@blamejs/exceptd-skills 0.20.1 → 0.21.0

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.20.1",
+  "version": "0.21.0",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -17,7 +17,7 @@
       "name": "kernel-lpe-triage",
       "version": "1.0.0",
       "path": "skills/kernel-lpe-triage/skill.md",
-      "description": "Assess Linux kernel LPE exposure — Copy Fail, Dirty Frag, live-patch vs. reboot remediation",
+      "description": "Assess Linux kernel LPE exposure — Copy Fail, Dirty Frag, Fragnesia, live-patch vs. reboot remediation paths, framework gap declarations",
       "triggers": [
         "kernel lpe",
         "privilege escalation",
@@ -56,8 +56,8 @@
         "RFC-7296"
       ],
       "last_threat_review": "2026-05-15",
-      "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
-      "signed_at": "2026-09-22T21:36:58.815Z",
+      "signature": "qF31mqZPI8ZUuuVXnV05yptx+4lZe5YX6IKIybbaqHdCQ2ELUusjgRA6Hm/G2T89mpM3iCIdnKUmUkd9A6nPDw==",
+      "signed_at": "2026-09-23T08:58:29.165Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -110,7 +110,8 @@
         "AML.T0096",
         "AML.T0016",
         "AML.T0017",
-        "AML.T0018"
+        "AML.T0018",
+        "AML.T0013"
       ],
       "attack_refs": [
         "T1566",
@@ -132,8 +133,8 @@
         "AU-Essential-8-App-Hardening"
       ],
       "last_threat_review": "2026-09-18",
-      "signature": "PfXydBMsoPgfPGfjtF30mO5L1m9zlrmyoMCqhbaVGiFyfR2oNg1rvohEdYZIQwISNwhRgYhGF0lqX2cC0Oc2AA==",
-      "signed_at": "2026-09-22T21:36:58.817Z",
+      "signature": "lwK5zyS1/TyNp0/Hh2ldlto8r0Tj0P6XWs0U0pSGjbMq7ldNnnUJDe1oLCWwvTj/fcTGPLOt51ZBGlGlGugBDA==",
+      "signed_at": "2026-09-23T08:58:29.167Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -184,7 +185,8 @@
       ],
       "atlas_refs": [
         "AML.T0010",
-        "AML.T0016",
+        "AML.T0053",
+        "AML.T0086",
         "AML.T0096"
       ],
       "attack_refs": [
@@ -214,8 +216,8 @@
         "RFC-9700"
       ],
       "last_threat_review": "2026-09-18",
-      "signature": "pZDdXCnXy1V6lP8Q7c3jih2bJSNaCYnWl3b+bn7OkooM0nr2OR3Hc5bytgIZbQhMVQSS6YqC5CSEh3OktD4oBA==",
-      "signed_at": "2026-09-22T21:36:58.817Z",
+      "signature": "+zW0ui2tPBoE69HFEuTHzLJkPJD3KLpDCL1murk1N+ALuWEtx/ApgS7eZVH7BsLxVv/uHmmmfw+Uu5cNhrmQAw==",
+      "signed_at": "2026-09-23T08:58:29.167Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -268,14 +270,14 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-09-18",
-      "signature": "2hXPSi37nQXyc16aAgbCK7yOrpoXz9IdZCjpVXaIQozYyryUFQw52rKCwQrI8HfeiUvXieGuEgCLaTqFXpkmCQ==",
-      "signed_at": "2026-09-22T21:36:58.817Z"
+      "signature": "zf55d/qt6fVGaqsYT1LnlcAUVcwh2qs/WBdwdAFU4pwTRp540sQoJNEo/8EPNwsCZKKwY6IOJlkMXLy/kyGRCg==",
+      "signed_at": "2026-09-23T08:58:29.167Z"
     },
     {
       "name": "compliance-theater",
       "version": "1.0.0",
       "path": "skills/compliance-theater/skill.md",
-      "description": "Detect where an organization passes an audit but remains exposed — seven documented compliance theater patterns",
+      "description": "Detect where an organization passes an audit but remains exposed — seven documented compliance theater patterns with specific detection tests",
       "triggers": [
         "compliance theater",
         "paper compliance",
@@ -300,8 +302,8 @@
         "CMMC-2.0-Level-2"
       ],
       "last_threat_review": "2026-09-18",
-      "signature": "ULvL7X7lORtHGtccOuqMnLYgDjhrYKUpVXjIveOkYEH+x6TlWTqRf6MCtK7jovRbNco2G4KGKPD5ujc9g41zBw==",
-      "signed_at": "2026-09-22T21:36:58.818Z"
+      "signature": "osyCDCgT1mJoZjiodGsO/Q6ze65er7LWcMbBDcNXLPIuxpYONSnuUrKrG0kZmbVJMOdK5Jte+BOTkDbCYOsSAA==",
+      "signed_at": "2026-09-23T08:58:29.168Z"
     },
     {
       "name": "exploit-scoring",
@@ -331,14 +333,14 @@
         "CIS-Controls-v8-Control7"
       ],
       "last_threat_review": "2026-09-18",
-      "signature": "0s5UuQbjpLKKQrFkoGsuBdbIgOvfOSdG8T41r0u2Qr8mSjPhkynzqmVCNhRQlhX0FHZTu47VeWCja/SMwLpeCA==",
-      "signed_at": "2026-09-22T21:36:58.818Z"
+      "signature": "p4h5ex1KPndY88cMmafXzZoz3idfI7TsdMxajjGmxPC43ZNaFnfDNfhrkQlTo42VJ+8N27ZyYNwuTCk1RtJ8Dg==",
