@blamejs/exceptd-skills 0.21.2 → 0.21.4

package/lib/cve-batch.js

@@ -7,6 +7,7 @@
 const fs = require('fs');
 const path = require('path');
 const enrich = require('./cve-enrich.js');
+const gaps = require('./gap-detectors.js');
 
 // The insertion point just after the top-level "_meta" member, brace-matched
 // from its key. The catalog is 2-space-indented and new members match it.
@@ -60,6 +61,24 @@ function insertEntries(catalogText, entriesById) {
   return catalogText.slice(0, at) + insert + catalogText.slice(at);
 }
 
+// Sets the top-level _meta.last_updated to `today`, adding the member when it is
+// absent. Only a direct child of _meta is touched; entries carry their own
+// last_updated and keep it. The activity feed dates the catalog by this field.
+function stampMetaDate(catalogText, today) {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(String(today))) throw new Error(`cve-batch: invalid date ${today}`);
+  const m = /\n {2}"_meta"\s*:\s*\{/.exec(catalogText);
+  if (!m) throw new Error('cve-batch: could not locate top-level "_meta" member');
+  const { at } = _metaEnd(catalogText);
+  const head = catalogText.slice(m.index, at);
+  const member = /(\n {4}"last_updated"\s*:\s*")[^"]*(")/;
+  // head begins with the _meta key, so its first brace opens _meta.
+  const open = head.indexOf('{') + 1;
+  const stamped = member.test(head)
+    ? head.replace(member, `$1${today}$2`)
+    : head.slice(0, open) + `\n    "last_updated": ${JSON.stringify(today)},` + head.slice(open);
+  return catalogText.slice(0, m.index) + stamped + catalogText.slice(at);
+}
+
 function recomputeAiMeta(catalogText, aiCount, total) {
   // current_rate is ROUNDED; the floor is enforced against the RAW rate, so the
   // floor is the raw rate FLOORED (rounding both leaves 0.02262 facing a 0.023
@@ -105,7 +124,9 @@ test('${cveId}: curated KEV entry is complete and self-consistent', () => {
   assert.notStrictEqual(e._auto_imported, true, 'not a draft');
   assert.strictEqual(e.cisa_kev, true);
   assert.strictEqual(typeof e.cvss_score, 'number');
-  assert.ok(Array.isArray(e.cwe_refs) && e.cwe_refs.length > 0, 'has cwe_refs');
+  // NVD assigns no CWE to some records, so an empty list is valid.
+  assert.ok(Array.isArray(e.cwe_refs), 'has a cwe_refs array');
+  for (const ref of e.cwe_refs) assert.match(ref, /^CWE-\\d+$/);
   assert.ok(Array.isArray(e.attack_refs) && e.attack_refs.length > 0, 'has attack_refs');
   const sum = Object.values(e.rwep_factors).reduce((a, b) => a + b, 0);
   assert.strictEqual(sum, e.rwep_score, 'Σ rwep_factors === rwep_score');
@@ -154,6 +175,13 @@ async function curateBatch({ factsPath, judgmentsPath, apply, catalogRoot, today
     }
   }
 
+  // New entries and lessons may not cite the curation input; the gap-detector
+  // budget covers only texts already in the catalog.
+  for (const f of gaps.pipelineWordingFindings({ 'cve-catalog': entries, 'zeroday-lessons': lessons }, { includeDrafts: true })) {
+    errors.push(`${f.id}: ${f.catalog === 'cve-catalog' ? 'entry' : 'lesson'} ${f.field} cites the curation ` +
+      `input or a field name ("Packet: ...", "the packet names ..."); state the fact and its source instead.`);
+  }
+
   // Reported as a validation error so the DRY RUN surfaces it; insertEntries
   // throws on the same condition, but only under --apply.
   const catText = fs.readFileSync(path.join(catalogRoot, 'data', 'cve-catalog.json'), 'utf8');
@@ -171,10 +199,12 @@ async function curateBatch({ factsPath, judgmentsPath, apply, catalogRoot, today
   const ids = Object.keys(parsed).filter((k) => k !== '_meta');
   const aiCount = ids.filter((k) => parsed[k].ai_discovered === true).length;
   text = recomputeAiMeta(text, aiCount, ids.length);
+  text = stampMetaDate(text, today);
   fs.writeFileSync(catPath, text);
 
   const lesPath = path.join(catalogRoot, 'data', 'zeroday-lessons.json');
   const lesObj = addLessons(JSON.parse(fs.readFileSync(lesPath, 'utf8')), lessons);
+  lesObj._meta.last_updated = today;
   fs.writeFileSync(lesPath, JSON.stringify(lesObj, null, 2) + '\n');
 
