@blamejs/exceptd-skills 0.20.1 → 0.21.0

package/skills/security-maturity-tiers/skill.md

@@ -1,7 +1,7 @@
 ---
 name: security-maturity-tiers
 version: "1.0.0"
-description: Three-tier implementation roadmap — MVP you can ship today, practical best practices useable now, overkill gold standard for defense-in-depth
+description: Three-tier implementation roadmap — MVP you can ship today, practical best practices usable now, overkill gold standard for defense-in-depth
 triggers:
   - security maturity
   - implementation roadmap
@@ -457,7 +457,7 @@ Each tier diverges from at least one widely-cited framework control because the
 | MVP | PCI DSS 4.0 6.3.3 | Critical patches within 1 month | Same divergence — RWEP >= 70 must be live-patched within hours | 1 month is multiple AI-accelerated exploit cycles |
 | MVP | EU NIS2 Art. 21(2)(f) (vulnerability handling) | "Policies/procedures to assess vulnerability handling measures" | Concrete RWEP-anchored SLA published as policy | "Procedures to assess" is meta-control, not a control |
 | MVP | UK Cyber Essentials | High-risk patches within 14 days | Same divergence — 14 days insufficient for KEV-class deterministic LPE | Better than NIST but still loses to AI-accelerated weaponization |
-| MVP | AU ASD ISM-1623 / Essential 8 ML3 | 48h patch when exploit exists | Aligned at the framework level; tier adds live-patch capability requirement | Closest national framework alignment globally; still no live-patch mandate |
+| MVP | AU ASD ISM-1877 and ISM-1696 / Essential 8 | 48h patch when a working exploit exists (internet-facing systems at every maturity level, workstations at ML3) | Aligned at the framework level; tier adds live-patch capability requirement | Closest national framework alignment globally; still no live-patch mandate |
 | MVP | CISA BOD 26-04 (Prioritizing Security Updates Based on Risk) | Urgency set by four decision points — asset exposure, KEV status, exploit automation, technical impact — 3 days at the top band, "fix on system upgrade" at the bottom | RWEP-indexed SLA with the live patch verified within hours for KEV-listed deterministic LPE | Closest framework alignment to risk-indexed remediation to date, but the top band is still 3 days, there is no live-patch requirement, and it binds only US federal civilian agencies |
 | Practical | ISO 27001:2022 A.5.9 (Inventory of information and other associated assets) | Point-in-time CMDB / asset register | Ephemeral-aware inventory snapshots (continuous, container/serverless-native) | Point-in-time CMDB misses ephemeral workloads; Practical Tier requires an inventory that reflects actual workload existence within minutes, not days |
 | Practical | NIST 800-53 CM-8 (System component inventory) | Documented inventory, updated periodically | Same divergence — continuous, attestation-based inventory | CM-8 cadence is multi-day at best; AI-speed reconnaissance (36,000 probes/sec) requires continuous attack-surface awareness |
@@ -482,10 +482,10 @@ Per-tier TTP coverage is cumulative: Practical includes MVP's coverage plus addi
 | MVP | ML Supply Chain Compromise (MCP) | AML.T0010 | atlas-ttps.json | MCP server inventory + version pinning + tool allowlist |
 | MVP | LLM Jailbreak | AML.T0054 | atlas-ttps.json | Same control as AML.T0051; the two are operationally adjacent — adversarial-instruction injection bypasses guardrails |
 | Practical | Exploit Public-Facing Application | T1190 (ATT&CK) | cve-catalog.json (CVE-2025-53773 attack_refs) | External attack-surface management + AI-mediated T1190 coverage |
-| Practical | Discover ML Model Ontology | AML.T0017 | atlas-ttps.json | Inference-API rate + shape monitoring; reconstruct adversary's model-family map |
+| Practical | Discover AI Model Ontology | AML.T0013 | atlas-ttps.json | Inference-API rate + shape monitoring; reconstruct adversary's model-family map |
 | Practical | Poison Training Data | AML.T0020 | atlas-ttps.json | Training-pipeline integrity verification for any in-house ML used in decisions |
-| Practical | Obtain Capabilities: Develop Capabilities (AI-assisted weaponization) | AML.T0016 | atlas-ttps.json | RWEP-anchored monitoring; treat KEV+PoC as immediate live-patch trigger; phishing detection updated for AI-generated content; behavioural signals primary |
-| Overkill | LLM Integration Abuse (C2) | AML.T0096 | atlas-ttps.json | AI-traffic content inspection + SesameOp-pattern detection with behavioural baseline |
+| Practical | Obtain / Develop Capabilities (AI-assisted weaponization) | AML.T0016, AML.T0017 | atlas-ttps.json | RWEP-anchored monitoring; treat KEV+PoC as immediate live-patch trigger; phishing detection updated for AI-generated content; behavioural signals primary |
+| Overkill | AI Service API (C2) | AML.T0096 | atlas-ttps.json | AI-traffic content inspection + SesameOp-pattern detection with behavioural baseline |
 | Overkill | Backdoor ML Model | AML.T0018 | atlas-ttps.json | Model integrity verification (behavioural regression tests, model signing) |
 | Overkill | Craft Adversarial Data (RAG/general) | AML.T0043 | atlas-ttps.json | Vector-store access controls + retrieval-anomaly monitoring |
 