+      "signed_at": "2026-09-23T08:58:29.168Z"
     },
     {
       "name": "rag-pipeline-security",
       "version": "1.0.0",
       "path": "skills/rag-pipeline-security/skill.md",
-      "description": "RAG-specific threat model — embedding manipulation, vector store poisoning, retrieval filter bypass, indirect prompt injection",
+      "description": "RAG-specific threat model — embedding manipulation, vector store poisoning, retrieval filter bypass, indirect prompt injection — no current framework coverage",
       "triggers": [
         "rag security",
         "retrieval security",
@@ -373,8 +375,8 @@
         "AU-Essential-8-App-Hardening"
       ],
       "last_threat_review": "2026-09-18",
-      "signature": "CCekpdnULetngyfqpqnZ7gviGRdJFRBogzJksFprDMvkEtSh7bFEBPc/Jq92m9BNdJeByVDJyLJpCPeC5c98BA==",
-      "signed_at": "2026-09-22T21:36:58.818Z",
+      "signature": "NSpytlrXh1+o4sX0EqZ746eAm3+mPfl0hgpgE5YHAMcvosOu1icbZ2aR424GrB5rASr7c/5fo+olZcBA4qx9CQ==",
+      "signed_at": "2026-09-23T08:58:29.168Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -394,7 +396,7 @@
       "name": "ai-c2-detection",
       "version": "1.0.0",
       "path": "skills/ai-c2-detection/skill.md",
-      "description": "Detect adversary use of AI APIs as covert C2 — SesameOp pattern, PROMPTFLUX/PROMPTSTEAL behavioral signatures",
+      "description": "Detect adversary use of AI APIs as covert C2 — SesameOp pattern, PROMPTFLUX/PROMPTSTEAL behavioral signatures, response playbook",
       "triggers": [
         "ai c2",
         "ai command and control",
@@ -415,7 +417,7 @@
       ],
       "atlas_refs": [
         "AML.T0096",
-        "AML.T0017"
+        "AML.T0016"
       ],
       "attack_refs": [
         "T1071",
@@ -440,8 +442,8 @@
         "RFC-9000"
       ],
       "last_threat_review": "2026-09-18",
-      "signature": "NPtJimG32ubukGmXjfpt5t2Cvpojhn98p0idJ9WBwgv103DGo6zhoHbYqRGdI7IkIeJqotYNX4QnpBVcf0DhCQ==",
-      "signed_at": "2026-09-22T21:36:58.819Z",
+      "signature": "/bIjyOG3vcL6sMPX0agXTVCO2Wd6/6/PBMQfjALT63ojxXMwBDz4HQTO00OSkNgvCLTOvcUM4nN4H+4yl+roCg==",
+      "signed_at": "2026-09-23T08:58:29.169Z",
       "cwe_refs": [
         "CWE-918"
       ],
@@ -459,7 +461,7 @@
       "name": "policy-exception-gen",
       "version": "1.0.0",
       "path": "skills/policy-exception-gen/skill.md",
-      "description": "Generate defensible policy exceptions for architectural realities — ephemeral infra, AI pipelines, ZTA, no-reboot patching",
+      "description": "Generate defensible policy exceptions for architectural realities — ephemeral infra, AI pipelines, ZTA, no-reboot patching, with compensating controls and auditor-ready justification",
       "triggers": [
         "policy exception",
         "exception request",
@@ -481,8 +483,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-09-18",
-      "signature": "nI93oN7VnrtJYPVuqjznDtzAes7ABjxE6KYdi9HlRahKtAVOLsRZjRP4dkntt8HW7A7/PM7eebMRWD6GEtVHAg==",
-      "signed_at": "2026-09-22T21:36:58.819Z",
+      "signature": "Q40RkYhyDuzaOX02Oy/UOYEIbWMG7Jj2AIiSeUjZLrHJZcQJMsQG0YQN1/tPtzuTwip1oXf69gAe/PHuz7/uBQ==",
+      "signed_at": "2026-09-23T08:58:29.169Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -516,8 +518,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-09-18",
-      "signature": "M0dazAvW3h8EDpLHo9fmENLzstDC3EFvkIRSCtE8VrztY0kCpfdq+VPjwjrMMmS7h+PY27FJ1UaNJ+RnVQg8Dw==",
-      "signed_at": "2026-09-22T21:36:58.820Z",
+      "signature": "ip/6xTNuHUcdPjPQW8TFLWatHGffymsi0xHgb/Hv/umC3GpQciVWUIp0pUJ2dlnuBnmd72IjDSvpVrQZjSzPCQ==",
+      "signed_at": "2026-09-23T08:58:29.170Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -557,8 +559,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-09-09",
-      "signature": "SVrgHZlCIv+NWBZle0lLG4ldCXKC4YCXkMRA8UQkRwYf+5eAFkeUYumYNY7rvIhrxo+mWtsQT8cNE5Jot/SfBg==",
-      "signed_at": "2026-09-22T21:36:58.820Z",
+      "signature": "u/3QUr3Nh0q1tjOaHQ3yC4WIJOUoABr+6R8VStCgS4NvNBglb/JcbLYvQmFixqdURu4Qi6xtqvUw0E14b5mtDA==",
+      "signed_at": "2026-09-23T08:58:29.170Z",
       "d3fend_refs": [
         "D3-EAL",
         "D3-EFA",
@@ -599,8 +601,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-09-18",