   // The id carries its "CVE-" prefix, so lowercasing gives tests/cve-<y>-<n>.test.js.
@@ -221,4 +251,4 @@ async function cli(argv) {
   if (!r.ok) process.exitCode = 1;
 }
 
-module.exports = { insertEntries, recomputeAiMeta, addLessons, renderTest, curateBatch, cli };
+module.exports = { insertEntries, recomputeAiMeta, stampMetaDate, addLessons, renderTest, curateBatch, cli };

package/lib/cve-enrich.js

@@ -34,6 +34,23 @@ function extractVendorAdvisories(references, kevVendor, cveId) {
   return out;
 }
 
+// A curator-supplied advisory in the { vendor, id, url, published } form takes
+// the derived shape, so every record carries vendor, advisory_id, url, severity
+// and published_date. Any other member is kept after those five.
+function normalizeAdvisory(a) {
+  if (!a || typeof a !== 'object') return a;
+  const { id, published, ...rest } = a;
+  const out = {
+    vendor: rest.vendor,
+    advisory_id: rest.advisory_id ?? id ?? null,
+    url: rest.url,
+    severity: rest.severity ?? 'unknown',
+    published_date: rest.published_date ?? published ?? null,
+  };
+  for (const [k, v] of Object.entries(rest)) if (!(k in out)) out[k] = v;
+  return out;
+}
+
 function _num(x) { const n = Number(x); return Number.isFinite(n) ? n : null; }
 
 function _ordinal(n) {
@@ -114,7 +131,7 @@ function assembleEntry(facts, judgment, today) {
     if (Array.isArray(entry[k])) entry[k] = [...new Set(entry[k])];
   if (Array.isArray(entry.vendor_advisories)) {
     const seenUrl = new Set();
-    entry.vendor_advisories = entry.vendor_advisories.filter((a) => {
+    entry.vendor_advisories = entry.vendor_advisories.map(normalizeAdvisory).filter((a) => {
       const u = a && a.url;
       if (!u || seenUrl.has(u)) return !u;
       seenUrl.add(u);

