A Daily Field Report on Things That Are Probably Fine
No. 22·Monday 19 October 2026·Published 06:00 UK·Fine Meter 3/5: Not especially fine
Lead · Supply chain
One credential, 173 tenants: ConnectWise pulls the plug on Cloud Backup
ConnectWise has shut down customer access to its Cloud Backup service, formerly SkyKick, and disabled seven application identities after a compromised Microsoft 365 credential was used to sign in to 173 customer tenants.
confidence0.85
This is not a story about 173 breaches. It is a story about one trust relationship, replayed 173 times, at machine speed, by somebody who did not have to break into anything after the first door. Researchers describe an active campaign abusing a compromised M365 credential belonging to ConnectWise Cloud Backup to reach customers' environments; ConnectWise said on Saturday it had disabled seven ConnectWise application identities while it investigates, and has cut customer access to the service entirely.
Three independent feeds carried it inside nine hours, which tells you the facts are solid and tells you nothing at all about whether your tenant was one of the 173. The honest position for most defenders this morning is that you do not know, and the only way to find out is to go and read sign-in logs for service principals rather than for people, which is the part of Entra nobody has ever been given time to learn.
The reframe worth taking into your stand-up: the backup product is not a backup product, it is a standing, privileged, invisible administrator at every customer site, and it was procured on the strength of a datasheet that used the word seamless. Seamless is correct. That is exactly what happened. There were no seams.
Why it mattersIf you use ConnectWise Cloud Backup or SkyKick, treat the service principal as compromised and go through M365 sign-in and mailbox audit logs for non-interactive app activity, not user logins.
A credential that works in 173 organisations is not a credential. It is a weather system, and you do not patch weather.
— Sturgeon’s Revelations · Probably Fine Daily No. 22
Every morning06:00 UK
Get it in your inbox. Every morning. Probably.
One email a day. The whole paper. Unsubscribe in one click.
§2
Top stories
The rest of the last 24 hours, with receipts.
Vulnerabilities
The web application firewall is now the foothold
Attackers are actively exploiting an OS command injection flaw in SiteGuard Server Edition that lets them run commands as root or SYSTEM on affected servers, which is the entire operating system, handed over by the product bought to prevent exactly that. Drupal has separately patched two critical remote code execution flaws affecting every supported version and warned that exploits may follow quickly. JetBrains has three TeamCity CVEs — CVE-2026-111094 at 8.1, an authenticated RCE via a build messages whitelist bypass, plus stored XSS at 8.0 and 6.7 — with on-premises fixes in 2026.2, 2026.1.4 and 2025.11.8, no public proof of concept and no active exploitation reported.
Why it mattersPatch order this morning: SiteGuard first because it is being exploited now, Drupal second because the window is short, TeamCity third because it is a build server and build servers sign things.
N0n posted 29 times on Saturday, and the worst of it belongs to other people's clients
N0n went from effectively nothing to 29 leak-site items in a day, and the pattern is third-party: SQA Services, described as a Wolters Kluwer/CCH Axcess test lab, listed with VPN access credentials for all 64 employee accounts and domain controller configuration including group policies, DNS zones and network maps; All Business Technologies, a Massachusetts bookkeeping and tax practice, listed with live accounting files for more than 60 client companies and backups from 2014 through 2026. ECO USA was posted with 217,186 production and check records and 33 company and partner accounts with plaintext passwords, Solid Trading B.V. with client order and execution data, and SMIC US and Telecom Egypt both marked NOT PAID — EXPOSED. Four victims sat on the site as Company #88 to #91 from early morning until they were named at 15:26. Atlas rates N0n's US run as escalating at 0.82.
Why it mattersIf your accountant, your QA lab or your outsourced bookkeeper is on that list, your data is in the leak even though your name is not.
Helix has discovered the countdown clock, and it ticks in GoFile
Helix listed four large US organisations inside roughly four hours on Saturday night — Smith Douglas Homes, Bay Alarm, Personify Health and, later, Quikrete — each with GoFile links and passwords advertised as unlocking in 12 hours, then 6, before adding Southwire with a stated yearly revenue of around $9 billion. The listings quote revenue figures the way a sales deck quotes addressable market: Smith Douglas Homes at around $971 million, Personify Health around $500 million, Bay Alarm around $256 million. Atlas scores Helix as escalating in US manufacturing, with the velocity-weighted country run at 0.82, though the signal trailed the raw listings by about 18.5 hours.