-      "signature": "RtqVZ2mVmnxls34xiReTILRCX5rPt8fiWweq8FdHZcbHhsVE/y9P/EG3kMm5bISZMH+bgTX0X+k/nmEMC+MEBA==",
-      "signed_at": "2026-09-22T21:36:58.821Z",
+      "signature": "5+DC+gAxjBkgM8OjirB3yDpcSOWSiii2zuEH1ue3VDdlvfvVrLF8ysRHUHg0AYC4Y9lByy5xJb1UWz1xnRqmAw==",
+      "signed_at": "2026-09-23T08:58:29.170Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -612,7 +614,7 @@
       "name": "pqc-first",
       "version": "1.0.0",
       "path": "skills/pqc-first/skill.md",
-      "description": "Post-quantum cryptography first mentality — hard version gates (OpenSSL 3.5+), algorithm sunset tracking, HNDL assessment, loopback learning for NIST/IETF evolution",
+      "description": "Post-quantum cryptography first mentality — hard version gates (OpenSSL 3.5+), algorithm sunset tracking, HNDL assessment, loopback learning for NIST/IETF standards evolution",
       "triggers": [
         "pqc",
         "post-quantum",
@@ -668,8 +670,8 @@
         "New CRQC timeline estimates from academic cryptanalysis"
       ],
       "last_threat_review": "2026-08-05",
-      "signature": "DNXmzLVK71XI/b9mkIBw30KVdVV5Wc9/0o/pP35RkferqtvlsMHjj4WJpoGXpIu8/hJyuMJRQrV7pzfR68iIAg==",
-      "signed_at": "2026-09-22T21:36:58.821Z",
+      "signature": "r8tW6PJ8G0Sjd9nyr6rWJ11dovdH9llEe6eAldHedUKRl+vdbQd4g5Cefs2Q/xcNzoXGh3C0usNLX8jX4EaWBQ==",
+      "signed_at": "2026-09-23T08:58:29.171Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -682,7 +684,7 @@
       "name": "skill-update-loop",
       "version": "1.0.0",
       "path": "skills/skill-update-loop/skill.md",
-      "description": "Meta-skill for keeping all exceptd skills current — CISA KEV triggers, ATLAS version updates, framework amendments, forward_watch resolution, currency scoring",
+      "description": "Meta-skill for keeping all exceptd skills current — fires on new CVEs and CISA KEV listings, ATLAS updates, framework changes, and forward_watch triggers, and scores each skill's currency",
       "triggers": [
         "update skills",
         "skill review",
@@ -718,14 +720,14 @@
         "IETF RFC publications and draft status changes (datatracker.ietf.org, rfc-editor.org); run `npm run validate-rfcs` quarterly"
       ],
       "last_threat_review": "2026-09-18",
-      "signature": "MbiFq5G7gjfNkq2tstHHXtaIbTp+TKOzy/FqVLtKkMmc8o57T6Uf49/4bfpbGe/rp4j1pqqHm6wrL2+XBIncDw==",
-      "signed_at": "2026-09-22T21:36:58.822Z"
+      "signature": "R9cbLm2pz1MupiQpWk3CtrnlZ06VQQ5gN5MWlMEbF+aFTHdK7JsSXoyLodZYDo1U+ROQ+4OH2VXo0Z+54k/KBw==",
+      "signed_at": "2026-09-23T08:58:29.171Z"
     },
     {
       "name": "security-maturity-tiers",
       "version": "1.0.0",
       "path": "skills/security-maturity-tiers/skill.md",
-      "description": "Three-tier implementation roadmap — MVP (ship this week), Practical (scalable today), Overkill (defense-in-depth)",
+      "description": "Three-tier implementation roadmap — MVP you can ship today, practical best practices usable now, overkill gold standard for defense-in-depth",
       "triggers": [
         "security maturity",
         "implementation roadmap",
@@ -758,8 +760,8 @@
         "PQC tooling maturity shifting overkill to practical"
       ],
       "last_threat_review": "2026-09-18",
-      "signature": "qt66AfLK6ZAoK50xqO8xgxUoN2OND7Qo6H0mPakiG4Qji2IZFISzAyLpvTn7cq0nfgk9J+4Zhl88sIdVO36SCQ==",
-      "signed_at": "2026-09-22T21:36:58.822Z",
+      "signature": "n9Emv3t+W3lhOPkrLI06Grwx9lDVdHVYT6KMXcLHGnJiTLiSrz23XWIdpJQNMjj7Prp6TFaDScZ6x6WkZuxHDA==",
+      "signed_at": "2026-09-23T08:58:29.172Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -812,8 +814,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-09-09",
-      "signature": "wlczcAvZJzoosd2k7MxQg3kN/JcS7f7LXs6F4zrOYvUUAJUqQi95czUvWIPn8NXtCJ5WWhraitzZiyL2lSUpAg==",
-      "signed_at": "2026-09-22T21:36:58.822Z"
+      "signature": "Lb71p2XDRGmSUe4LGxiMl5HgJQ6gOVvWhjZ24dz8eBt7q+9qb0dLMMXshsfmreTjRU4ArNv50QPLZFFh9l+HCw==",
+      "signed_at": "2026-09-23T08:58:29.172Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -888,8 +890,8 @@
         "PTES revision incorporating AI-surface enumeration",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