package/lib/gap-detectors.js

@@ -25,6 +25,63 @@ function hasPlaceholderLanguage(str) {
   return false;
 }
 
+// Curation-pipeline wording in shipped prose: text that cites the input bundle a
+// curator worked from ("Packet: ...", "the packet names ...") or quotes a catalog
+// field name as its source. Each pattern is a construction a network packet cannot
+// form, so "packet data", "the packet socket (AF_PACKET)" and "Packet Storm" do not match.
+const PIPELINE_WORDING = [
+  /(?:^|[.;:!?,]['"’”)\]]*\s+|\(\s*)(?:the )?packet:/i,
+  /\b(?:per(?: the)?|(?:in|from|follows) the|this|own) packet:/i,
+  /\bpacket:\s*(?:cisa[_ ]kev|active_exploitation|patch_available|live_patch|cwe_refs|cvss|vector|attack_vector|rwep|affected(?:_versions)?|poc_available)\b/i,
+  /\bPacket fields?\s*(?::|for\s+(?:CVE-|this\b))/,
+  /\bPacket vector\b/,
+  /\bpacket(?:'s)? (?:attack_vector|live_patch_notes|cisa_kev|affected_versions|poc_description|patch_available|active_exploitation_notes|vendor_update_paths|cwe_refs|rwep_\w+)\b/i,
+  /\b[Tt]he packet (?:records|names|registers|supplies|lists|says|states|reports|marks|confirms|describes)\b/,
+  /\b(?:per|according to) the packet\b/i,
+  // A possessive followed by a curation noun, a catalog field identifier or a
+  // framework key. Words a network packet can also own (path, delivery, length,
+  // boundary) are left out.
+  /\bpacket's\s+(?:own|vector|stated|attack(?:\s+(?:vector|path))?|exploitation|remediation|live[- ]?patch|livepatch|chain|fix(?:ed)?|attacker|outcome|affected|flaw(?:-remediation)?|precondition|primitive|rwep|exploit|kev|gaps?|description|cit(?:ing|ed)|confirmed|defect|cwe\b|escalation|caf|recorded|requiredaction|product|essential(?:-eight)?|framing|cvss|reachability|timeline|chained|campaign|exposure|actor|interim|named|attribution|title|targeting|coverage|end-of-life|guidance|observed|recommended|threat|public-exploit|vendor|requirement|mitigation|documented|implant|lure|post-exploitation|patch-management|references?|notes?|framework|facts|advisory|versions?(?!\s+(?:field|number|byte|bits?)\b)|summary|deadline|(?:nist-800-53|uk-caf|au-essential-8|au-ism|iso-27001|nis2|dora|eu-ai-act|cwe-)[\w.-]*|(?:active_exploitation(?:_notes)?|affected_versions|ai_discovered|ai_discovery_\w+|attack_vector|cisa_kev\w*|cvss_\w+|cwe_refs|discovery_attribution_note|epss_\w+|framework_control_gaps|known_ransomware_use|live_patch_\w+|patch_available|patch_required_reboot|poc_available|poc_description|rwep_\w+|vendor_advisories|vendor_update_paths|verification_sources))\b/i,
+];
+
+function hasPipelineWording(str) {
+  if (typeof str !== "string" || str.length === 0) return false;
+  return PIPELINE_WORDING.some((re) => re.test(str));
+}
+
+// Every string under a value, with its dotted path.
+function _strings(value, pathSoFar, out) {
+  if (typeof value === "string") out.push([pathSoFar, value]);
+  else if (Array.isArray(value)) value.forEach((v, i) => _strings(v, `${pathSoFar}[${i}]`, out));
+  else if (value && typeof value === "object") {
+    for (const k of Object.keys(value)) _strings(value[k], pathSoFar ? `${pathSoFar}.${k}` : k, out);
+  }
+  return out;
+}
+
+// One finding per curated catalog or lesson text that carries pipeline wording.
+// Drafts are skipped unless opts.includeDrafts is set, as it is for a batch about
+// to be written, where every submitted object is checked.
+function pipelineWordingFindings(loaded, opts = {}) {
+  const out = [];
+  for (const catalog of ["cve-catalog", "zeroday-lessons"]) {
+    const cat = loaded[catalog];
+    if (!cat) continue;
+    for (const id of Object.keys(cat)) {
+      if (id === "_meta") continue;
+      const e = cat[id];
+      if (!e || (e._auto_imported === true && !opts.includeDrafts)) continue;
+      for (const [field, s] of _strings(e, "", [])) {
+        if (hasPipelineWording(s)) {
+          out.push({ class: "pipeline-wording", catalog, id, field,
+            reason: "text cites the curation input or a catalog field name instead of stating the fact and its source" });
+        }
+      }
+    }
+  }
+  return out;
+}
+
 // Fields present but weak; what counts as weak is per catalog and field.
 function contentQualityFindings(loaded) {
   const out = [];
@@ -403,7 +460,8 @@ function runAllDetectors(loaded, opts = {}) {
     ...crossRefCompletenessFindings(loaded),
     ...schemaEvolutionFindings(loaded),
     ...operatorActionSlaFindings(loaded, opts),
-    ...unusedOrphanFindings(loaded, orphanOpts)
+    ...unusedOrphanFindings(loaded, orphanOpts),
+    ...pipelineWordingFindings(loaded)
   ];
 }
 