@@ -504,11 +504,11 @@ D3FEND references from `data/d3fend-catalog.json`. This skill prescribes a roadm
 | MVP | AML.T0010 (ML Supply Chain Compromise — MCP) | `D3-EAL` | Executable Allowlisting (tool allowlist + version pinning) | `mcp-agent-trust` |
 | MVP | T1190 (Exploit Public-Facing Application — self-hosted LLM infrastructure) | `D3-NI` + `D3-ITF` | Network Isolation + Inbound Traffic Filtering | `webapp-security` + `ai-attack-surface` |
 | Practical | T1190 (Exploit Public-Facing Application) | `D3-ITF` + `D3-NI` | Inbound Traffic Filtering + Network Isolation | `attack-surface-pentest` |
-| Practical | AML.T0017 (Discover ML Model Ontology) | `D3-CSPP` | Client-server Payload Profiling (inference-API rate and shape monitoring) | `ai-attack-surface` |
+| Practical | AML.T0013 (Discover AI Model Ontology) | `D3-CSPP` | Client-server Payload Profiling (inference-API rate and shape monitoring) | `ai-attack-surface` |
 | Practical | AML.T0020 (Training Data Poisoning) | `D3-FAPA` | File Access Pattern Analysis (training-pipeline integrity) | `mlops-security` |
-| Practical | AML.T0016 (Develop Capabilities — AI-assisted weaponization) | `D3-CSPP` + `D3-MFA` | Client-server Payload Profiling + Multi-factor Authentication (passkey class) | `email-security-anti-phishing` + `identity-assurance` |
+| Practical | AML.T0016 (Obtain Capabilities, AI-generated phishing and payloads) | `D3-CSPP` + `D3-MFA` | Client-server Payload Profiling + Multi-factor Authentication (passkey class) | `email-security-anti-phishing` + `identity-assurance` |
 | Practical | Harvest-now-decrypt-later (T1040, T1557) | `D3-MENCR` | Message Encryption (PQC-hybrid KEM per RFC 9954) | `pqc-first` |
-| Overkill | AML.T0096 (LLM Integration Abuse — C2) | `D3-NTA` + `D3-OTF` | Network Traffic Analysis + Outbound Traffic Filtering | `ai-c2-detection` |
+| Overkill | AML.T0096 (AI Service API, C2) | `D3-NTA` + `D3-OTF` | Network Traffic Analysis + Outbound Traffic Filtering | `ai-c2-detection` |
 | Overkill | AML.T0018 (Manipulate AI Model) | `D3-EFA` + `D3-FAPA` | Executable File Analysis (model signing) + File Access Pattern Analysis | `mlops-security` |
 | Overkill | AML.T0043 (Craft Adversarial Data — RAG) | `D3-IOPR` + `D3-FAPA` | Input/Output Profiling + File Access Pattern Analysis (vector-store access control) | `rag-pipeline-security` |
 

package/skills/self-update-integrity/skill.md

@@ -35,7 +35,7 @@ framework_gaps:
   - NIST-800-53-SR-11
   - NIS2-Art21-network-security
   - UK-CAF-B4
-  - AU-ISM-1556
+  - AU-ISM-0298
 cwe_refs:
   - CWE-494
   - CWE-829