-      "signature": "WRu5Yg1RBOPUZ+dmQWOE2t+HGBDHcRUk1d975hkuuiQoAvBWFEDsXr2y9GCHo/cblDrUkpD7LT8ylj5XyCtcDA==",
-      "signed_at": "2026-09-22T21:36:58.823Z"
+      "signature": "tBzI4lHl8F2+MeDZIOak1IYUBy8rrbgbc7M5uvodJXBKs+Rj9BmC0quk3NEcNRma8eIawUyyjU5ieFMi5MpiBQ==",
+      "signed_at": "2026-09-23T08:58:29.172Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -950,7 +952,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "1rpQIBRamlNF6gFGwycmgGLcmNalYeAZjkRKdQ0NWQW1lXQegE4sTObgDFkKCLuLSB+6j3zjzinwSQyxwxL9Dw==",
-      "signed_at": "2026-09-22T21:36:58.823Z"
+      "signed_at": "2026-09-23T08:58:29.173Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -984,7 +986,7 @@
       ],
       "atlas_refs": [
         "AML.T0096",
-        "AML.T0017",
+        "AML.T0024",
         "AML.T0051"
       ],
       "attack_refs": [
@@ -1027,8 +1029,8 @@
         "MCP gateway / proxy standardisation (Anthropic enterprise MCP gateway, Portkey MCP) — tool-call argument inspection is the missing primary control",
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
-      "signature": "8bQYr8vU3mlCrBIbVwj3MDDUQkIYSP4oeEjfXyeM8VJReqGmgO4MFvvcZOVRxuf5XRS40dpOfEO5AKj1ImKvAw==",
-      "signed_at": "2026-09-22T21:36:58.823Z"
+      "signature": "wKN08ODL/5Z1Kr1ySnDqj/eWY013y13LRqupqEERjMLjKMxuFiC6cLUaPjUyachML0PZAZrWYlCdfrggbNxkDg==",
+      "signed_at": "2026-09-23T08:58:29.173Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1112,7 +1114,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "fZ7VVjKFgQsgNNQd6m71lLY+POS/85jSZopbDwC96M+SfqSCQGW+6F9CqOhjE9vwkxoKhaKRULTfhpdbcsHhBg==",
-      "signed_at": "2026-09-22T21:36:58.824Z"
+      "signed_at": "2026-09-23T08:58:29.174Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1169,7 +1171,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "W8kg2Okd/VF521VmeVFGK2TmXkFPycuwgYdyNxLU2fMN+sR9Aals/X+Xqr/prrGEsqWnZsCInSq1TYzFr0wiDg==",
-      "signed_at": "2026-09-22T21:36:58.824Z"
+      "signed_at": "2026-09-23T08:58:29.174Z"
     },
     {
       "name": "identity-assurance",
@@ -1243,7 +1245,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-09-22T21:36:58.824Z"
+      "signed_at": "2026-09-23T08:58:29.174Z"
     },
     {
       "name": "ot-ics-security",
@@ -1302,7 +1304,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-09-18",
       "signature": "2pmqMIfqL1VAK5ZzPY4l1wllI7tnl5ne7ML6u9qQnA3SScRR1++TPUjEaB3iLZeRanCKGgkMj8LmU96dbqYYDA==",
-      "signed_at": "2026-09-22T21:36:58.825Z"
+      "signed_at": "2026-09-23T08:58:29.175Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1361,8 +1363,8 @@
         "UK NCSC Vulnerability Disclosure Toolkit revisions and AU ISM CVD guidance updates",
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
-      "signature": "3AZhfmMXX43i6y/usRLXHHiypnrKCVpA2qkNEJmZxqSF/9hQp9dAIEpA+Ko0R4aVgjCX7cRtcWR3xQuPhZMwAg==",
-      "signed_at": "2026-09-22T21:36:58.825Z"
+      "signature": "FfzagIXtJNegSNPjLSI11fnQqxXJ4nSfPcv+IdbD3XmIfDTxnV7nTAR0tCQKqOGKpsyYEwAZP5jQzA3tIuJJBw==",
+      "signed_at": "2026-09-23T08:58:29.175Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1415,8 +1417,8 @@
         "LINDDUN-GO and LINDDUN-PRO updates incorporating LLM privacy threats",
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
-      "signature": "y331xjTn8EY4xrIw18R9LWpLa78Qqa/bZZ2cUCZ3VV94ZlDfsfsU+ljZvGfPzBYbAfjEonHrHS6e7VTJLq6mAw==",
-      "signed_at": "2026-09-22T21:36:58.825Z"
+      "signature": "0njaUBtRgD+5ys5xh1x+daPI2xhnHzZP+pielUdqEndR2/uDAuf3XIDUWnhC8LKr+33HSX3pXmqfgbXJpyqxBQ==",
+      "signed_at": "2026-09-23T08:58:29.176Z"
     },
     {
       "name": "webapp-security",
@@ -1499,7 +1501,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "YhdXy2fMZubdoGemwvt8XCPFaMpcA3uVzGlGH7j+3koPuPl99VqkD1Q2gsJjs894V3CiRSWuRU75q4nIGwUAAQ==",
-      "signed_at": "2026-09-22T21:36:58.826Z",
+      "signed_at": "2026-09-23T08:58:29.176Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1537,7 +1539,8 @@
       "atlas_refs": [
         "AML.T0051",
         "AML.T0096",
-        "AML.T0017"
+        "AML.T0017",
+        "AML.T0013"
       ],
       "attack_refs": [],
       "framework_gaps": [
@@ -1558,8 +1561,8 @@
         "D3-IOPR"
       ],