@@ -416,11 +474,15 @@ const DETECTOR_CLASSES = [
   "cross-ref-completeness",
   "schema-evolution",
   "operator-action-sla",
-  "unused-orphan"
+  "unused-orphan",
+  "pipeline-wording"
 ];
 
 module.exports = {
   hasPlaceholderLanguage,
+  hasPipelineWording,
+  pipelineWordingFindings,
+  PIPELINE_WORDING,
   daysSince,
   contentQualityFindings,
   temporalStalenessFindings,

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.21.2",
+  "version": "0.21.4",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -57,7 +57,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "qF31mqZPI8ZUuuVXnV05yptx+4lZe5YX6IKIybbaqHdCQ2ELUusjgRA6Hm/G2T89mpM3iCIdnKUmUkd9A6nPDw==",
-      "signed_at": "2026-09-23T16:52:05.498Z",
+      "signed_at": "2026-09-27T05:23:30.369Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -134,7 +134,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "lwK5zyS1/TyNp0/Hh2ldlto8r0Tj0P6XWs0U0pSGjbMq7ldNnnUJDe1oLCWwvTj/fcTGPLOt51ZBGlGlGugBDA==",
-      "signed_at": "2026-09-23T16:52:05.499Z",
+      "signed_at": "2026-09-27T05:23:30.370Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -217,7 +217,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "+zW0ui2tPBoE69HFEuTHzLJkPJD3KLpDCL1murk1N+ALuWEtx/ApgS7eZVH7BsLxVv/uHmmmfw+Uu5cNhrmQAw==",
-      "signed_at": "2026-09-23T16:52:05.500Z",
+      "signed_at": "2026-09-27T05:23:30.371Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -271,7 +271,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-18",
       "signature": "zf55d/qt6fVGaqsYT1LnlcAUVcwh2qs/WBdwdAFU4pwTRp540sQoJNEo/8EPNwsCZKKwY6IOJlkMXLy/kyGRCg==",
-      "signed_at": "2026-09-23T16:52:05.500Z"
+      "signed_at": "2026-09-27T05:23:30.371Z"
     },
     {
       "name": "compliance-theater",
@@ -303,7 +303,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "osyCDCgT1mJoZjiodGsO/Q6ze65er7LWcMbBDcNXLPIuxpYONSnuUrKrG0kZmbVJMOdK5Jte+BOTkDbCYOsSAA==",
-      "signed_at": "2026-09-23T16:52:05.501Z"
+      "signed_at": "2026-09-27T05:23:30.371Z"
     },
     {
       "name": "exploit-scoring",
@@ -334,7 +334,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "p4h5ex1KPndY88cMmafXzZoz3idfI7TsdMxajjGmxPC43ZNaFnfDNfhrkQlTo42VJ+8N27ZyYNwuTCk1RtJ8Dg==",
-      "signed_at": "2026-09-23T16:52:05.501Z"
+      "signed_at": "2026-09-27T05:23:30.372Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -376,7 +376,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "NSpytlrXh1+o4sX0EqZ746eAm3+mPfl0hgpgE5YHAMcvosOu1icbZ2aR424GrB5rASr7c/5fo+olZcBA4qx9CQ==",
-      "signed_at": "2026-09-23T16:52:05.501Z",
+      "signed_at": "2026-09-27T05:23:30.372Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -443,7 +443,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "/bIjyOG3vcL6sMPX0agXTVCO2Wd6/6/PBMQfjALT63ojxXMwBDz4HQTO00OSkNgvCLTOvcUM4nN4H+4yl+roCg==",
-      "signed_at": "2026-09-23T16:52:05.502Z",
+      "signed_at": "2026-09-27T05:23:30.372Z",
       "cwe_refs": [
         "CWE-918"
       ],
@@ -484,7 +484,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-18",
       "signature": "Q40RkYhyDuzaOX02Oy/UOYEIbWMG7Jj2AIiSeUjZLrHJZcQJMsQG0YQN1/tPtzuTwip1oXf69gAe/PHuz7/uBQ==",
-      "signed_at": "2026-09-23T16:52:05.502Z",