package/skills/skill-update-loop/skill.md

@@ -1,7 +1,7 @@
 ---
 name: skill-update-loop
 version: "1.0.0"
-description: Meta-skill for keeping all exceptd skills current — fires on new CVEs, ATLAS updates, framework changes, and forward_watch triggers
+description: Meta-skill for keeping all exceptd skills current — fires on new CVEs and CISA KEV listings, ATLAS updates, framework changes, and forward_watch triggers, and scores each skill's currency
 triggers:
   - update skills
   - skill review
@@ -71,10 +71,10 @@ This skill defends against drift; the TTPs that EXPLOIT a drifted skill are:
 | Tactic | TTP | What drift enables |
 |---|---|---|
 | Defense Evasion | T1685 (Disable or Modify Tools) | Stale skill recommends only the controls the current adversary class already evades |
-| Resource Development | AML.T0016 (Obtain Capabilities: Develop Capabilities) | Attacker capability outpaces the catalog the skill cites |
+| Resource Development | AML.T0016 / AML.T0017 (Obtain / Develop Capabilities) | Attacker capability outpaces the catalog the skill cites |
 | Initial Access | AML.T0010 (Supply Chain Compromise) | New attack class (e.g. MCP plugin compromise) isn't yet a skill |
 | Defense Evasion | T1027 (Obfuscated Files or Information) | Detection rules in a skill are for an older obfuscation generation |
-| Impact | AML.T0048 (Erode ML Model Integrity) | Drift in the threat-context section means the operator's mental model is wrong by months |
+| Impact | AML.T0031 (Erode AI Model Integrity) | Drift in the threat-context section means the operator's mental model is wrong by months |
 | Discovery | T1518 (Software Discovery) | The catalog the skill scans doesn't recognize the adversary's current tool inventory |
 
 The update loop does not detect these TTPs — it prevents the skill set from being *vulnerable* to them by structural staleness.

package/skills/threat-model-currency/skill.md

@@ -254,7 +254,7 @@ No major risk-assessment or threat-intelligence framework defines a currency met
 | EU | DORA Art. 6 (ICT risk management framework) | Requires identification of ICT risks "on an ongoing basis"; "ongoing" is undefined and unmetered. |
 | EU | EU AI Act Art. 9 (Risk Management System for high-risk AI) | Mandates "continuous iterative" risk management; provides no currency test, no mapping to ATLAS, no required refresh trigger. |
 | UK | NCSC CAF Principle A2 (Risk Management) | Principle-based, leaves currency to the assessor. No threat-class checklist, no minimum refresh cadence. |
-| AU | ISM-0042 / Essential 8 governance | Requires documented risk assessment; no currency metric. ISM updates monthly but does not require organisations' threat models to track its cadence. |
+| AU | ISM-1238 and ISM-2039 | Require threat modelling in the software development life cycle, and a review that keeps the model current with the as-built software and the threat environment. Neither sets a review cadence, and neither applies to threat models outside software development. |
 | Global | COSO ERM / ISO 31000 | Enterprise risk frameworks treat cyber as one risk category; no operational threat-currency requirement. |
 