       "last_threat_review": "2026-05-15",
-      "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
-      "signed_at": "2026-09-22T21:36:58.826Z"
+      "signature": "+x25rPi9K6Yo39Nj9ZN+PV4y0yQ9z9mNmOrBISYLsWrjqVTACCUFI+mp4w/nV6sZueEMoiar+inwE/fucbuiDw==",
+      "signed_at": "2026-09-23T08:58:29.176Z"
     },
     {
       "name": "sector-healthcare",
@@ -1593,7 +1596,8 @@
       ],
       "atlas_refs": [
         "AML.T0051",
-        "AML.T0017"
+        "AML.T0017",
+        "AML.T0013"
       ],
       "attack_refs": [
         "T1078",
@@ -1625,8 +1629,8 @@
         "D3-MFA"
       ],
       "last_threat_review": "2026-09-18",
-      "signature": "wzn+2M42Jirv4SaakneHXsICUvx0YjHT+lY/vwp+hbvR17U9JaXMKWyIFH1GbbYYuHy+3f4Xgouqatkg8pJlDw==",
-      "signed_at": "2026-09-22T21:36:58.827Z"
+      "signature": "XMI/ZJn07vHRmN+zRCbYh+JH0bUaRL0KpthMVfRXGz3ELqQqeLG7eUrrnBWnJ5GhsWTuYY/dGCyDdsVyBKtNDA==",
+      "signed_at": "2026-09-23T08:58:29.177Z"
     },
     {
       "name": "sector-financial",
@@ -1663,7 +1667,7 @@
       ],
       "atlas_refs": [
         "AML.T0096",
-        "AML.T0017"
+        "AML.T0013"
       ],
       "attack_refs": [
         "T1078",
@@ -1714,8 +1718,8 @@
         "OSFI B-13 (Technology and Cyber Risk Management) post-2024 examination findings",
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
-      "signature": "LJuRKWJevk24XppOXTNoWEpJFNsYh20uk+LEmPkKISUM0vt2M19dUzaS4vbWxoSXBHB1apA4SISFKD+J5rJnCQ==",
-      "signed_at": "2026-09-22T21:36:58.827Z"
+      "signature": "gFUmQCkAfdW++Mb+UcwHTATJcZuszFA3dQSD+v3asEdYYsSFt63L03p09Y3JWN0c4JS4jAC1x08WsgYSklSCBQ==",
+      "signed_at": "2026-09-23T08:58:29.177Z"
     },
     {
       "name": "sector-federal-government",
@@ -1792,7 +1796,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "eFY8sPJCCqYTLGKx+1Spc8UhXNF5Lg3PxN11++lGHBEtPJf/HWeLtrrw2CZSabeqZxdrSLEjuiJxkFo9r+VkAg==",
-      "signed_at": "2026-09-22T21:36:58.827Z"
+      "signed_at": "2026-09-23T08:58:29.177Z"
     },
     {
       "name": "sector-energy",
@@ -1866,13 +1870,13 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "tpbR4Azrmbh9YSByEBqsb40/c6e17bKw6RDYzdW1P1gK31g+It5wOCgVvoacCv4F5SjQWIQnlrm1QWTMYYJWAA==",
-      "signed_at": "2026-09-22T21:36:58.828Z"
+      "signed_at": "2026-09-23T08:58:29.178Z"
     },
     {
       "name": "sector-telecom",
       "version": "1.0.0",
       "path": "skills/sector-telecom/skill.md",
-      "description": "Telecom and 5G security for mid-2026 — Salt Typhoon, Volt Typhoon, CALEA / IPA-LI gateway compromise, signaling-protocol abuse (SS7 / Diameter / GTP), 5G N6 / N9 isolation, gNB / DU / CU integrity, OEM-equipment supply-chain compromise, AI-RAN / O-RAN security",
+      "description": "Telecom and 5G security for mid-2026 — Salt Typhoon, Volt Typhoon, CALEA / IPA-LI gateway compromise, signaling-protocol abuse (SS7 / Diameter / GTP), 5G N6 / N9 isolation, gNB / DU / CU integrity, OEM-equipment supply-chain compromise, AI-RAN / O-RAN security; FCC CPNI + 4-business-day notification, NIS2 Annex I telecom essential entities, UK TSA 2021 + Ofcom, AU SOCI / TSSR, GSMA NESAS, 3GPP TR 33.926 + TS 33.501, ITU-T X.805.",
       "triggers": [
         "telecom security",
         "5g core",
@@ -1906,7 +1910,7 @@
         "d3fend-catalog.json"
       ],
       "atlas_refs": [
-        "AML.T0040"
+        "AML.T0010"
       ],
       "attack_refs": [
         "T1071",
@@ -1922,7 +1926,7 @@
         "NIS2-Annex-I-Telecom",
         "DORA-Art-21-Telecom-ICT",
         "UK-CAF-B5",
-        "AU-ISM-1556",
+        "AU-ISM-1173-Telecom-NMS",
         "GSMA-NESAS-Deployment",
         "3GPP-TR-33.926",
         "ITU-T-X.805"
@@ -1951,8 +1955,8 @@
         "3GPP TS 33.501 updates (5G security architecture rebaseline)",
         "O-RAN SFG / WG11 security specifications"
       ],
-      "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
-      "signed_at": "2026-09-22T21:36:58.828Z"
+      "signature": "G7WrqBaR/Nqf4zhYdS69gBsunZJolx0saEAAd6Y+3ev8iN7mDiB5H0W+ow+YZjD74hhsJr4ks3RD/yKulavXCQ==",
+      "signed_at": "2026-09-23T08:58:29.178Z"
     },
     {
       "name": "api-security",
@@ -1986,7 +1990,7 @@
       ],
       "atlas_refs": [
         "AML.T0096",