+      "signed_at": "2026-09-27T05:23:30.373Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -519,7 +519,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-18",
       "signature": "ip/6xTNuHUcdPjPQW8TFLWatHGffymsi0xHgb/Hv/umC3GpQciVWUIp0pUJ2dlnuBnmd72IjDSvpVrQZjSzPCQ==",
-      "signed_at": "2026-09-23T16:52:05.503Z",
+      "signed_at": "2026-09-27T05:23:30.373Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -560,7 +560,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-09",
       "signature": "u/3QUr3Nh0q1tjOaHQ3yC4WIJOUoABr+6R8VStCgS4NvNBglb/JcbLYvQmFixqdURu4Qi6xtqvUw0E14b5mtDA==",
-      "signed_at": "2026-09-23T16:52:05.503Z",
+      "signed_at": "2026-09-27T05:23:30.374Z",
       "d3fend_refs": [
         "D3-EAL",
         "D3-EFA",
@@ -602,7 +602,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-18",
       "signature": "5+DC+gAxjBkgM8OjirB3yDpcSOWSiii2zuEH1ue3VDdlvfvVrLF8ysRHUHg0AYC4Y9lByy5xJb1UWz1xnRqmAw==",
-      "signed_at": "2026-09-23T16:52:05.503Z",
+      "signed_at": "2026-09-27T05:23:30.374Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -671,7 +671,7 @@
       ],
       "last_threat_review": "2026-08-05",
       "signature": "r8tW6PJ8G0Sjd9nyr6rWJ11dovdH9llEe6eAldHedUKRl+vdbQd4g5Cefs2Q/xcNzoXGh3C0usNLX8jX4EaWBQ==",
-      "signed_at": "2026-09-23T16:52:05.504Z",
+      "signed_at": "2026-09-27T05:23:30.375Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -721,7 +721,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "R9cbLm2pz1MupiQpWk3CtrnlZ06VQQ5gN5MWlMEbF+aFTHdK7JsSXoyLodZYDo1U+ROQ+4OH2VXo0Z+54k/KBw==",
-      "signed_at": "2026-09-23T16:52:05.504Z"
+      "signed_at": "2026-09-27T05:23:30.376Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -761,7 +761,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "n9Emv3t+W3lhOPkrLI06Grwx9lDVdHVYT6KMXcLHGnJiTLiSrz23XWIdpJQNMjj7Prp6TFaDScZ6x6WkZuxHDA==",
-      "signed_at": "2026-09-23T16:52:05.505Z",
+      "signed_at": "2026-09-27T05:23:30.376Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -815,7 +815,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-09",
       "signature": "Lb71p2XDRGmSUe4LGxiMl5HgJQ6gOVvWhjZ24dz8eBt7q+9qb0dLMMXshsfmreTjRU4ArNv50QPLZFFh9l+HCw==",
-      "signed_at": "2026-09-23T16:52:05.505Z"
+      "signed_at": "2026-09-27T05:23:30.377Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -891,7 +891,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "tBzI4lHl8F2+MeDZIOak1IYUBy8rrbgbc7M5uvodJXBKs+Rj9BmC0quk3NEcNRma8eIawUyyjU5ieFMi5MpiBQ==",
-      "signed_at": "2026-09-23T16:52:05.505Z"
+      "signed_at": "2026-09-27T05:23:30.377Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -952,7 +952,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "1rpQIBRamlNF6gFGwycmgGLcmNalYeAZjkRKdQ0NWQW1lXQegE4sTObgDFkKCLuLSB+6j3zjzinwSQyxwxL9Dw==",
-      "signed_at": "2026-09-23T16:52:05.506Z"
+      "signed_at": "2026-09-27T05:23:30.377Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -1030,7 +1030,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "wKN08ODL/5Z1Kr1ySnDqj/eWY013y13LRqupqEERjMLjKMxuFiC6cLUaPjUyachML0PZAZrWYlCdfrggbNxkDg==",
-      "signed_at": "2026-09-23T16:52:05.506Z"
+      "signed_at": "2026-09-27T05:23:30.378Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1114,7 +1114,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "fZ7VVjKFgQsgNNQd6m71lLY+POS/85jSZopbDwC96M+SfqSCQGW+6F9CqOhjE9vwkxoKhaKRULTfhpdbcsHhBg==",
