@blamejs/exceptd-skills 0.21.13 → 0.21.15

package/skills/kernel-lpe-triage/skill.md

@@ -52,7 +52,7 @@ forward_watch:
   - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12 or sooner via Patch Tuesday) — Windows 11 LPE heap buffer overflow by Marcin Wiązowski; track MSRC advisory and KEV add
   - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12 or sooner via Patch Tuesday) — Windows 11 LPE 2x use-after-free by Kentaro Kawane (GMO); track MSRC advisory and KEV add
   - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — RHEL race-condition LPE by chompie / IBM X-Force XOR; track Red Hat advisory and KEV add
-last_threat_review: "2026-05-15"
+last_threat_review: "2026-09-28"
 ---
 
 # Kernel LPE Triage
@@ -83,9 +83,9 @@ The attack abuses a write primitive in the copy-on-write path of the page cache.
 ### Dirty Frag — CVE-2026-43284 + CVE-2026-43500
 
 **Classification:** Local Privilege Escalation Chain | Breaks IPsec Mitigations  
-**CVSS:** 7.8 (High) | **RWEP:** 38/100
+**CVSS / RWEP:** CVE-2026-43284 (CVSS 8.8 High, RWEP 53/100), CVE-2026-43500 (CVSS 7.6 High, RWEP 47/100)
 
-Discovered by Hyunwoo Kim. A two-CVE chain exploiting page-cache write primitives in:
+Discovered by Hyunwoo Kim with AI assistance, per Sysdig's write-up. A two-CVE chain exploiting page-cache write primitives in:
 - ESP/IPsec subsystem (CVE-2026-43284)
 - RxRPC subsystem (CVE-2026-43500)
 
@@ -104,18 +104,18 @@ The IPsec dimension is critical: organizations with network segmentation control
 
 ### Fragnesia — CVE-2026-46300
 
-**Classification:** Local Privilege Escalation | Dirty Frag family sequel | Human-Discovered  
-**CVSS:** 7.8 (High) | **RWEP:** 20/100 (will jump to 55+ on CISA KEV listing)
+**Classification:** Local Privilege Escalation | Dirty Frag family sequel | AI-Assisted Discovery  
+**CVSS:** 7.8 (High) | **RWEP:** 35/100 (60 on a CISA KEV listing)
 
-Disclosed 2026-05-13 by William Bowling (V12 security team). Same primitive class as Dirty Frag — Fragnesia is the sibling bug introduced by the patch for CVE-2026-43284 / CVE-2026-43500. The defect is in `skb_try_coalesce()`: when transferring paged fragments between socket buffers, the kernel fails to propagate the `SKBFL_SHARED_FRAG` marker, losing track of externally-backed fragments (page-cache pages spliced from a file). An unprivileged local user can deterministically overwrite read-only file data in the kernel page cache without modifying the on-disk file. Public PoC targets `/usr/bin/su` for a one-line root shell.
+Disclosed 2026-05-13 by William Bowling (V12 security team). The Hacker News and Help Net Security attribute the discovery to William Bowling of Zellic working with Zellic's AI-agentic software auditing tool. Same primitive class as Dirty Frag — Fragnesia is the sibling bug introduced by the patch for CVE-2026-43284 / CVE-2026-43500. The defect is in `skb_try_coalesce()`: when transferring paged fragments between socket buffers, the kernel fails to propagate the `SKBFL_SHARED_FRAG` marker, losing track of externally-backed fragments (page-cache pages spliced from a file). An unprivileged local user can deterministically overwrite read-only file data in the kernel page cache without modifying the on-disk file. Public PoC targets `/usr/bin/su` for a one-line root shell.
 
 Key characteristics:
-- **Deterministic exploitation** — no race condition, no kernel-version fingerprinting beyond the affected_versions range.
+- **Deterministic exploitation** — no race condition, no kernel-version fingerprinting beyond the affected version range.
 - **Public PoC** — one-liner against `/usr/bin/su` from the V12 disclosure.
 - **Page-cache corruption without on-disk write** — file-integrity tools that hash on-disk bytes (AIDE, Tripwire, IMA in measure-only mode) cannot detect the corruption.
 - **Module-unload mitigation is identical to Dirty Frag** — blacklist `esp4`, `esp6`, `rxrpc` in `/etc/modprobe.d/`. Any host already mitigated for Dirty Frag by module blacklist is already mitigated for Fragnesia, with no further action required.
 - **Live-patch is non-reboot** — AlmaLinux + CloudLinux kernels in testing as of 2026-05-13; Canonical Livepatch + kpatch follow standard cadence.
-- **Not CISA KEV-listed as of 2026-05-14**, no active exploitation observed in the wild yet. RWEP today is 20; expect 55+ if KEV-listed, 65+ if active exploitation confirmed.
+- **Not CISA KEV-listed as of the 2026-09-27 KEV catalog**, and no active exploitation has been observed in the wild. RWEP is 35; a KEV listing takes it to 60, and confirmed active exploitation to 80.
 
 **Lesson for operators:** when a CVE patch lands, retain the pre-patch compensating controls (module blacklists, sysctl restrictions) until the patched code has soaked. Fragnesia is the canonical case — the Dirty Frag patch introduced Fragnesia, and the same `modprobe -r esp4 esp6 rxrpc` mitigation covers both.
 