-        "AML.T0017"
+        "AML.T0013"
       ],
       "attack_refs": [
         "T1190",
@@ -2030,8 +2034,8 @@
         "D3-CBAN"
       ],
       "last_threat_review": "2026-09-18",
-      "signature": "kFrz/uEDmfGzaAnYjdC8LODy5Ezq0YzIyI+8K4bJp9+LIYkCbxE4kWr0tHCvoipud0keCljXY9M96y826fSZAQ==",
-      "signed_at": "2026-09-22T21:36:58.828Z",
+      "signature": "y6LfKfsHtpPT+UBrfkXVR4xO139xvzrWOGTdyeEAna1kecWDJIqKKMdSpHqR4T7KG2HCAmgLCV2cmf3B3jnkAg==",
+      "signed_at": "2026-09-23T08:58:29.178Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -2070,7 +2074,8 @@
       ],
       "atlas_refs": [
         "AML.T0010",
-        "AML.T0017"
+        "AML.T0017",
+        "AML.T0013"
       ],
       "attack_refs": [
         "T1078",
@@ -2125,8 +2130,8 @@
         "eBPF-based runtime detection coverage of confidential-computing enclaves (AWS Nitro Enclaves, Azure Confidential VMs, GCP Confidential Space) — partial visibility is a tracked detection gap",
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
-      "signature": "8w+nFlBZ4+AgVrgiXyHzAHT2lgUbaP9Q8YOkt+NYPlwx2AjfTazB7S2G4Rg9ibUH+mcs9gpZMDAD+9CyZqo6Dw==",
-      "signed_at": "2026-09-22T21:36:58.829Z"
+      "signature": "f7b0+D4TJwd9c9ISGMFquvePueywoO92QZ172etyayBcDwYVTIiGYII67+NyaLl2+u0QG49d4QY41UPbRflrDw==",
+      "signed_at": "2026-09-23T08:58:29.179Z"
     },
     {
       "name": "container-runtime-security",
@@ -2198,7 +2203,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "mN0q+CDc2WyUjgOzFwUBZBo3SbaOAvWn4CVBjLAYfWYDxm5em+vil0a5dlUWLXxviDNkeQpG0kaAv9dstqPWDg==",
-      "signed_at": "2026-09-22T21:36:58.830Z",
+      "signed_at": "2026-09-23T08:58:29.180Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2239,7 +2244,7 @@
         "AML.T0018",
         "AML.T0020",
         "AML.T0043",
-        "AML.T0017"
+        "AML.T0013"
       ],
       "attack_refs": [
         "T1195.001",
@@ -2278,8 +2283,8 @@
         "EU AI Act high-risk technical-file implementing acts (2026-2027) — operational requirements for Article 10 / 13 / 15 documentation may pin ML-BOM or model-signing",
         "MITRE ATLAS release 2026.06 (June 2026) added AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie) and AML.T0114 (AI Service Web Interface) to release 2026.05 and removed no technique ids. Earlier releases shipped the AML.T0010 sub-technique expansion and the agentic-AI techniques this forecast tracked (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"). Forward watch: subsequent monthly ATLAS releases, for updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
-      "signature": "Rq8DoRSZdGHnteEe5UG/sJJe3OlWjqJVvFuKFHycaAamDVCXP9FQOP3GtAZKfDxN76PJEo7dbcxBkchkC5K7Bg==",
-      "signed_at": "2026-09-22T21:36:58.830Z"
+      "signature": "+DWL+I6VipjzZpvjZptUNk7jrCYhOBQqFy1ejThc4Gdr2BJ5vWYuRWclUUd4RhC58iv4S3NAgatuZOcXTOkRCg==",
+      "signed_at": "2026-09-23T08:58:29.180Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2312,7 +2317,8 @@
       ],
       "atlas_refs": [
         "AML.T0096",
-        "AML.T0017",
+        "AML.T0013",
+        "AML.T0024",
         "AML.T0051"
       ],
       "attack_refs": [
@@ -2352,14 +2358,14 @@
         "IL INCD Incident Response Process v4 (slated for 2026-2027) consolidating AI-incident sub-class",
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
-      "signature": "Mhw/tHJIg7J3caW2Hjue9GDFiU1KTUzoj0X5TzNYSsRYA8jtMxy2gW5yJLG0znFYfWmzSg/0WLq1peP6grqhAQ==",
-      "signed_at": "2026-09-22T21:36:58.831Z"
+      "signature": "GXEqUic3Dg65QODe/2+AA5PJ2gkRLf39/AbFaZDt19GzknfhHlBxQf7LrpDX2S87JKPHzHPShRAFRxJSW90LAA==",
+      "signed_at": "2026-09-23T08:58:29.180Z"
     },
     {
       "name": "ransomware-response",
       "version": "1.0.0",
       "path": "skills/ransomware-response/skill.md",
-      "description": "Ransomware-specific incident response — OFAC SDN sanctions screening as payment-posture blocker, EU Reg 2014/833 + UK OFSI + AU DFAT + JP MOF cross-jurisdiction sanctions lookups, decryptor availability via No More Ransom + vendor-specific catalogs, cyber-insurance carrier 24h notification, negotiator-engagement legal posture, immutable-backup viability test, PHI exfil-before-encrypt as distinct breach class, parallel jurisdiction clocks",