 The recurring failure across all of the above: every framework treats threat modelling as a process to perform, not a knowledge artefact to keep fresh against external TTP catalogs. The 14-class checklist in this skill is the missing currency metric.
@@ -272,13 +272,13 @@ The 14-class checklist above *is* the TTP map. Each class is a coverage requirem
 | 3 — IPsec subsystem LPE | T1068 | cve-catalog.json: CVE-2026-43284 / CVE-2026-43500 / CVE-2026-46300 | Network-segmentation claimed as compensating control for the attack surface itself; patch-landed-therefore-safe assumes patches close bug families (Fragnesia disproved this in days) |
 | 4 — Prompt injection RCE | AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak) | atlas-ttps.json + CVE-2025-53773 | Prompt injection treated as T&S, not security |
 | 5 — MCP supply chain RCE | AML.T0010 (AI Supply Chain Compromise), T1190 (Exploit Public-Facing Application) | atlas-ttps.json + CVE-2026-30615 | AI plugin ecosystem out of supply-chain scope |
-| 6 — AI-assisted weaponization | AML.T0016 (Obtain Capabilities: Develop Capabilities) | atlas-ttps.json | Patch SLAs sized for 2019 attacker speed |
-| 7 — AI as covert C2 | AML.T0096 (LLM Integration Abuse — C2) | atlas-ttps.json | C2 detection architecture has total blind spot |
-| 8 — AI-generated malware evasion | AML.T0016 (Obtain Capabilities: Develop Capabilities — payload generation) | atlas-ttps.json | Detection stack signature-bound; PROMPTFLUX bypasses by design |
+| 6 — AI-assisted weaponization | AML.T0017 (Develop Capabilities) | atlas-ttps.json | Patch SLAs sized for 2019 attacker speed |
+| 7 — AI as covert C2 | AML.T0096 (AI Service API, C2) | atlas-ttps.json | C2 detection architecture has total blind spot |
+| 8 — AI-generated malware evasion | AML.T0016 (Obtain Capabilities, payload generation) | atlas-ttps.json | Detection stack signature-bound; PROMPTFLUX bypasses by design |
 | 9 — RAG exfiltration | AML.T0043 (Craft Adversarial Data) | atlas-ttps.json | Vector store treated as database, not as semantic exfil surface |
 | 10 — Model poisoning | AML.T0020 (Training Data Poisoning) | atlas-ttps.json | ML decision systems treated as standard software |
 | 11 — AI-speed reconnaissance | T1595 (Active Scanning), T1190 | ATT&CK | Rate-based detection thresholds calibrated for human-speed scans |
-| 12 — AI-generated phishing | AML.T0016 (Obtain Capabilities: Develop Capabilities — payload crafting via public AI APIs), T1566 (Phishing) | atlas-ttps.json + ATT&CK | Detection rules tuned for 2021 phishing |
+| 12 — AI-generated phishing | AML.T0016 (Obtain Capabilities, payload crafting via public AI APIs), T1566 (Phishing) | atlas-ttps.json + ATT&CK | Detection rules tuned for 2021 phishing |
 | 13 — ATLAS coverage | All AML.T* in atlas-ttps.json | atlas-ttps.json `_meta.atlas_version` | SOC detection programs are ATT&CK-only |
 | 14 — Post-quantum adversary | T1557 (harvest-now-decrypt-later context) | global-frameworks.json (PQC standards) | Long-lived sensitive traffic captured today, decrypted later |
 
@@ -427,7 +427,7 @@ A threat model is current only when each of the 14 threat classes above has a na
 | 4 — Prompt injection RCE (gateway tier) | AML.T0051 | `D3-CSPP` | Client-server Payload Profiling | LLM gateway — when SDK-side instrumentation is not deployable |
 | 5 — MCP supply chain RCE | AML.T0010 | `D3-EAL` | Executable Allowlisting | Managed endpoint — only sanctioned MCP servers and IDE assistants execute |
 | 5 — MCP supply chain RCE | AML.T0010 | `D3-EFA` | Executable File Analysis | Endpoint — pre-execution analysis of MCP-server binaries |
-| 6 — AI-assisted weaponization | AML.T0016 | `D3-NTA` | Network Traffic Analysis | Network egress — detect attacker-side AI-API queries from compromised tooling |
+| 6 — AI-assisted weaponization | AML.T0017 | `D3-NTA` | Network Traffic Analysis | Network egress — detect attacker-side AI-API queries from compromised tooling |
 | 7 — AI as covert C2 (SesameOp) | AML.T0096 | `D3-NTA` | Network Traffic Analysis | Network egress — per-identity baseline of model-API destinations |
 | 8 — AI-generated malware evasion (PROMPTFLUX) | AML.T0016 | `D3-PA` | Process Analysis | Endpoint — behavioral detection of in-process LLM-query patterns |
 | 9 — RAG exfiltration | AML.T0043 | `D3-FAPA` | File Access Pattern Analysis | Data tier — RAG-corpus retrieval-pattern baselining |

package/skills/threat-modeling-methodology/skill.md

@@ -67,7 +67,7 @@ Most "threat models" in circulation in mid-2026 are STRIDE diagrams of 2018–20
 