-      "signed_at": "2026-09-23T16:52:05.506Z"
+      "signed_at": "2026-09-27T05:23:30.378Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1171,7 +1171,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "W8kg2Okd/VF521VmeVFGK2TmXkFPycuwgYdyNxLU2fMN+sR9Aals/X+Xqr/prrGEsqWnZsCInSq1TYzFr0wiDg==",
-      "signed_at": "2026-09-23T16:52:05.507Z"
+      "signed_at": "2026-09-27T05:23:30.378Z"
     },
     {
       "name": "identity-assurance",
@@ -1245,7 +1245,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-09-23T16:52:05.507Z"
+      "signed_at": "2026-09-27T05:23:30.378Z"
     },
     {
       "name": "ot-ics-security",
@@ -1304,7 +1304,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-09-18",
       "signature": "2pmqMIfqL1VAK5ZzPY4l1wllI7tnl5ne7ML6u9qQnA3SScRR1++TPUjEaB3iLZeRanCKGgkMj8LmU96dbqYYDA==",
-      "signed_at": "2026-09-23T16:52:05.507Z"
+      "signed_at": "2026-09-27T05:23:30.379Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1364,7 +1364,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "FfzagIXtJNegSNPjLSI11fnQqxXJ4nSfPcv+IdbD3XmIfDTxnV7nTAR0tCQKqOGKpsyYEwAZP5jQzA3tIuJJBw==",
-      "signed_at": "2026-09-23T16:52:05.508Z"
+      "signed_at": "2026-09-27T05:23:30.379Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1418,7 +1418,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "0njaUBtRgD+5ys5xh1x+daPI2xhnHzZP+pielUdqEndR2/uDAuf3XIDUWnhC8LKr+33HSX3pXmqfgbXJpyqxBQ==",
-      "signed_at": "2026-09-23T16:52:05.508Z"
+      "signed_at": "2026-09-27T05:23:30.379Z"
     },
     {
       "name": "webapp-security",
@@ -1501,7 +1501,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "YhdXy2fMZubdoGemwvt8XCPFaMpcA3uVzGlGH7j+3koPuPl99VqkD1Q2gsJjs894V3CiRSWuRU75q4nIGwUAAQ==",
-      "signed_at": "2026-09-23T16:52:05.508Z",
+      "signed_at": "2026-09-27T05:23:30.380Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1562,7 +1562,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "+x25rPi9K6Yo39Nj9ZN+PV4y0yQ9z9mNmOrBISYLsWrjqVTACCUFI+mp4w/nV6sZueEMoiar+inwE/fucbuiDw==",
-      "signed_at": "2026-09-23T16:52:05.508Z"
+      "signed_at": "2026-09-27T05:23:30.380Z"
     },
     {
       "name": "sector-healthcare",
@@ -1630,7 +1630,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "XMI/ZJn07vHRmN+zRCbYh+JH0bUaRL0KpthMVfRXGz3ELqQqeLG7eUrrnBWnJ5GhsWTuYY/dGCyDdsVyBKtNDA==",
-      "signed_at": "2026-09-23T16:52:05.509Z"
+      "signed_at": "2026-09-27T05:23:30.380Z"
     },
     {
       "name": "sector-financial",
@@ -1719,7 +1719,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "gFUmQCkAfdW++Mb+UcwHTATJcZuszFA3dQSD+v3asEdYYsSFt63L03p09Y3JWN0c4JS4jAC1x08WsgYSklSCBQ==",
-      "signed_at": "2026-09-23T16:52:05.509Z"
+      "signed_at": "2026-09-27T05:23:30.381Z"
     },
     {
       "name": "sector-federal-government",
@@ -1796,7 +1796,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "eFY8sPJCCqYTLGKx+1Spc8UhXNF5Lg3PxN11++lGHBEtPJf/HWeLtrrw2CZSabeqZxdrSLEjuiJxkFo9r+VkAg==",
-      "signed_at": "2026-09-23T16:52:05.510Z"
+      "signed_at": "2026-09-27T05:23:30.381Z"
     },
     {
       "name": "sector-energy",