@@ -168,9 +168,9 @@ Note: ATLAS refs are intentionally empty in frontmatter — these are Linux kern
 | CVE | CVSS | RWEP | CISA KEV | PoC Public | AI-Discovered | Active Exploitation | Patch Available | Live Patch | Reboot Required |
 |---|---|---|---|---|---|---|---|---|---|
 | CVE-2026-31431 (Copy Fail) | 7.8 | 90 | Yes (2026-05-01, due 2026-05-15) | Yes — 732-byte script | Yes | Confirmed | Yes | Yes (kpatch/livepatch/kGraft) | Yes |
-| CVE-2026-43284 (Dirty Frag ESP) | 7.8 | 38 | No | Yes | No | Suspected | Yes | No (kpatch RHEL-only) | Yes |
-| CVE-2026-43500 (Dirty Frag RxRPC) | 7.6 | 81 | No | Yes (chain component) | No | Suspected | Yes | Partial (kpatch) | Yes if no live patch |
-| CVE-2026-46300 (Fragnesia) | 7.8 | 20 | No (likely candidate) | Yes — one-liner vs /usr/bin/su | No | None observed | Yes (testing on Alma/CloudLinux) | Yes (kpatch / canonical-livepatch / KernelCare) | No (module-unload mitigation is non-reboot) |
+| CVE-2026-43284 (Dirty Frag ESP) | 8.8 | 53 | No | Yes | Yes (AI-assisted) | Suspected | Yes | No (kpatch RHEL-only) | Yes |
+| CVE-2026-43500 (Dirty Frag RxRPC) | 7.6 | 47 | No | Yes (chain component) | Yes (AI-assisted) | Suspected | Yes | No | Yes |
+| CVE-2026-46300 (Fragnesia) | 7.8 | 35 | No (likely candidate) | Yes — one-liner vs /usr/bin/su | Yes (AI-assisted) | None observed | Yes (testing on Alma/CloudLinux) | Yes (kpatch / canonical-livepatch / KernelCare) | No (module-unload mitigation is non-reboot) |
 
 ---
 
@@ -338,9 +338,9 @@ Produce this structure:
 
