Lead · Vulnerabilities

Both ends of the remote-support cable went bad on the same day

ConnectWise disabled five ScreenConnect extensions after rogue clients reached 288 endpoints at 48 organisations, and inside about a day N-able pulled hosted N-central offline over more than 30 publicly dropped zero-days.

confidence 0.88

Here is the shape of it. ConnectWise is investigating an active campaign in which compromised ScreenConnect environments were used to push rogue remote-access clients down to customer devices, delivering something Huntress is calling SCKit; the count so far is at least 288 endpoints across 48 organisations, and ConnectWise has disabled five third-party extensions in partner environments while saying there is no evidence its own infrastructure was compromised. Separately, and roughly a day either side of it, N-able took hosted N-central environments offline and shipped hotfixes after a researcher published zero-days over the weekend — more than thirty of them, thirty-three by Dark Reading's count, good for remote code execution, credential theft and the creation of administrator accounts.

The mechanisms are not the same. One is abuse of an extension model that was working exactly as designed; the other is a pile of vulnerabilities that were not. So I am not going to tell you it is one coordinated wave, because I cannot see that from here. What I will tell you is that both products exist for the same reason, which is that somebody somewhere needs to reach into a thousand machines they have never physically touched, and that is a capability, not a product category. The capability is the target. It always was.

There is a version of this incident in which it is nobody's fault: supported software, legitimate tooling, a supplier relationship that is contractual and insured and has a logo on the website. That version is the ontologically inconvenient one, because it means there was no moment of negligence to point at in the timeline. You bought the ability to run commands on everything. Someone else is now exercising it.

Why it mattersIf you have an MSP, your blast radius today is their session history: hunt for unexpected ScreenConnect clients and extensions, and treat any N-central box that was internet-facing over the weekend as owned until proven otherwise.

Receipts

Today’s revelation

Remote management is a door you fit on your own behalf, into your own wall, and then hand the key to a supply chain whose hiring policy you have never read.

— Sturgeon’s Revelations · Probably Fine Daily No. 46

§2

Top stories

The rest of the last 24 hours, with receipts.

Vulnerabilities

CISA adds Cisco BroadWorks and an Openwave transcoder to KEV, both already patched

CISA added two flaws to the Known Exploited Vulnerabilities catalogue on Tuesday: CVE-2026-20320 in Cisco BroadWorks, an improper restriction of XML external entity reference with a CVSS of 7.5, and CVE-2026-111793 in Openwave Messaging Webtop Media Transcoder, both being used to leak sensitive information including configuration data. Patches exist for both. Alongside them, the Outlook flaw CVE-2026-124194 is listed by CISA as exploited, added on 10 November, CVSS 6.5, reachable over a network, no login required, and happy to hand over NTLMv2 authentication hashes to an attacker-controlled destination if somebody opens the file.

Why it mattersThree exploited items with vendor fixes available: BroadWorks and the Openwave transcoder are the unglamorous telco plumbing nobody owns, and Outlook is owned by everyone, which is worse.

confidence 0.92

Receipts

Vulnerabilities

Patch Tuesday was 1,235, or 1,259, or 1,260, or 1,093, depending who counted

Microsoft's November release was reported as 1,235 flaws by BleepingComputer, 1,259 by The Hacker News, 1,260 by the SANS Internet Storm Center and 1,093 or 'nearly 1,100' by SecurityWeek, Cyberscoop and Krebs; the critical count lands at 68 per SANS and 63 per Krebs, and SANS notes 167 of the total are Chromium issues in Edge. SAP was patched as 35 vulnerabilities per BleepingComputer and 42 advisories with nine critical per SecurityWeek, with everyone agreeing on the four CVSS 10.0 flaws in NetWeaver and Web Dispatcher. Then Adobe did 110 across nine products, Fortinet did nearly 100 after integrating frontier AI models into its product security testing, and Zoom shipped a fix for CVE-2026-108186 at CVSS 9.6, unauthenticated privilege escalation over the network. The discrepancies are counting methods, not conspiracy.