Why it mattersTimed public unlocks compress victim decision-making deliberately; if you are in US manufacturing, assume your incident clock is set by the attacker's web page, not your retainer.
Qilin posted 37 times in a day, and a brand called Storm turned up with three victims in an hour
Qilin's leak-site volume on 18 October hit 37 items against a median of one on other days, with Mastelli S.r.l., Pergande, Pengurusan Aset Air Berhad, BRUTRA Logistek, Llano Independent School District and Belcorp among the names; the two trackers disagree about Mastelli's sector, one calling it Manufacturing and the other Healthcare Services, which is the kind of detail that ends up in a board slide as fact. Separately, a group calling itself Storm appeared with Patriot Maritime, Merit Financial Group and Baltimore Tank Lines, first spotted on Mastodon and confirmed on ransomlook about 1.1 hours later — maritime, wealth management and fuel haulage, inside about an hour. Treat the Qilin burst with care: Atlas led the raw listings by roughly 39 to 53 hours here, the wrong direction, which usually means batch ingestion rather than a sudden surge of competence.
Why it mattersVictim counts you read on a Monday are a scraper's view of a weekend, not a measurement of attacker tempo; use the named victims, not the totals.
Vidar's C2 estate is all numbers and short domains, and it is huntable
ThreatFox's last day of Vidar indicators clusters hard on numeric-prefixed domains with short paths: k3.9nawin.org, tp.988boss.org, then k9n/tx/xs/cva on 9wing.org, l.9kio.org, j7.88idr.org and f.88qr.org and n.88qr.org. The same indicators appear with and without a trailing slash, which is what bulk automated submission from one panel looks like. Background volume continues underneath: 209 new Mozi indicators and 208 new Mirai indicators in the window, plus ClearFake, AMOS and ValleyRAT infrastructure.
Why it mattersA regex over DNS logs for short numeric-prefixed hosts with two-character URI paths will cost you ten minutes and may be the cheapest Vidar detection you write this quarter.
confidence0.60
AI & security
US security job postings fall 26% while everyone hires for the thing that is leaking
CyberSN's jobs report has US cybersecurity postings down 26% while demand for AI Security Engineers soars, which is not a shortage story and not a glut story but a reallocation story told with a straight face.
Why it mattersYour AI tooling is now a credential-bearing desktop application in your developers' hands; scope it in your asset inventory before you scope it in your strategy deck.
A bug old enough to remember rotary phones gets you root on OpenBSD 7.9
A local privilege escalation exploit published this weekend gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow in shared memory with a separate kernel flaw, bypassing KARL kernel-address randomisation along with SMAP and SMEP hardware protections. Security firm Calif found and reported it. Mitigations stacked over three decades were walked past by a bug that predates all of them.
Why it mattersLocal privesc on your most hardened boxes is exactly the chain that turns a contained web shell into an estate-wide incident.
A $75 wristband that turns the people near you into content
Amazon's Bee, reported this weekend, is a $75 wristband that turns conversations into notes and, with a paid opt-in, into shopping suggestions. The wearer opts in. The bystanders supply the dialogue and have no opt-out. As the person who flagged it put it, a tidy little supply chain.
Why it mattersEvery meeting room in your estate is now potentially a recorded environment with no processor agreement and no data subject who knows they are one.
The daily deep read: what is under the feeds, not on top of them.
Under the feeds: one credential doing the work of 173, a leak-site weekend that is partly real and partly a scraper catching its breath, and two sources that went silent on Sunday morning.
Exception 01
The ConnectWise event is an MSP trust abuse, not 173 intrusions
Three independent feeds corroborate one compromised multi-tenant application secret signing into many customer tenants, with seven ConnectWise application identities disabled. The blast radius is customers' M365 data, and the access pattern is the vendor's own legitimate integration.
confidence0.80
Wrong if
ConnectWise reports that the 173 figure was overstated, or that the sign-ins were limited to contracted vendor access with no customer data touched.