 ### RWEP Scores
 CVE-2026-31431: CVSS 7.8 / RWEP 90 — immediate action required (4h)
-CVE-2026-43284: CVSS 7.8 / RWEP 38 — remediate within 7 days; disable RxRPC/IPsec chain if not required
-CVE-2026-43500: CVSS 7.6 / RWEP 32 — remediate within 7 days; consider disabling RxRPC module
-CVE-2026-46300: CVSS 7.8 / RWEP 20 — patch within standard cycle; module unload (esp4/esp6/rxrpc) is the immediate non-reboot mitigation. Same mitigation set as Dirty Frag — already-blacklisted hosts are already covered. Reassess if CISA KEV-listed (expected RWEP 55+).
+CVE-2026-43284: CVSS 8.8 / RWEP 53 — remediate within 7 days; disable RxRPC/IPsec chain if not required
+CVE-2026-43500: CVSS 7.6 / RWEP 47 — remediate within 7 days; consider disabling RxRPC module
+CVE-2026-46300: CVSS 7.8 / RWEP 35 — patch within standard cycle; module unload (esp4/esp6/rxrpc) is the immediate non-reboot mitigation. Same mitigation set as Dirty Frag — already-blacklisted hosts are already covered. Reassess on a CISA KEV listing, which adds 25 points.
 ```
 
 ---
@@ -389,7 +389,7 @@ Maps the kernel LPE findings above to MITRE D3FEND techniques with explicit defe
 
 After producing the kernel LPE triage output, the operator should chain into the following skills. Each entry names a downstream or sibling skill and the specific reason to invoke it from this finding.
 
-- **`exploit-scoring`** — recalculate RWEP when any of the inputs that drive the score change post-triage: a new CISA KEV listing for Dirty Frag, a public PoC for CVE-2026-43500's RxRPC leg, or an AI-discovery flag flip. RWEP, not CVSS, is the prioritisation signal — re-run scoring rather than re-reading the static value in the matrix above.
+- **`exploit-scoring`** — recalculate RWEP when any of the inputs that drive the score change post-triage: a new CISA KEV listing for Dirty Frag, confirmed active exploitation of either leg, or an AI-discovery flag flip. RWEP, not CVSS, is the prioritisation signal — re-run scoring rather than re-reading the static value in the matrix above.
 - **`defensive-countermeasure-mapping`** — map each kernel LPE finding to D3FEND counters (D3-EAL for executable allowlisting at the kernel-module layer, D3-ASLR for address-space layout randomisation hardening, D3-PSEP for process self-modification prevention, D3-PHRA for process hardening / runtime attestation) and produce the defence-in-depth, least-privilege, zero-trust layered remediation plan rather than a single-control patch ticket.
 - **`attack-surface-pentest`** — verify that the kernel LPE class is in the organisation's pen-test scope (TIBER-EU / DORA TLPT for EU financial-sector orgs, CBEST for UK financial, or the equivalent red-team programme). Most 2025-vintage pen-test scopes are perimeter / web-app focused and do not exercise local LPE primitives against the patched-kernel claim.
 - **`compliance-theater`** — test whether the org's SI-2 / A.8.8 / PCI 6.3.3 patch-management evidence is CVSS-anchored theater for a KEV-listed, AI-discovered, 732-byte deterministic LPE. The 30-day window is the exploitation window; if the org cannot show live-patch-within-4-hours capability or documented compensating controls, the patch-management control is theater for this CVE class.

package/skills/policy-exception-gen/skill.md

@@ -23,7 +23,7 @@ forward_watch:
   - EU CRA exceptions for AI pipeline components
   - NIST SP 800-204 series updates for microservices
   - FedRAMP updates for container/serverless authorization
-last_threat_review: "2026-09-18"
+last_threat_review: "2026-09-28"
 ---
 
 # Policy Exception Generation
@@ -109,10 +109,10 @@ For each residual TTP an exception leaves in scope, the compensating control bun
 
 | Residual TTP | Evidence CVE / class | CVSS | RWEP tier | KEV | Public PoC | AI-accelerated | Live-patchable | Implication for compensating bundle |
 |---|---|---|---|---|---|---|---|---|
-| T1068 (Privilege Escalation — Copy Fail class) | CVE-2026-31431 | High | Critical | Yes | Yes (732 bytes, deterministic) | Yes | Yes (kpatch/livepatch) | Live patch within 4 hours OR network isolation — anything weaker is non-defensible |
-| T1190 (Exploit Public-Facing Application — IPsec subsystem) | CVE-2026-43284 (Dirty Frag) | High | High | Pending | Partial | No | Limited | eBPF kernel-text integrity monitoring + maintenance-window reboot SLA |
+| T1068 (Privilege Escalation — Copy Fail class) | CVE-2026-31431 | 7.8 | 90 | Yes (2026-05-01) | Yes (732 bytes, deterministic) | Yes | Yes (kpatch/livepatch) | Live patch within 4 hours OR network isolation — anything weaker is non-defensible |
+| T1190 (Exploit Public-Facing Application — IPsec subsystem) | CVE-2026-43284 (Dirty Frag) | 8.8 | 53 | No | Yes (chain component) | Yes (AI-assisted discovery) | Limited (kpatch RHEL-only) | eBPF kernel-text integrity monitoring + maintenance-window reboot SLA |
 | AML.T0051 (LLM Prompt Injection — emergent on model upgrade) | CVE-2025-53773 (Copilot YOLO-mode RCE) | 7.8 (AV:L) | 30 | No | Yes | Yes | Yes (SaaS push / IDE update) | Behavioral regression suite + system-prompt hardening + tool allowlist |
-| AML.T0010 (ML Supply Chain Compromise — MCP) | CVE-2026-30615 (Windsurf MCP local-vector RCE) | 8.0 (AV:L) | 35 | No | Partial | No | Yes (IDE update) | MCP server allowlist + signed-manifest enforcement + per-server auth |
+| AML.T0010 (ML Supply Chain Compromise — MCP) | CVE-2026-30615 (Windsurf MCP local-vector RCE) | 8.0 (AV:L) | 35 | No | Yes | No | Yes (IDE update) | MCP server allowlist + signed-manifest enforcement + per-server auth |
 | T1525 / T1610 (Implant Internal Image / Deploy Container) | Image-supply-chain class | Varies | High | N/A | Operational | Yes | N/A (image rebuild) | CI image scanning gate at CVSS ≥ 7.0, SBOM per image, image-registry signing |
 