+      "description": "Ransomware-specific incident response — OFAC sanctions screening as payment-posture blocker, EU Reg 2014/833 + UK OFSI + AU DFAT + JP MOF cross-jurisdiction sanctions lookups, decryptor availability via No More Ransom + vendor-specific catalogs, cyber-insurance carrier 24h notification, negotiator-engagement legal posture, immutable-backup viability test, PHI exfil-before-encrypt as distinct breach class, parallel jurisdiction clocks (NIS2 24h / DORA 4h / GDPR 72h / SEC 8-K 96h / HIPAA 60d / CIRCIA 72h / NYDFS 500.17 24h ransom-payment)",
       "triggers": [
         "ransomware",
         "ransomware incident",
@@ -2432,8 +2438,8 @@
         "SCOTUS or circuit-court rulings on ransomware payment, sanctions liability, and insurance-policy enforcement"
       ],
       "last_threat_review": "2026-09-18",
-      "signature": "DlbATKeUswUKvYTL9eUyFUhZQGVnuKtJPwKDrSam5QucJeRufnIM1ygUvzU1GhXN9i7tl1rJ/3EP1T2GWco5AQ==",
-      "signed_at": "2026-09-22T21:36:58.831Z"
+      "signature": "ULB2eBGPwh5vgOTK9m9i7Do25p48npVDpyDqjRYOfUUHoYvXkG+XxF0DdJLrs27ngQ2TyETn6X9xKp4310RGBA==",
+      "signed_at": "2026-09-23T08:58:29.181Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2501,7 +2507,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-09-22T21:36:58.831Z"
+      "signed_at": "2026-09-23T08:58:29.181Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2576,13 +2582,13 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "rlHzyruu9OhkcVrYfHnMJvQf9z3rnDh5VbDQr4qCmqFXTzPqyQz9u1GvKdNiElSNXv3Qv3afvUFsvcHxOxX4DQ==",
-      "signed_at": "2026-09-22T21:36:58.832Z"
+      "signed_at": "2026-09-23T08:58:29.181Z"
     },
     {
       "name": "cloud-iam-incident",
       "version": "1.0.0",
       "path": "skills/cloud-iam-incident/skill.md",
-      "description": "Cloud-IAM incident response for AWS / GCP / Azure — account takeover, IAM role assumption abuse, access-key compromise, cross-account assume-role chains, federated-trust attacks, IMDS metadata exfiltration, and Snowflake-AA24-class IdP-to-cloud credential reuse",
+      "description": "Cloud-IAM incident response for AWS / GCP / Azure — account takeover, IAM role assumption abuse, access-key compromise, cross-account assume-role chains, federated-trust attacks (IAM Identity Center / Workload Identity Federation / Azure managed identity), IMDS metadata exfiltration, and Snowflake-AA24-class IdP-to-cloud credential reuse",
       "triggers": [
         "cloud iam compromise",
         "aws account takeover",
@@ -2631,7 +2637,7 @@
         "SOC2-CC6-Access-Key-Leak-Public-Repo",
         "AWS-Security-Hub-Coverage-Gap",
         "UK-CAF-B2-Cloud-IAM",
-        "AU-ISM-1546-Cloud-Service-Account"
+        "AU-ISM-1685-Cloud-Service-Account"
       ],
       "rfc_refs": [
         "RFC-8693",
@@ -2655,8 +2661,8 @@
         "D3-CAA"
       ],
       "last_threat_review": "2026-05-15",
-      "signature": "vrMvYLdYJLlEAC8YvOb/g3LJ8gU1YmYewZ94J5AFgxxh2EiDyszqo3D/WVpt5NTrDSS/N5OgOf5Vwom/KGlMCA==",
-      "signed_at": "2026-09-22T21:36:58.832Z",
+      "signature": "jIHvISo1VRnvLRMktdJtEIpb/jKEu5yk23WrzoZCIdhtzGdcXL10vVfycxVM6U/tHg+u/5ju/x8wreQRnYHQBQ==",
+      "signed_at": "2026-09-23T08:58:29.182Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2723,7 +2729,7 @@
         "ISO-27001-2022-A.5.16-Federated",
         "SOC2-CC6-OAuth-Consent",
         "UK-CAF-B2-IdP-Tenant",
-        "AU-ISM-1559-IdP",
+        "AU-ISM-1685-IdP",
         "NIS2-Art-21-Federated-Identity",
         "DORA-Art-19-IdP-4h",
         "OFAC-Sanctions-Threat-Actor-Negotiation"
@@ -2749,8 +2755,8 @@
         "D3-IOPR"
       ],
       "last_threat_review": "2026-05-15",
-      "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
-      "signed_at": "2026-09-22T21:36:58.832Z",
+      "signature": "gbYSLSe+VfZy3fwKkKIIDa4ipF7lbcKTWMyEAmvdGoO4TgQKWZf5/1mAxOSj0kqkXc16ai09NsSc70NOP05RBA==",
+      "signed_at": "2026-09-23T08:58:29.182Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2822,7 +2828,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-09-22T21:36:58.833Z"