@@ -1870,7 +1870,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "tpbR4Azrmbh9YSByEBqsb40/c6e17bKw6RDYzdW1P1gK31g+It5wOCgVvoacCv4F5SjQWIQnlrm1QWTMYYJWAA==",
-      "signed_at": "2026-09-23T16:52:05.510Z"
+      "signed_at": "2026-09-27T05:23:30.381Z"
     },
     {
       "name": "sector-telecom",
@@ -1956,7 +1956,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "G7WrqBaR/Nqf4zhYdS69gBsunZJolx0saEAAd6Y+3ev8iN7mDiB5H0W+ow+YZjD74hhsJr4ks3RD/yKulavXCQ==",
-      "signed_at": "2026-09-23T16:52:05.510Z"
+      "signed_at": "2026-09-27T05:23:30.382Z"
     },
     {
       "name": "api-security",
@@ -2035,7 +2035,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "y6LfKfsHtpPT+UBrfkXVR4xO139xvzrWOGTdyeEAna1kecWDJIqKKMdSpHqR4T7KG2HCAmgLCV2cmf3B3jnkAg==",
-      "signed_at": "2026-09-23T16:52:05.511Z",
+      "signed_at": "2026-09-27T05:23:30.382Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -2131,7 +2131,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "f7b0+D4TJwd9c9ISGMFquvePueywoO92QZ172etyayBcDwYVTIiGYII67+NyaLl2+u0QG49d4QY41UPbRflrDw==",
-      "signed_at": "2026-09-23T16:52:05.511Z"
+      "signed_at": "2026-09-27T05:23:30.383Z"
     },
     {
       "name": "container-runtime-security",
@@ -2203,7 +2203,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "mN0q+CDc2WyUjgOzFwUBZBo3SbaOAvWn4CVBjLAYfWYDxm5em+vil0a5dlUWLXxviDNkeQpG0kaAv9dstqPWDg==",
-      "signed_at": "2026-09-23T16:52:05.512Z",
+      "signed_at": "2026-09-27T05:23:30.383Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2284,7 +2284,7 @@
         "MITRE ATLAS release 2026.06 (June 2026) added AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie) and AML.T0114 (AI Service Web Interface) to release 2026.05 and removed no technique ids. Earlier releases shipped the AML.T0010 sub-technique expansion and the agentic-AI techniques this forecast tracked (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"). Forward watch: subsequent monthly ATLAS releases, for updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "+DWL+I6VipjzZpvjZptUNk7jrCYhOBQqFy1ejThc4Gdr2BJ5vWYuRWclUUd4RhC58iv4S3NAgatuZOcXTOkRCg==",
-      "signed_at": "2026-09-23T16:52:05.513Z"
+      "signed_at": "2026-09-27T05:23:30.383Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2359,7 +2359,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "GXEqUic3Dg65QODe/2+AA5PJ2gkRLf39/AbFaZDt19GzknfhHlBxQf7LrpDX2S87JKPHzHPShRAFRxJSW90LAA==",
-      "signed_at": "2026-09-23T16:52:05.513Z"
+      "signed_at": "2026-09-27T05:23:30.384Z"
     },
     {
       "name": "ransomware-response",
@@ -2439,7 +2439,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "ULB2eBGPwh5vgOTK9m9i7Do25p48npVDpyDqjRYOfUUHoYvXkG+XxF0DdJLrs27ngQ2TyETn6X9xKp4310RGBA==",
-      "signed_at": "2026-09-23T16:52:05.514Z"
+      "signed_at": "2026-09-27T05:23:30.384Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2507,7 +2507,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-09-23T16:52:05.514Z"
+      "signed_at": "2026-09-27T05:23:30.384Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2582,7 +2582,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "rlHzyruu9OhkcVrYfHnMJvQf9z3rnDh5VbDQr4qCmqFXTzPqyQz9u1GvKdNiElSNXv3Qv3afvUFsvcHxOxX4DQ==",
-      "signed_at": "2026-09-23T16:52:05.515Z"
