 to T+1 that lag NVD enrichment. Report-only — does not auto-write the catalog.',
   applies_to: 'data/cve-catalog.json',
+  // The no-op applyDiff below already refuses to write, but the flag is what
+  // the *callers* read. refresh-external only counts a source toward the
+  // upsert total when `!report_only`, and the refresh workflow gates its apply
+  // step and its entire open-pr job on that total being non-zero. This feed
+  // reports every CVE seen across USN / RHSA / ZDI / CISA that the catalog
+  // does not track — structurally in the thousands, and never zero, because
+  // the catalog deliberately does not carry every Ubuntu kernel CVE. Leaving
+  // the flag off therefore pinned the upsert count permanently above zero and
+  // made "open a PR only when something changed" unconditional.
+  report_only: true,
   async fetchDiff(ctx) {
     const results = await Promise.all(FEEDS.map((feed) => checkFeed(feed, ctx)));
     const allDiffs = [];