Watch
ConnectWise or Microsoft follow-ups and customer notices over the next 1-3 days; whether other MSP multi-tenant apps are named.
N0n's Saturday is mostly downstream tax and accounting exposure
N0n went from near zero to 29 items in a day, and the two most consequential listings are service providers: a CCH Axcess test lab and a bookkeeping practice holding live accounting files for 60-plus client companies. The named victims are not the full victim list.
confidence0.65
Wrong if
Evidence the 29 items are a single scraper backfill of postings originally dated over several weeks.
Watch
Whether N0n keeps posting on 19-20 October, and whether Wolters Kluwer or CCH say anything about the test lab.
Exception 03
The Qilin burst may be ingestion, not tempo
37 Qilin items on 18 October against a median of one, with Atlas leading the raw leak-site listings by about 39 to 53 hours — the opposite of the usual direction, which points at backdating or batch scraping rather than a genuine surge.
confidence0.50Speculative
Wrong if
Leak-site timestamps show the victim posts were genuinely published across 18 October rather than ingested in one batch.
Watch
Whether Qilin volume stays elevated on 19-20 October and whether the Manufacturing story gains new corroborating victims.
Both feeds have nothing after 2026-10-18T00:04, and the NVD set is largely one batch stamped 16 October, so any CVE or OTX activity from the 18th and 19th is invisible in this read. Most likely batch-ingest behaviour, not a real drop in reporting.
confidence0.60
Wrong if
Direct checks of NVD and OTX show continuous publication across 18-19 October that this pipeline failed to collect.
Watch
Whether the next ingest restores both; if not, the collectors, not the world, are broken.
Nothing to seeThe Chrome extension badness-score burst, the Atlas 'compound crisis converging on one country' stories at 0.43 to 0.51 confidence, the weekend WordPress advisory batch with no exploitation evidence, and a large and heartfelt fediverse thread about a 1970s horror film. None of it showed cross-source structure, and one of it was about an organ that is also a lift.
Deep read: 483 items read
§4
Forecast
Dated, falsifiable calls. We mark our own homework in public.
Today’s calls
DueCallConfidence
DueMon 26 Oct7d
ConnectWise or Microsoft publishes a further public update on the Cloud Backup / SkyKick incident — revised tenant numbers, scope of data access, or customer guidance — by 26 October.
Wrong ifNo new ConnectWise or Microsoft statement on this incident appears in these feeds by end of 26 October.
No official T-Mobile breach notification or verified data sample corroborating BYOD's claim appears in these feeds.
Called Fri 9 Oct · due Fri 16 Oct
Past due. No T-Mobile statement, filing or verified sample appears in any of today's items.
open
None of KFC, MoneyGram, Confluent, BigID or Placer AI publicly confirms a breach in these feeds by 18 October.
Called Tue 13 Oct · due Sun 18 Oct
Due 18 Oct passed. No confirmation from KFC, MoneyGram, Confluent, BigID or Placer AI appears in any item.
right
Qilin will not sustain yesterday's volume: at least one day between 17 and 21 October will show fewer than ten Qilin leak-site items on ransomware.live.
Called Fri 16 Oct · due Wed 21 Oct
On 18 Oct, ransomware.live shows only 5 Qilin claims (Mastelli, Pergande, Pengurusan, BRUTRA, Llano). On 17 Oct it shows 1. Both are under ten, though the feed may be a sample.
N0n posts at least one further numbered anonymised victim above #88 on its leak site.
Called Sun 18 Oct · due Fri 23 Oct
N0n posted Company #89 and #90 (5:52–5:53 UTC) and #91 (8:54 UTC) on 18 Oct. ransomlook shows the same listings.
Glossary of terms you will be expected to nod at
Multi-tenant application(n.)
One secret that works at all of your customers at once, sold to you as an integration, described in the incident notice as seven application identities, and disabled on a Saturday.
§5
From our edge
Live attacks on our own servers in the last 24 hours. Yes, really ours.