 - **No AI agents as actors.** The actor inventory lists humans, services, and external systems. AI coding assistants, MCP servers, RAG retrievers, autonomous agents executing tool calls — none appear with their own trust boundaries. The Windsurf MCP local-vector RCE (CVE-2026-30615, CVSS 8.0 / AV:L) and the Copilot YOLO-mode RCE (CVE-2025-53773, CVSS 7.8 / AV:L) are not representable in a model whose actor schema predates the threat.
 - **No MCP supply-chain RCE class.** Trust boundaries between developer workstations and "tool plugins" do not exist in pre-2024 threat models. The supply-chain chapter lists npm, Docker, and OS packages — not AI tool plugins, which now have an equal or greater attack surface across 150M+ assistant installs.
-- **No AI-API as C2 channel.** The C2 chapter enumerates DGAs, beaconing, protocol anomalies. ATLAS AML.T0096 (LLM Integration Abuse — covert C2, SesameOp pattern) is not on the diagram. The model cannot reason about a documented technique that is operationally indistinguishable from legitimate AI usage at the network layer.
+- **No AI-API as C2 channel.** The C2 chapter enumerates DGAs, beaconing, protocol anomalies. ATLAS AML.T0096 (AI Service API, covert C2, SesameOp pattern) is not on the diagram. The model cannot reason about a documented technique that is operationally indistinguishable from legitimate AI usage at the network layer.
 - **Prompt injection mis-classified.** Pre-2024 STRIDE assigns prompt injection to "Tampering" or omits it entirely. Operationally it is an access-control bypass that achieves what spoofing achieves via the model's context window, with measured success rates above 85% against state-of-the-art defences.
 - **Embedding store missing from crown jewels.** Data-classification work predates RAG. Vector embeddings of proprietary documents are treated as "metadata" rather than as a semantic projection of the underlying sensitive corpus.
 