Why it mattersThe number on the slide is not a risk signal; the four CVSS 10.0 SAP flaws and the one exploited Outlook bug are, and they are the same size this month as they were last month.

confidence 0.85

Receipts

AI & security

An agentic pentest tool read a web.config and went shopping in AWS

ARTEX, an AI-native penetration framework, was observed in October attacking AWS environments and going for financial data; its fork AntiFox is now being self-hosted on Alibaba Cloud and used against web services and AWS, with Arctic Wolf reporting IIS web shells, abuse of valid AWS credentials and successful Secrets Manager requests. One described intrusion is almost tediously procedural: hit an IIS server, parse web.config, take the AWS credentials inside, call 18 services in 30 minutes, collect AccessDenied on nearly all of them and GetSecretValue on one production secret. Dark Reading counts 45 similar pen-testing tools still capable of credential attacks and cloud breaches at machine speed. There is no CVE here and there is nothing to patch.

Why it mattersThe denial wall is not a repelled attack, it is a free enumeration of your permission boundary at speed, so least-privilege IAM and alerting on bulk AccessDenied bursts are the control, not the inbox.

confidence 0.82

Receipts

AI & security

Four AI and cloud providers lost other people's secrets in the same window

A threat actor used IAM credentials from Qubole's AWS account to assume integration roles inside customer environments between 14 and 26 October, hitting over a dozen organisations and taking files, secrets, keys and environment variables. Fireworks AI widened its October incident to cover account and billing data, secrets, datasets and incomplete models for a limited set of accounts, which is how Notion came to disclose exposed AI chat transcripts in fewer than 1% of its workspaces. Railway says stolen customer authentication secrets produced roughly $740,000 of fraudulent AI usage with up to 100,000 workspaces potentially affected, and has said it will pay the charges where a provider will not refund them; OpenRouter has declined. NEAR AI, meanwhile, lost code execution on an inference server to an SGLang RCE, affecting data from 18 agents and about 100 user accounts.

Why it mattersYour model API keys now have the blast radius of cloud root credentials and none of the rotation discipline, because nobody built a key lifecycle for a thing that was a hackathon six months ago.

confidence 0.86

Receipts

Ransomware

N0n is posting at three times its own rate, and two crews emptied their drafts folder

Ninja Signal's tempo read for today counts 291 leak-site claims in seven days from 49 of the 277 groups tracked, with N0n at 94 claims against 28.0 expected from its own prior rate, and interlock at 12 against 1.25, both at p below 0.001. Underneath that, two burst publishers dominated the window: the gentlemen posted roughly two dozen victims including Esri South Africa, United Pharmacy and Kuwait's National Investments Company, and Curious Worm posted a tranche of US healthcare and professional services domains that ransomware.live carried about 2.1 to 2.2 hours before ransomlook did. Separately, Krebs puts Qilin at at least 365 victim organisations claimed in the past three months.

Why it mattersLeak-site volume is a publishing cadence, not an attack cadence; the signal worth acting on is which group is genuinely surging, and today that is N0n and interlock.

confidence 0.80

Receipts

Ransomware

The people you would ring about this are not answering, and Maersk is dealing with a legacy box

NBC News reports some top US cyber security firms are turning away new customers seeking emergency help, with Sophos saying other DFIR firms have asked it for overflow support when their teams hit capacity; practitioners in the field describe conditions as horrible right now and say that if you have no plan and no retainer, help is unlikely. One responder's read is that a lot of it is AI-assisted but the initial entry is definitely not sophisticated — it is everyone's dirty laundry airing at once, and security by obscurity dying. Against that backdrop Maersk has confirmed a threat actor reached a local legacy system inherited through an earlier acquisition and extracted data from it, with WhiteArmor demanding $5 million.