+      "signed_at": "2026-09-27T05:23:30.385Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2662,7 +2662,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "jIHvISo1VRnvLRMktdJtEIpb/jKEu5yk23WrzoZCIdhtzGdcXL10vVfycxVM6U/tHg+u/5ju/x8wreQRnYHQBQ==",
-      "signed_at": "2026-09-23T16:52:05.515Z",
+      "signed_at": "2026-09-27T05:23:30.385Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2756,7 +2756,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "gbYSLSe+VfZy3fwKkKIIDa4ipF7lbcKTWMyEAmvdGoO4TgQKWZf5/1mAxOSj0kqkXc16ai09NsSc70NOP05RBA==",
-      "signed_at": "2026-09-23T16:52:05.515Z",
+      "signed_at": "2026-09-27T05:23:30.385Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2828,7 +2828,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-09-23T16:52:05.516Z"
+      "signed_at": "2026-09-27T05:23:30.386Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2887,7 +2887,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-09-23T16:52:05.516Z"
+      "signed_at": "2026-09-27T05:23:30.386Z"
     },
     {
       "name": "network-trust",
@@ -2943,7 +2943,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-09-23T16:52:05.516Z"
+      "signed_at": "2026-09-27T05:23:30.386Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2998,7 +2998,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "T7sFREX7P2QYrau+eTNXKkrU2aJ91dsX6GQWVJeexJ9SqbyFHtAnIKo4r6F6VdELADyVjaRXKk/fLuyUaCkGBA==",
-      "signed_at": "2026-09-23T16:52:05.516Z"
+      "signed_at": "2026-09-27T05:23:30.386Z"
     },
     {
       "name": "self-update-integrity",
@@ -3052,7 +3052,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "OKVmNgVoGGDS8kwezWrtFk62xgYkU3B7lhGRd7xO7wfSQPbETk+aeLmkpoS8sTryzrAg7JYhJ0qDofbSQpOTCg==",
-      "signed_at": "2026-09-23T16:52:05.516Z"
+      "signed_at": "2026-09-27T05:23:30.386Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -3110,7 +3110,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "MWDxwIfhUvGAet5F1LBJnBApTBHafuW+NwysdaSYh8DmPM70bcg6v7f7qwv+zADXYc1LHdF4FoqiAcFy8TA7DA==",
-      "signed_at": "2026-09-23T16:52:05.517Z"
+      "signed_at": "2026-09-27T05:23:30.387Z"
     },
     {
       "name": "decompression-dos",
@@ -3168,7 +3168,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "iDsEYQo/OWYUI8TbBNsS9A60Kt5XEcZ1WYKg52wuSAzgctn4W68dgMeaoNbPXq2Bon1amFKIH5uxUtU8q7I/Dw==",
-      "signed_at": "2026-09-23T16:52:05.517Z"
+      "signed_at": "2026-09-27T05:23:30.387Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -3223,7 +3223,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "1Qn1LUzL2qCvG+jEaif7uMVL/cDwyMVueZAhu5uSroQzfw1V5X2vm/t69fExGKoLnVdkfta71aZWI4Gz0tfiDQ==",
-      "signed_at": "2026-09-23T16:52:05.517Z"
+      "signed_at": "2026-09-27T05:23:30.387Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3278,11 +3278,11 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "UIzZfFwZP/7Gg5IdwQQTv6oDZyzjID8lXWYL1SgiSu4JRPJYzt/vqQO1ztfEaaRdbZBi0Vao3td2aFixnhw6AQ==",
-      "signed_at": "2026-09-23T16:52:05.517Z"
+      "signed_at": "2026-09-27T05:23:30.387Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "A73XbsvpC/7XnjYyebnaspv5xP+BdANBOIGjtC6h9dPCOl5TbAI0wH3/Qg2CmunCBDq1xLOUD7XHPhBBdwBWCg=="
+    "signature_base64": "kkPvnCSHHCopk/uB/UDEv2mfILZG6o59FIw8KywrEocW1yK9da4G/JpvouxJ/rBs6uvRvLNiIIE0hoNUXfgNDQ=="
   }
 }