@@ -101,7 +101,7 @@ No major risk-assessment, secure-development, or AI-management framework prescri
 | EU | DORA (Regulation 2022/2554) | Art. 6 — ICT risk management framework | "Ongoing" risk identification; undefined methodology. |
 | EU | EU Cyber Resilience Act (Regulation 2024/2847) | Annex I, Part I — Essential cybersecurity requirements | Requires risk assessment over the product lifecycle; does not specify methodology, does not name AI components or agent supply chain as a required model element. |
 | UK | NCSC | Cyber Assessment Framework Principle A2 (Risk Management); NCSC Threat Modelling guidance (2024 update) | Principle-based. NCSC's 2024 threat-modelling guidance recommends STRIDE-like decomposition but does not mandate AI-agent actor representation. |
-| AU | ASD | ISM control ISM-0042 (security risk management framework); ISM AI annex (2025) | ISM updates monthly but does not bind a threat-modeling methodology. The 2025 AI annex names ATLAS but does not require methodology-level integration. |
+| AU | ASD | ISM-1238 (threat modelling in the software development life cycle) and ISM-2039 (threat model review); ISM AI annex (2025) | The ISM requires threat modelling for software development and a review that tracks changes to the threat environment, but binds no threat-modeling methodology. The 2025 AI annex names ATLAS but does not require methodology-level integration. |
 | JP | NISC / IPA | Cybersecurity Management Guidelines v3.0 (2023) | Requires risk identification process; methodology-neutral; no AI-actor requirement. |
 | IL | INCD | Cyber Defence Methodology 2.0 (2024) | Risk-based but methodology-neutral; AI-system threat modelling not yet integrated as of mid-2026. |
 | SG | CSA Singapore | Cybersecurity Code of Practice (CCoP 2.0, 2022); Model AI Governance Framework v2 (2024) | CCoP requires risk assessment; AI governance framework is principle-based; neither binds a methodology. |
@@ -124,7 +124,7 @@ Threat-modelling methodologies are *consumers* of the TTP catalog, not contribut
 | Methodology | Native input | TTP pull pattern | Gap if methodology used alone |
 |---|---|---|---|
 | STRIDE / STRIDE-per-element | Trust boundaries on a DFD | Per boundary: enumerate Spoof / Tamper / Repudiate / InfoDisclose / DoS / EoP; map each to ATT&CK or ATLAS TTPs from `data/atlas-ttps.json` | Privacy threats (linkability, identifiability) compressed into "InfoDisclose" lose specificity; LINDDUN required to surface them. |
-| STRIDE-ML (Microsoft, 2020) | DFD with ML training/inference/feedback elements | Per ML element: adversarial ML threats from ATLAS (AML.T0010 ML Supply Chain, AML.T0020 Poison Training Data, AML.T0043 Craft Adversarial Data, AML.T0051 LLM Prompt Injection, AML.T0054 LLM Jailbreak, AML.T0096 LLM Integration Abuse) | Agent-as-actor still missing; needs the actor-inventory amendment described in the Analysis Procedure. |
+| STRIDE-ML (Microsoft, 2020) | DFD with ML training/inference/feedback elements | Per ML element: adversarial ML threats from ATLAS (AML.T0010 ML Supply Chain, AML.T0020 Poison Training Data, AML.T0043 Craft Adversarial Data, AML.T0051 LLM Prompt Injection, AML.T0054 LLM Jailbreak, AML.T0096 AI Service API) | Agent-as-actor still missing; needs the actor-inventory amendment described in the Analysis Procedure. |
 | PASTA | App-centric attack trees with business-impact rooting | Per app component: pull CVE-level threats from `data/cve-catalog.json` (e.g. CVE-2025-53773 prompt-injection RCE in app-integrated AI assistants) and ATLAS TTPs at the app boundary | Systemic AI risks crossing services (cross-agent prompt injection, shared embedding contamination) sit outside any one app. |
 | LINDDUN / LINDDUN-PRO | DFD plus privacy threat tree | Per data flow: Linkability, Identifiability, Non-repudiation, Detectability, Disclosure-of-Information, Unawareness/Unintervenability, Non-compliance; cross-walk to GDPR Art. 5 / Art. 32 obligations | Technical threats (memory corruption, kernel LPE) not represented. |
 | Trike | Requirements model + implementation model | Per actor-action pair: authorised vs. unauthorised actions; pull ATT&CK TTPs that bridge the gap | Limited recent revision; weaker fit for AI-agent actors. |
@@ -146,7 +146,7 @@ Methodologies are catalog consumers, not catalog producers. The matrix shows the
 | Methodology | Consumes | KEV-bound? | PoC-bound? | AI-accelerated input? | Live-patch decisions in scope? |
 |---|---|---|---|---|---|
 | STRIDE | Generic threat categories per boundary | No — threat categories are pre-CVE | No | No | No (model is design-time) |
-| STRIDE-ML | STRIDE categories + ATLAS TTPs | Indirectly via CVEs mapped to TTPs | Yes (when a TTP has a public PoC, that strengthens the threat) | Yes (AML.T0016 Obtain Capabilities: Develop Capabilities — AI on attacker side) | No |
+| STRIDE-ML | STRIDE categories + ATLAS TTPs | Indirectly via CVEs mapped to TTPs | Yes (when a TTP has a public PoC, that strengthens the threat) | Yes (AML.T0016 Obtain Capabilities and AML.T0017 Develop Capabilities, AI on attacker side) | No |
 | PASTA | App-centric attack trees consuming CVE-level primitives from `data/cve-catalog.json` | Yes (KEV entries elevate tree-branch priority) | Yes | Yes | Possible — PASTA stage VI (Vulnerability and Weakness Analysis) names live-patch as a control class |
 | LINDDUN | Privacy threat tree | No — privacy threats are policy-bound, not exploit-bound | No | No | No |
 | Trike | Authorised/unauthorised action gaps | Indirectly | Indirectly | No | No |

package/skills/zeroday-gap-learn/skill.md

@@ -166,7 +166,7 @@ Output: Lesson entry for data/zeroday-lessons.json
 | NIST 800-53 SI-2 | Flaw Remediation | Present but insufficient: 30-day SLA is exploitation window for CISA KEV + public PoC |
 | ISO 27001 A.8.8 | Technical vulnerability management | Present but insufficient: "appropriate timescales" undefined; no live-patch requirement |
 | PCI DSS 6.3.3 | Critical patches within 1 month | Present but insufficient: same problem |
-| ASD ISM-1623 | Patch within 48h with exploit | Closest to adequate, but: no live-patch mandate, 48h window still long for 732-byte public exploit |
+| ASD ISM-1877 and ISM-1696 | Patch within 48h of release when a working exploit exists | Closest to adequate, but: no live-patch mandate, and 48h is still long for a 732-byte public exploit; for workstations the 48h window applies only at Maturity Level Three |
 | Any framework | Detection for LPE exploitation patterns | Missing entirely: no framework requires auditd/eBPF exploitation detection |
 | Any framework | Live kernel patching as required capability | Missing entirely |
 