 An exception that names a residual TTP without a compensating-control bundle of equal or greater RWEP-justified strength is theater. The compliance-theater skill's universal test (demand the bypassing TTP for any claimed compensating control) should be run against the bundle before the exception is approved.

package/skills/sector-federal-government/skill.md

@@ -60,7 +60,7 @@ forward_watch:
   - UK GovAssure replacing the legacy IT Health Check (ITHC) scheme — phased rollout for departments and ALBs through 2026
   - EU Cybersecurity Certification Scheme on Common Criteria (EUCC) operational — first certificates issued 2024; high-assurance level for government use cases ramping
   - Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities
-last_threat_review: "2026-09-18"
+last_threat_review: "2026-09-28"
 discovery_mode: "standalone"  # operator-reached via `exceptd brief sector-federal-government` or `exceptd ask`; not chained into any playbook's direct.skill_chain by design
 ---
 
@@ -140,11 +140,11 @@ Sourced from `data/cve-catalog.json`, `data/exploit-availability.json`, and CISA
 
 | Incident / Class | CVSS | RWEP | PoC Public? | CISA KEV? | AI-Accelerated? | Patch / Mitigation | FedRAMP-Visible? | CMMC-Visible? | SSDF-Attestable? |
 |---|---|---|---|---|---|---|---|---|---|
-| CVE-2026-30615 (Windsurf MCP local-vector RCE — DIB development environments) | 8.0 | 35 (see `cve-catalog.json`) | Partial conceptual exploit | No (architectural class) | Rides on AI agent tool-call autonomy; AV:L (attacker-controlled HTML processed by the MCP client) | Vendor IDE update + manifest signing + MCP server allowlisting | Limited — developer workstation tooling typically outside FedRAMP boundary | Partially — CMMC Level 2 CM (configuration management) and AC (access control) families touch developer workstations handling CUI; MCP-specific controls absent | SSDF practice PS.2 covers software dependency integrity but does not specify MCP manifest signing |
+| CVE-2026-30615 (Windsurf MCP local-vector RCE — DIB development environments) | 8.0 | 35 (see `cve-catalog.json`) | Yes | No (architectural class) | Rides on AI agent tool-call autonomy; AV:L (attacker-controlled HTML processed by the MCP client) | Vendor IDE update + manifest signing + MCP server allowlisting | Limited — developer workstation tooling typically outside FedRAMP boundary | Partially — CMMC Level 2 CM (configuration management) and AC (access control) families touch developer workstations handling CUI; MCP-specific controls absent | SSDF practice PS.2 covers software dependency integrity but does not specify MCP manifest signing |
 | Volt Typhoon pre-positioning (PRC nation-state, CISA/FBI/NSA joint advisories ongoing since May 2023) | N/A (campaign) | N/A | Yes — public IOC sets and TTP descriptions | Multiple component CVEs in KEV | Yes — AI-assisted lateral movement reported in adjacent campaigns | Living-off-the-land detection; rigorous identity ZT (M-22-09 pillar 1); network ZT (M-22-09 pillar 3); credential hygiene | Partially — FedRAMP ConMon detects only the cloud-tenant surface | Partially — CMMC AC + AU + IR families address detection but not pre-positioning specifically | No — SSDF is producer-side |
 | Salt Typhoon US telco intrusions (PRC nation-state, publicly disclosed late 2024) | N/A (campaign) | N/A | Yes — IOC sets and CISA/FBI joint advisories | Multiple component CVEs in KEV | Yes — large-scale exploitation of edge-device CVEs | Patch + replace EOL edge devices; lawful-intercept-interface hardening; segment carrier management plane | No — telco infrastructure outside FedRAMP scope | No — telco carriers outside CMMC scope | No |
 | SolarWinds Orion supply-chain compromise (CVE-2020-10148 + SUNBURST backdoor, historical reference) | 9.8 | not in current `data/cve-catalog.json` — pre-scope incident | Yes — fully post-disclosure | Yes (KEV at time of disclosure) | No — long-game manual TTP | Patch; rotate all credentials handled by affected Orion deployments; rebuild from clean state | Yes — FedRAMP-authorized SolarWinds Orion ATOs were impacted; ConMon did not detect the implanted update | Yes — DIB contractors using Orion were impacted; current 800-171 SI-3 / SI-4 controls would not have detected the implant | Partially — SLSA L3 + in-toto + reproducible builds would have detected the build-time tampering; SSDF self-attestation alone would not |
-| XZ Utils backdoor (CVE-2024-3094, 2024) | 10.0 | 70 (catalog: KEV 2024-04-03; active_exploitation=suspected; ai_discovered=false) | Yes — fully public post-disclosure | Yes — KEV 2024-04-03 | No — multi-year human social-engineering long game | Distro rollback to 5.4.x; key revocation in federal build pipelines | Indirectly — federal-procured Linux distros downstream of upstream sshd were exposed | Yes — DIB development environments built against affected distros were in scope | Partially — SSDF PS.1 / PS.2 reference dependency integrity; do not require SLSA L3 detection |
+| XZ Utils backdoor (CVE-2024-3094, 2024) | 10.0 | 45 (see `cve-catalog.json`; not KEV-listed, exploitation suspected, human-discovered) | Yes — fully public post-disclosure | No | No — multi-year human social-engineering long game | Distro rollback to 5.4.x; key revocation in federal build pipelines | Indirectly — federal-procured Linux distros downstream of upstream sshd were exposed | Yes — DIB development environments built against affected distros were in scope | Partially — SSDF PS.1 / PS.2 reference dependency integrity; do not require SLSA L3 detection |