Our own edge profiled 53 hostile sources in 24 hours — 42 scanners, 9 bot crawlers, 2 targeted operators — sending 6,394 requests between them, of which 7 went past reconnaissance into actual exploitation attempts, across 4,919 addresses from 92 countries with 1,040 seen for the first time today. The item that should interest you: 34.53.212.113 worked through /.env-example, /.aws/config and /.env.aws and then asked for /.env.anthropic, which means model API keys are now on the standard shopping list next to cloud keys. Elsewhere, 35.240.58.49 fired 118 requests in about 0.4 seconds looking for Laravel and Docker .env files, eleven addresses shared one behavioural fingerprint (DNA dfef4501b216) while rotating hosts, 20.196.193.222 sent 470 requests at a steady one a minute hunting a WordPress HelloPress file manager, and two addresses were still spraying CVE-2017-9841 at us, which tells you what the internet actually believes about patching. The highest hostility on the board, 7.7 out of 10, was 84.17.60.236, which sent just 20 requests, reached credential-access, and was looking for xmlrpc.php. Raw logs never left the server. Only the findings did.
53hostile sources profiled
6,394requests from them
7reached exploitation
6shared-DNA clusters
7.7/10top hostility
4,919addresses at our edge
1,040first seen today
92countries
The WTF list
WTF #1
Looking for your AI keys
34.53.212.113, a scanner (hostility 5.7/10), sent 234 requests to 2 of our sites, probing for /.env-example, /.aws/config, /.env.aws, /.aws/.env.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: custom credential-harvesting scanner (sensor's best match, 45%)Sun 18 Oct, 05:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA 9427f6c77bf1
WTF #2
The most determined visitor
84.17.60.236, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
2 addresses sent 16 requests shaped like CVE-2017-9841 exploitation (/vendor/phpunit/phpunit/…), including 170.64.211.230, 94.26.0.103.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
probe family: phpunit-rce
WTF #4
Same DNA, different addresses
34.131.254.38, a scanner (hostility 6.3/10), sent 277 requests to one of our sites, probing for /.git/config, /.env, /.env.local, /.env.production.
Why it’s weird11 IPs share one behavioural fingerprint (DNA dfef4501b216): one tool or one operator rotating addresses: 20.194.96.223, 20.207.202.183, 74.225.146.100, 2001:41d0:601:2000::166e, 20.214.147.109 and more.
attribution: unknownSun 18 Oct, 20:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA dfef4501b216
WTF #5
The strangest shopping list
20.196.193.222, a scanner (hostility 6.5/10), sent 470 requests at 1 a minute to 3 of our sites, probing for /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /3PJcpMFsD8B.php, /sm.php.
Why it’s weirdAsked for files almost nobody else asks for: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /3PJcpMFsD8B.php, /sm.php, /ebkid.php.
attribution: WordPress HelloPress File Manager RCE scanner (sensor's best match, 55%)Sun 18 Oct, 05:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA 8e306493632a
WTF #6
In a hurry
35.240.58.49, a scanner (hostility 5.5/10), sent 118 requests to one of our sites, probing for /.aws/.env, /.env, /.docker/.env, /.docker/laravel/app/.env.
Why it’s weirdFired 118 requests in about 0.4 seconds.
attribution: Automated Credential/Secrets Harvester (sensor's best match, 55%)Sun 18 Oct, 05:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
One email a day. The whole paper. Unsubscribe in one click.
§7
Colophon
How this edition was made, plainly.
Edition 22 was made by machine and checked by code. Every item published by 12 public threat feeds in the 24 hours to 05:05 UK (483 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.74. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.
483items read
24hour window
$0.74cost of this edition
04:05 UTCgenerated
Sources this morning
ThreatFox150ok
NVD100ok
infosec.exchange77ok
Signal Atlas56ok
ransomware.live26ok
RansomLook26ok
atlas20ok
Security news10ok
signal:ioc-family6ok
signal:actor6ok
RSS3ok
AlienVault OTX3ok
ITEMS READ: 483|SOURCES: 12|STORIES DROPPED FOR LACK OF RECEIPTS: 0|COST: $0.74|STATUS: NOT ESPECIALLY FINE
OWNER: the machine|EDITOR: the rules|CALLS OPEN: 3|NEXT REVIEW: tomorrow 06:00 UK