@@ -221,7 +221,7 @@ Output: Lesson entry for data/zeroday-lessons.json
 | NIS2 Art. 21(2)(c) | Patch-management measures | Present but insufficient: undefined for fast-cycle kernel LPEs with public PoC; module-blacklist not in scope |
 | DORA Art. 9 | ICT incident management | Present but insufficient: presumes vendor-patch cadence; module-unload as immediate mitigation has no place in the typical DORA evidence pack |
 | UK CAF B4 | System security | Silent on subsystem module disable as a compensating control |
-| AU ISM-1546 / Essential 8 | Patch applications | ML3 48h anchors on advisory date, not PoC availability; still long for a deterministic public exploit |
+| AU Essential 8 (ISM-1692, ISM-1877) | Patch applications and operating systems | The 48h windows run from the vendor's release rather than from public-exploit availability, and are still long for a deterministic public exploit |
 | ISO 27001 A.5.7 | Threat intelligence | Collects feeds; does not require operational pivot when intel shows a same-family sequel to a previously-patched bug |
 | Any framework | Page-cache integrity verification | Missing entirely — on-disk file-integrity tools cannot detect this class |
 
@@ -296,7 +296,7 @@ Output: Lesson entry for data/zeroday-lessons.json
 
 ### Lesson: CVE-2026-45321 (Mini Shai-Hulud TanStack npm worm)
 
-**Attack vector:** Engineering-grade three-primitive chain against the TanStack monorepo, disclosed 2026-05-11. (1) `pull_request_target` on `bundle-size.yml` runs fork-PR code with base-repo permissions (classic Pwn Request). (2) That run poisons the `actions/cache` pnpm-store under the key `Linux-pnpm-store-${hashFiles('**/pnpm-lock.yaml')}` that `release.yml` later restores. (3) On the next main push, `release.yml` (which has `id-token: write` for npm publish) restores the poisoned cache and the worm captures the OIDC token. 84 malicious versions published across 42 @tanstack/* packages between 2026-05-11 19:20-19:26 UTC. ~150M weekly downloads in scope. CVSS 9.6; CISA KEV pending. Attribution: TeamPCP. No AI-assisted exploit-development attribution for this specific instance, but the chain shape is exactly what AML.T0016-class capability-development produces at AI cadence — chained CI/CD primitives that no individual component owner recognises as exploitable.
+**Attack vector:** Engineering-grade three-primitive chain against the TanStack monorepo, disclosed 2026-05-11. (1) `pull_request_target` on `bundle-size.yml` runs fork-PR code with base-repo permissions (classic Pwn Request). (2) That run poisons the `actions/cache` pnpm-store under the key `Linux-pnpm-store-${hashFiles('**/pnpm-lock.yaml')}` that `release.yml` later restores. (3) On the next main push, `release.yml` (which has `id-token: write` for npm publish) restores the poisoned cache and the worm captures the OIDC token. 84 malicious versions published across 42 @tanstack/* packages between 2026-05-11 19:20-19:26 UTC. ~150M weekly downloads in scope. CVSS 9.6; CISA KEV pending. Attribution: TeamPCP. No AI-assisted exploit-development attribution for this specific instance, but the chain shape is exactly what AML.T0017-class capability development produces at AI cadence — chained CI/CD primitives that no individual component owner recognises as exploitable.
 
 **What control should have prevented this:**
 - Workflow-privilege isolation: `pull_request_target` should never run fork-PR code with base-repo permissions in the same job as cache writes. The chain is broken if the bundle-size workflow runs with `permissions: contents: read` and writes to a separate cache key.