 | Typosquat against MCP / `@modelcontextprotocol/*` / Hugging Face namespaces targeting DIB AI developers (AML.T0010 class, ongoing) | N/A (technique class) | N/A | Yes — multiple public incidents | No (technique class) | Yes — AI assistants accelerate convincing tool-description authoring | Pin versions; verify publisher provenance; enforce private registry mirroring for CUI development environments | Limited | Partially — CMMC SC + SI families address some controls but MCP namespace specifically is not covered | Yes — SSDF practice PS.2 (software integrity) applies but does not specify the technique-class control |
 | AI-generated code committed to federal / DIB codebases without provenance markers (no CVE — class risk) | N/A | N/A | Pervasive | No | Yes — by definition | Commit-trailer provenance markers; PR-level attestation; in-CI AI-code detector; restricted federal-codebase AI tool allowlist | No — not within FedRAMP control set | No — CMMC Level 2 does not address AI-codegen provenance | No — SSDF does not specify AI-codegen attribution |
 | Edge / VPN appliance zero-days driving recent CISA Emergency Directives (ED 24-01 Ivanti Connect Secure class, ED 24-02 Microsoft / Midnight Blizzard, ongoing 2024-2026) | varies — multiple CVEs, most in KEV | varies | Yes — public PoCs typically within days | Yes | Yes — AI-assisted reverse engineering on appliance firmware reported | Vendor patch + agency-specific compensating controls per the ED text; ED-mandated actions within hours-to-days | Yes — affected appliances often within FedRAMP-authorized boundaries or boundary-adjacent | Yes — DIB contractors using affected appliances inherit the threat | Producer-side — appliance vendor SSDF attestations are downstream evidence |

package/skills/security-maturity-tiers/skill.md

@@ -44,7 +44,7 @@ forward_watch:
   - Framework updates that change minimum compliance baselines
   - New tooling that makes higher tiers more accessible
   - PQC tooling maturity shifting overkill to practical
-last_threat_review: "2026-09-18"
+last_threat_review: "2026-09-28"
 ---
 
 # Security Maturity Tiers
@@ -526,14 +526,14 @@ D3FEND references from `data/d3fend-catalog.json`. This skill prescribes a roadm
 
 Tiered to the current `data/cve-catalog.json`, using RWEP (`lib/scoring.js`) as the priority metric, not CVSS:
 
-| Tier | Coverage requirement | CVEs in scope as of 2026-05-01 | Available exploits | Required protective state |
+| Tier | Coverage requirement | Example CVEs in scope | Available exploits | Required protective state |
 |---|---|---|---|---|
 | MVP | RWEP >= 70 | CVE-2026-31431 (Copy Fail, RWEP 90, CVSS 7.8) | Public 732-byte deterministic PoC; KEV-listed 2026-05-01 (federal due 2026-05-15); AI-discovered; live-patch available (kpatch / canonical-livepatch / kGraft) | Live-patched within hours of KEV listing OR fully patched + rebooted OR network-isolated with documented reboot date |
-| Practical | RWEP >= 30 | CVE-2026-31431 (90), CVE-2026-30615 (Windsurf MCP local-vector RCE, 35, CVSS 8.0), CVE-2025-53773 (Copilot YOLO-mode RCE, 30, CVSS 7.8) | Copy Fail as above; CVE-2026-30615 + CVE-2025-53773 both AV:L local-vector, demonstrated PoC, vendor-patchable; AI-coding-assistant scope | All MVP coverage plus: prompt-injection classifier in front of any LLM processing external content; phishing simulation using AI-generated content; org-wide AI-coding-assistant version management; MCP server allowlisting with signed manifests |
-| Overkill | All catalog entries regardless of RWEP | CVE-2026-31431 (90), CVE-2026-43284 (Dirty Frag ESP/IPsec, 38, CVSS 7.8), CVE-2026-30615 (Windsurf MCP local-vector RCE, 35, CVSS 8.0), CVE-2026-43500 (Dirty Frag RxRPC, 32, CVSS 7.6), CVE-2025-53773 (Copilot YOLO-mode RCE, 30, CVSS 7.8) | Public PoC for all; Dirty Frag pair has no live patch (kpatch RHEL-only); Windsurf is local-vector supply-chain class; chained Dirty Frag requires kernel-version fingerprinting | All Practical coverage plus: kernel hardening (unprivileged_userns_clone=0, unprivileged_userfaultfd=0, kptr_restrict=2); seccomp profiles on all containers; eBPF runtime detection; immutable infrastructure for the workloads that tolerate it; sandboxed MCP execution; per-invocation capability tokens for AI agents |
+| Practical | RWEP >= 30 | CVE-2026-31431 (90), CVE-2026-43284 (Dirty Frag ESP/IPsec, 53, CVSS 8.8), CVE-2026-43500 (Dirty Frag RxRPC, 47, CVSS 7.6), CVE-2026-30615 (Windsurf MCP local-vector RCE, 35, CVSS 8.0), CVE-2025-53773 (Copilot YOLO-mode RCE, 30, CVSS 7.8) | Copy Fail as above; the Dirty Frag pair has a public chain PoC and no broad live patch (kpatch RHEL-only); CVE-2026-30615 + CVE-2025-53773 both AV:L local-vector, demonstrated PoC, vendor-patchable; AI-coding-assistant scope | All MVP coverage plus: prompt-injection classifier in front of any LLM processing external content; phishing simulation using AI-generated content; org-wide AI-coding-assistant version management; MCP server allowlisting with signed manifests |
+| Overkill | All catalog entries regardless of RWEP | CVE-2026-31431 (90), CVE-2026-43284 (Dirty Frag ESP/IPsec, 53, CVSS 8.8), CVE-2026-30615 (Windsurf MCP local-vector RCE, 35, CVSS 8.0), CVE-2026-43500 (Dirty Frag RxRPC, 47, CVSS 7.6), CVE-2025-53773 (Copilot YOLO-mode RCE, 30, CVSS 7.8) | Public PoC for all; Dirty Frag pair has no live patch (kpatch RHEL-only); Windsurf is local-vector supply-chain class; chained Dirty Frag requires kernel-version fingerprinting | All Practical coverage plus: kernel hardening (unprivileged_userns_clone=0, unprivileged_userfaultfd=0, kptr_restrict=2); seccomp profiles on all containers; eBPF runtime detection; immutable infrastructure for the workloads that tolerate it; sandboxed MCP execution; per-invocation capability tokens for AI agents |
 
 Refresh trigger: re-run `node lib/scoring.js` and rebuild this matrix whenever `data/cve-catalog.json` is updated. The zero-day learning loop also feeds back into the tier mapping when a new CVE is added.
 