+      "signed_at": "2026-09-23T08:58:29.182Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2881,7 +2887,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-09-22T21:36:58.833Z"
+      "signed_at": "2026-09-23T08:58:29.182Z"
     },
     {
       "name": "network-trust",
@@ -2937,7 +2943,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-09-22T21:36:58.833Z"
+      "signed_at": "2026-09-23T08:58:29.183Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2992,7 +2998,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "T7sFREX7P2QYrau+eTNXKkrU2aJ91dsX6GQWVJeexJ9SqbyFHtAnIKo4r6F6VdELADyVjaRXKk/fLuyUaCkGBA==",
-      "signed_at": "2026-09-22T21:36:58.833Z"
+      "signed_at": "2026-09-23T08:58:29.183Z"
     },
     {
       "name": "self-update-integrity",
@@ -3034,7 +3040,7 @@
         "NIST-800-53-SR-11",
         "NIS2-Art21-network-security",
         "UK-CAF-B4",
-        "AU-ISM-1556"
+        "AU-ISM-0298"
       ],
       "rfc_refs": [],
       "cwe_refs": [
@@ -3045,8 +3051,8 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
-      "signature": "BOQZ8G9LdyG/tfpz6rCU4THz5Dq2HGJkUV7uCqSTCMrqnXH6seNXKM41FWawYo0s2VUlXtRgaO7ETp5qgxw+CQ==",
-      "signed_at": "2026-09-22T21:36:58.834Z"
+      "signature": "OKVmNgVoGGDS8kwezWrtFk62xgYkU3B7lhGRd7xO7wfSQPbETk+aeLmkpoS8sTryzrAg7JYhJ0qDofbSQpOTCg==",
+      "signed_at": "2026-09-23T08:58:29.183Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -3091,7 +3097,7 @@
         "NIST-800-53-AC-3",
         "NIS2-Art21-network-security",
         "UK-CAF-B4",
-        "AU-ISM-1556"
+        "AU-ISM-1268"
       ],
       "rfc_refs": [],
       "cwe_refs": [
@@ -3103,8 +3109,8 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
-      "signature": "bncN0VE4ns0lxtPe48xDR33lerw54BPVkSwX7XlrLQcMHTrV94lmjO8z4ZP4Ko61n+KpuP2SNU8v9JT0bGMmAA==",
-      "signed_at": "2026-09-22T21:36:58.834Z"
+      "signature": "MWDxwIfhUvGAet5F1LBJnBApTBHafuW+NwysdaSYh8DmPM70bcg6v7f7qwv+zADXYc1LHdF4FoqiAcFy8TA7DA==",
+      "signed_at": "2026-09-23T08:58:29.183Z"
     },
     {
       "name": "decompression-dos",
@@ -3147,7 +3153,7 @@
         "NIST-800-53-SI-2",
         "NIS2-Art21-network-security",
         "UK-CAF-B4",
-        "AU-ISM-1556"
+        "AU-ISM-1240"
       ],
       "rfc_refs": [],
       "cwe_refs": [
@@ -3161,8 +3167,8 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
-      "signature": "03i0ZO5ScHIOjGvDKUEsws6m+20fnlJrEhSBtMU7PJzQutrPpmW9gULE0wbayTD5H9URh5nSKZuuVjvjVhZNCg==",
-      "signed_at": "2026-09-22T21:36:58.834Z"
+      "signature": "iDsEYQo/OWYUI8TbBNsS9A60Kt5XEcZ1WYKg52wuSAzgctn4W68dgMeaoNbPXq2Bon1amFKIH5uxUtU8q7I/Dw==",
+      "signed_at": "2026-09-23T08:58:29.183Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -3205,7 +3211,7 @@
         "ISO-27001-2022-A.8.15",
         "NIS2-Art21-network-security",
         "UK-CAF-B4",
-        "AU-ISM-1556"
+        "AU-ISM-1815"
       ],
       "rfc_refs": [],
       "cwe_refs": [
@@ -3216,8 +3222,8 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
-      "signature": "twTmA2l+Am2k2PCzB2DNxDQwoYlGopJp/3QgQwBsP7h2LF+uNudisqfuOVV/bYnWfrUhuYZUWbsR3mhzbJCUBw==",
-      "signed_at": "2026-09-22T21:36:58.834Z"
+      "signature": "1Qn1LUzL2qCvG+jEaif7uMVL/cDwyMVueZAhu5uSroQzfw1V5X2vm/t69fExGKoLnVdkfta71aZWI4Gz0tfiDQ==",
+      "signed_at": "2026-09-23T08:58:29.184Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3260,7 +3266,7 @@
         "NIST-800-53-SI-2",
         "NIS2-Art21-network-security",
         "UK-CAF-B4",
-        "AU-ISM-1556"
+        "AU-ISM-1240"
       ],
       "rfc_refs": [],
       "cwe_refs": [
@@ -3271,12 +3277,12 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
-      "signature": "0sfKSVrIf555c9bDGkXB96fUClN52fMAMYoQsNQ9eUUSzDiWUwdou+q0gYt43nObtj3m9Yb9X6q3oCXDVMgUDg==",
-      "signed_at": "2026-09-22T21:36:58.834Z"
+      "signature": "UIzZfFwZP/7Gg5IdwQQTv6oDZyzjID8lXWYL1SgiSu4JRPJYzt/vqQO1ztfEaaRdbZBi0Vao3td2aFixnhw6AQ==",
+      "signed_at": "2026-09-23T08:58:29.184Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "2bWiUu0MzA0TWW5/0yy1EIV+LHlLM3QiuT/Y8D2UiL0GHnPs33r6SJ/XjGoHjcpSpjCxLlDRjat686+1XC9sAA=="
+    "signature_base64": "N0VGi6t3Fuwj5c0vDtKDHO8cY8VCFugOopM+yXRUufjfACND6lYB8Lp/iH8PXVzN+x84pfJZK3yvBAB/yA1bDw=="
   }
 }