-Note on CVSS divergence: every CVE in this catalog has a CVSS in the 7.6–8.0 range — CVSS alone would prioritise the highest-band CVE without distinguishing the AI-discovered KEV-listed deterministic LPE (Copy Fail) from the local-vector MCP supply-chain class (Windsurf). RWEP correctly ranks Copy Fail (90) above Windsurf (35) because KEV listing, deterministic exploitability, AI discovery, and broad blast radius dominate. The MVP tier protects against the right thing first.
+Note on CVSS divergence: every CVE in this matrix has a CVSS between 7.6 and 8.8, so CVSS alone would prioritize the highest-band CVE without distinguishing the AI-discovered KEV-listed deterministic LPE (Copy Fail) from the local-vector MCP supply-chain class (Windsurf). RWEP correctly ranks Copy Fail (90) above Windsurf (35) because KEV listing, deterministic exploitability, AI discovery, and broad blast radius dominate. The MVP tier protects against the right thing first.
 
 ---

package/skills/supply-chain-integrity/skill.md

@@ -67,7 +67,7 @@ d3fend_refs:
   - D3-CBAN
   - D3-EAL
   - D3-EHB
-last_threat_review: "2026-09-18"
+last_threat_review: "2026-09-28"
 ---
 
 # Supply-Chain Integrity Assessment
@@ -167,8 +167,8 @@ Sourced from `data/cve-catalog.json`, `data/exploit-availability.json`, and publ
 
 | Incident / Class | CVSS | RWEP | PoC Public? | CISA KEV? | AI-Accelerated? | Patch / Mitigation | SLSA-Detectable? | SBOM-Detectable? | VEX-Helpful? |
 |---|---|---|---|---|---|---|---|---|---|
-| CVE-2026-30615 (Windsurf MCP zero-interaction RCE) | 9.8 | 35 (see `cve-catalog.json`) | Partial conceptual exploit | No (architectural class) | No direct AI weaponization recorded; the attack rides on AI agent tool-call autonomy | Vendor IDE update + manifest signing | Partially — SLSA L3 on the MCP server build would attest the binary, but client-side trust verification is the actual control | Partially — SBOM lists the MCP server package; VEX from the publisher would mark unpatched versions as `affected` | Yes — CSAF 2.0 VEX from the vendor classifies versions |
-| XZ Utils backdoor (CVE-2024-3094, 2024) | 10.0 | 70 (catalog: KEV 2024-04-03; active_exploitation=suspected; ai_discovered=false) | Yes — fully public post-disclosure | Yes — KEV 2024-04-03 | No — multi-year human social-engineering long game | Distro rollback to 5.4.x; key revocation in build pipelines | Yes — SLSA L3 with reproducible builds would have detected divergence between source and binary | Partially — SBOM lists `xz` but not the modified release tarball provenance | Yes — VEX statements published rapidly after disclosure |
+| CVE-2026-30615 (Windsurf MCP local-vector RCE) | 8.0 | 35 (see `cve-catalog.json`) | Yes | No (architectural class) | No direct AI weaponization recorded; the attack rides on AI agent tool-call autonomy | Vendor IDE update + manifest signing | Partially — SLSA L3 on the MCP server build would attest the binary, but client-side trust verification is the actual control | Partially — SBOM lists the MCP server package; VEX from the publisher would mark unpatched versions as `affected` | Yes — CSAF 2.0 VEX from the vendor classifies versions |
+| XZ Utils backdoor (CVE-2024-3094, 2024) | 10.0 | 45 (see `cve-catalog.json`; not KEV-listed, exploitation suspected, human-discovered) | Yes — fully public post-disclosure | No | No — multi-year human social-engineering long game | Distro rollback to 5.4.x; key revocation in build pipelines | Yes — SLSA L3 with reproducible builds would have detected divergence between source and binary | Partially — SBOM lists `xz` but not the modified release tarball provenance | Yes — VEX statements published rapidly after disclosure |
 | Typosquat in `@modelcontextprotocol/*` namespace (AML.T0010 class, ongoing 2024-2026) | N/A (technique class) | N/A | Yes — multiple public incidents | No (technique class) | Yes — AI assistants accelerate convincing tool-description authoring | Mitigation only: pin versions, verify npm provenance attestation, enforce publisher allowlist | Yes — SLSA provenance from a known publisher fails for a typosquatted package | Yes — SBOM diff at install time flags new unrecognized package | Limited — VEX is about known vulns, not malicious-by-design packages |
 | Hugging Face poisoned model weights (AML.T0018, ongoing) | N/A (technique class) | N/A | Yes — public research demonstrations of RCE in model artifacts using code-executing serialization formats | No | Yes — adversarial weights via training-data poisoning is AI-accelerated | Reject code-executing serialization formats; require safetensors; verify Sigstore / OpenSSF model-signing signatures | Yes — SLSA-style attestation of model training run | Partial — ML-BOM (CycloneDX 1.6) inventories models; does not by itself attest integrity | Limited — VEX semantics map weakly to model integrity |
 | AI-coding-assistant generated code with no provenance markers (no CVE — class risk) | N/A | N/A | N/A — pervasive in 2024-2026 codebases | No | Yes — by definition | Mitigation: commit-message provenance markers, in-toto-style attestation that ties commit to model + prompt context | Partially — SLSA provenance can attest the human author of a commit; AI-co-author attribution is not standardized | No — SBOM does not currently inventory AI-generated code segments | Not applicable |

package/skills/threat-model-currency/skill.md

@@ -22,7 +22,7 @@ forward_watch:
   - New CISA KEV entries in kernel/AI/supply chain categories
   - New MCP or agent protocol security disclosures
   - Emerging malware families using AI for evasion
-last_threat_review: "2026-09-18"
+last_threat_review: "2026-09-28"
 discovery_mode: "standalone"  # operator-reached via `exceptd brief threat-model-currency` or `exceptd ask`; not chained into any playbook's direct.skill_chain by design
 ---
 
@@ -294,12 +294,12 @@ A threat model is "current" only if it accounts for every `data/cve-catalog.json
 |---|---|---|---|---|---|---|---|---|
 | CVE-2026-31431 | Copy Fail | 7.8 | 90 | Yes (2026-05-01, due 2026-05-15) | Yes — 732-byte deterministic | AI-discovered | Yes (kpatch / canonical-livepatch / kGraft) | Must name as named threat. Patch SLA must reflect KEV + deterministic class — live-patch within hours, not 30 days. |
 | CVE-2025-53773 | Copilot YOLO-mode RCE | 7.8 | 30 | No | Yes — demonstrated | AI-weaponized | Yes (SaaS vendor patch / IDE update) | Must include prompt-injection-driven YOLO-mode escalation as RCE vector if any developer uses Copilot. |
-| CVE-2026-30615 | Windsurf MCP local-vector RCE | 8.0 | 35 | No | Partial | No | Yes (IDE update) | Must include MCP supply chain if any developer uses any MCP-capable assistant. |
-| CVE-2026-43284 | Dirty Frag (ESP/IPsec) | 7.8 | 38 | No | Yes — chain component | No | No | Required if IPsec-based controls are claimed as compensating. |
-| CVE-2026-43500 | Dirty Frag (RxRPC) | 7.6 | 32 | No | Yes — chain component | No | No | Required when chained with CVE-2026-43284 in IR scenario planning. |
-| CVE-2026-46300 | Fragnesia | 7.8 | 20 (today) / 55+ on KEV | No (candidate) | Yes — one-liner vs /usr/bin/su | No (human-discovered by V12 security team) | Yes (kpatch / canonical-livepatch / KernelCare) | Required when the threat model claims patches close bug families — Fragnesia is the sibling bug introduced by the Dirty Frag patch; the same `blacklist esp4 / esp6 / rxrpc` mitigation covers both. Treat as the canonical "today" example of threat-intel decay measured in days, not quarters. |
+| CVE-2026-30615 | Windsurf MCP local-vector RCE | 8.0 | 35 | No | Yes | No | Yes (IDE update) | Must include MCP supply chain if any developer uses any MCP-capable assistant. |
+| CVE-2026-43284 | Dirty Frag (ESP/IPsec) | 8.8 | 53 | No | Yes — chain component | AI-assisted discovery | No | Required if IPsec-based controls are claimed as compensating. |
+| CVE-2026-43500 | Dirty Frag (RxRPC) | 7.6 | 47 | No | Yes — chain component | AI-assisted discovery | No | Required when chained with CVE-2026-43284 in IR scenario planning. |
+| CVE-2026-46300 | Fragnesia | 7.8 | 35 (60 if KEV-listed) | No (candidate) | Yes — one-liner vs /usr/bin/su | AI-assisted discovery (Zellic's agentic auditing tool) | Yes (kpatch / canonical-livepatch / KernelCare) | Required when the threat model claims patches close bug families — Fragnesia is the sibling bug introduced by the Dirty Frag patch; the same `blacklist esp4 / esp6 / rxrpc` mitigation covers both. Treat as the canonical "today" example of threat-intel decay measured in days, not quarters. |
 
-The hard rule for currency scoring: every CVE in the catalog with RWEP >= 50 (currently CVE-2026-31431) must appear in the threat model under its named threat or its CVE ID. RWEP 40–49 entries should appear if the org uses the affected technology. Sub-40 entries appear by exception.
+The hard rule for currency scoring: every CVE in the catalog with RWEP >= 50 (query `data/cve-catalog.json` for the current set) must appear in the threat model under its named threat or its CVE ID. RWEP 40–49 entries should appear if the org uses the affected technology. Sub-40 entries appear by exception.
 
 Run `node lib/scoring.js` to recompute RWEP if `data/cve-catalog.json` has been updated since `last_threat_review`.
 

package/skills/zeroday-gap-learn/skill.md

@@ -23,7 +23,7 @@ forward_watch:
   - New ATLAS TTP additions in each ATLAS release
   - Framework updates that close previously open gaps
   - Vendor advisories for MCP/AI tool supply chain CVEs
-last_threat_review: "2026-09-18"
+last_threat_review: "2026-09-28"
 discovery_mode: "standalone"  # operator-reached via `exceptd brief zeroday-gap-learn` or `exceptd ask`; not chained into any playbook's direct.skill_chain by design
 ---
 
@@ -94,13 +94,13 @@ Status of the learning-loop entry for each CVE currently in `data/cve-catalog.js
 | CVE | KEV | PoC | AI-Discovered / AI-Enabled | RWEP | Lesson-Entry Status in `zeroday-lessons.json` |
 |---|---|---|---|---|---|
 | CVE-2026-31431 (Copy Fail) | Yes | Yes (732-byte) | Yes (AI-discovered ~1h) | 90 | Complete — pre-run lesson encoded below; new control requirements CISA-KEV-RESPONSE-SLA, LIVE-PATCH-CAPABILITY, KERNEL-EXPLOITATION-DETECTION generated |
-| CVE-2026-43284 (Dirty Frag — ESP/IPsec) | No | Yes (chain) | No | 38 | Complete — pre-run lesson encoded; new control requirements CRYPTO-SUBSYSTEM-INTEGRITY, PRE-PATCH-DISCLOSURE-RESPONSE generated |
-| CVE-2026-43500 (Dirty Frag — RxRPC) | No | Yes (chain) | No | 32 | Complete — covered jointly with CVE-2026-43284 (chain partner) |
+| CVE-2026-43284 (Dirty Frag — ESP/IPsec) | No | Yes (chain) | Yes (AI-assisted discovery) | 53 | Complete — pre-run lesson encoded; new control requirements CRYPTO-SUBSYSTEM-INTEGRITY, PRE-PATCH-DISCLOSURE-RESPONSE generated |
+| CVE-2026-43500 (Dirty Frag — RxRPC) | No | Yes (chain) | Yes (AI-assisted discovery) | 47 | Complete — covered jointly with CVE-2026-43284 (chain partner) |
 | CVE-2025-53773 (Copilot YOLO-mode RCE) | No | Yes (demonstrated) | Yes (AI tooling enables) | 30 | Complete — pre-run lesson encoded; new control requirements AI-TOOL-ACTION-AUTHORIZATION, AI-TOOL-INPUT-SANITIZATION, PROMPT-INJECTION-MONITORING generated |
-| CVE-2026-30615 (Windsurf MCP local-vector RCE) | No | Partial | No (supply-chain) | 35 | Complete — pre-run lesson encoded; new control requirements MCP-SERVER-SIGNING, MCP-TOOL-ALLOWLIST, MCP-SUPPLY-CHAIN-AUDIT generated |
-| CVE-2026-45321 (Mini Shai-Hulud TanStack npm worm) | Pending | Yes (worm in-wild) | No (engineering-grade chain) | n/a | Pre-run exemplar lesson encoded below (chained CI/CD primitives — Pwn Request + pnpm-store poisoning + OIDC theft); new control requirements PR-WORKFLOW-PRIVILEGE-CAP, ACTIONS-CACHE-INTEGRITY, OIDC-PUBLISH-AUDIT generated |
+| CVE-2026-30615 (Windsurf MCP local-vector RCE) | No | Yes | No (supply-chain) | 35 | Complete — pre-run lesson encoded; new control requirements MCP-SERVER-SIGNING, MCP-TOOL-ALLOWLIST, MCP-SUPPLY-CHAIN-AUDIT generated |
+| CVE-2026-45321 (Mini Shai-Hulud TanStack npm worm) | Yes (2026-05-27) | Yes (worm in-wild) | No (engineering-grade chain) | 70 | Pre-run exemplar lesson encoded below (chained CI/CD primitives — Pwn Request + pnpm-store poisoning + OIDC theft); new control requirements PR-WORKFLOW-PRIVILEGE-CAP, ACTIONS-CACHE-INTEGRITY, OIDC-PUBLISH-AUDIT generated |
 | MAL-2026-3083 (Elementary-Data PyPI worm — forged release via GitHub Actions script-injection) | No (OSSF Malicious Packages dataset; CISA KEV catalogues vendor CVEs only) | Yes (orphan commit + exfil domain confirmed in-wild during 8h window) | No (manual chain) | n/a | Pre-run exemplar lesson encoded below; control requirements GHACTIONS-EVENT-INTERPOLATION-BAN, INSTALL-HOOK-AUDIT, OSSF-MALPACKAGES-INGEST generated |
-| CVE-2026-46300 (Fragnesia — Dirty Frag sequel) | No (candidate within days) | Yes (one-liner vs /usr/bin/su) | No (human-discovered by V12 security team) | 20 | Complete — pre-run lesson encoded below; control requirements PAGE-CACHE-INTEGRITY-VERIFICATION, BUG-FAMILY-MITIGATION-PERSISTENCE, SCANNER-PAPER-COMPLIANCE-TEST generated. Pattern: a patch for one bug class introduced a sibling bug in the same primitive class. |
+| CVE-2026-46300 (Fragnesia — Dirty Frag sequel) | No (candidate within days) | Yes (one-liner vs /usr/bin/su) | Yes (AI-assisted discovery with Zellic's agentic auditing tool) | 35 | Complete — pre-run lesson encoded below; control requirements PAGE-CACHE-INTEGRITY-VERIFICATION, BUG-FAMILY-MITIGATION-PERSISTENCE, SCANNER-PAPER-COMPLIANCE-TEST generated. Pattern: a patch for one bug class introduced a sibling bug in the same primitive class. |
 
 Every new entry added to `data/cve-catalog.json` must produce a corresponding entry here and in `data/zeroday-lessons.json` before the catalog change ships. Any CVE in the catalog without a complete lesson entry is a pre-ship-checklist failure.
 
@@ -234,7 +234,7 @@ Output: Lesson entry for data/zeroday-lessons.json
 3. **SCANNER-PAPER-COMPLIANCE-TEST**: A vulnerability scanner that reports "patched" based on kernel package version alone is paper compliance. The operational test: does the scan account for the module-unload mitigation surface, AND does it verify the kernel is on a build that includes the specific Fragnesia patch (not just any version newer than the Dirty Frag patch that introduced Fragnesia)?
 
 **Exposure scoring:**
-- RWEP: 20 today. Will jump to 55+ on CISA KEV listing (+25) and to 65+ on confirmed active exploitation (+20 more).
+- RWEP: 35 today. A CISA KEV listing adds 25 (60), and confirmed active exploitation adds 20 more (80).
 - Audit-passing orgs still exposed: ~75%. Operators who retained the Dirty Frag module blacklist are already mitigated. Operators who relied on kernel-package-version alone with vanilla SI-2 / A.8.8 SLAs are exposed during the patch window.
 - Coverage failure: on-disk file-integrity tools (AIDE, Tripwire) report clean while the page-cache copy of /usr/bin/su is corrupted.
 
@@ -296,7 +296,7 @@ Output: Lesson entry for data/zeroday-lessons.json
 
 ### Lesson: CVE-2026-45321 (Mini Shai-Hulud TanStack npm worm)
 
-**Attack vector:** Engineering-grade three-primitive chain against the TanStack monorepo, disclosed 2026-05-11. (1) `pull_request_target` on `bundle-size.yml` runs fork-PR code with base-repo permissions (classic Pwn Request). (2) That run poisons the `actions/cache` pnpm-store under the key `Linux-pnpm-store-${hashFiles('**/pnpm-lock.yaml')}` that `release.yml` later restores. (3) On the next main push, `release.yml` (which has `id-token: write` for npm publish) restores the poisoned cache and the worm captures the OIDC token. 84 malicious versions published across 42 @tanstack/* packages between 2026-05-11 19:20-19:26 UTC. ~150M weekly downloads in scope. CVSS 9.6; CISA KEV pending. Attribution: TeamPCP. No AI-assisted exploit-development attribution for this specific instance, but the chain shape is exactly what AML.T0017-class capability development produces at AI cadence — chained CI/CD primitives that no individual component owner recognises as exploitable.
+**Attack vector:** Engineering-grade three-primitive chain against the TanStack monorepo, disclosed 2026-05-11. (1) `pull_request_target` on `bundle-size.yml` runs fork-PR code with base-repo permissions (classic Pwn Request). (2) That run poisons the `actions/cache` pnpm-store under the key `Linux-pnpm-store-${hashFiles('**/pnpm-lock.yaml')}` that `release.yml` later restores. (3) On the next main push, `release.yml` (which has `id-token: write` for npm publish) restores the poisoned cache and the worm captures the OIDC token. 84 malicious versions published across 42 @tanstack/* packages between 2026-05-11 19:20-19:26 UTC. ~150M weekly downloads in scope. CVSS 9.6; CISA added it to KEV on 2026-05-27. Attribution: TeamPCP. No AI-assisted exploit-development attribution for this specific instance, but the chain shape is exactly what AML.T0017-class capability development produces at AI cadence — chained CI/CD primitives that no individual component owner recognises as exploitable.
 
 **What control should have prevented this:**
 - Workflow-privilege isolation: `pull_request_target` should never run fork-PR code with base-repo permissions in the same job as cache writes. The chain is broken if the bundle-size workflow runs with `permissions: contents: read` and writes to a separate cache key.