Why it mattersRetainers are a control now, not a procurement nicety: the market signal is that surge capacity is finite and you cannot buy it at 2am on the day.

confidence 0.75

Receipts

Threat actors

Exploited in the wild without a CVE: a cookie that parses to nothing takes over Xen Orchestra

Vates VMS warns that a critical authentication bypass in Xen Orchestra, tracked as VSA-2026-062 with no CVE identifier yet, is being actively exploited: REST cookie parsing turns authenticationToken=j:%7B%7D into an empty object, REST authentication accepts that, and the attacker gets admin and root-level takeover of XCP-ng hosts. Barracuda says attackers have begun exploiting two recently patched Email Security Gateway flaws to run commands as root. Google shipped emergency updates for the eighth Chrome zero-day exploited in attacks this year.

Why it mattersTwo of these three sit in front of your virtualisation and your mail, which between them are most of what a ransomware crew wants before breakfast.

confidence 0.88

Receipts

Oddities

35,578 Grok-built apps open to anyone, and a backdoor you can fit in ten neurons

Claroc says it found 37,571 Grok-built apps online, of which 35,578 required no sign-in at all, some leaking confidential data and passwords, and 24 of them were built by staff at X and at SpaceXSI. Elsewhere, a command in Claude Code has been saving files containing credentials into public Git repositories at scale. And Microsoft researchers have shown an AI model can be given a hidden backdoor by editing fewer than ten of its rarely used neurons, no retraining required, so that a chosen trigger makes the model emit an attacker's command, which an agent would then run with the agent's permissions.

Why it mattersTwo of these are secrets in the wrong directory, which we know how to fix; the third is a supply chain where the artefact has no diff you can read.

confidence 0.80

Receipts

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

Most of today's volume is two leak sites emptying a queue; the structure worth reading is two RMM platforms and a pile of stolen AI credentials arriving in the same window.

Exception 01
Two RMM platforms, one day, two different mechanisms
ConnectWise disabled five ScreenConnect extensions after rogue clients reached 288 endpoints across 48 organisations, and N-able took hosted N-central offline over 30-plus published zero-days, within about a day of each other. Both are MSP-trust tooling, so this could be one wave against MSPs; it could equally be coincidence, because extension abuse and vulnerability disclosure are not the same thing.
confidence 0.40Speculative
Wrong if
Huntress or ConnectWise attribute the ScreenConnect abuse to actors unrelated to the N-central disclosure, or the N-central bugs prove to be coordinated research rather than attack-driven.
Watch
Follow-up on affected MSP customers and any ransomware claim citing MSP access in the next one to three days.
Receipts
Exception 02
Agentic offensive tooling has left the lab
ARTEX and its fork AntiFox appear across four source types in this window, with OTX leading the news coverage on ARTEX by about ten hours, and the observed activity is consistently cloud credential theft rather than demonstration.
confidence 0.55
Wrong if
Arctic Wolf's findings turn out to rest on a single incident with no wider distribution of the tooling.
Watch
New AntiFox forks, further Alibaba Cloud-sourced scanning, and more AWS Secrets Manager abuse reports.
Receipts
Exception 03
Leak-site bursts are a scraper artefact, not an attack wave
The gentlemen posted about 25 victims in roughly two hours and Curious Worm about 10 in seven minutes, with ransomware.live leading ransomlook by a near-constant 2.1 to 2.2 hours across nine Curious Worm domains. That regularity is a polling interval, not attacker timing.
confidence 0.60
Wrong if
Posting times on the leak sites themselves show a cadence different from what the tracker lag implies.
Watch
Whether the gentlemen's pending victims verify, and whether Curious Worm repeats a batch.
Receipts
Exception 04
A DFIR capacity crunch with no named incident behind it
Firms turning away emergency work, Sophos absorbing overflow, and responders calling the initial access unsophisticated together hint at heavy unreported activity. Three items support this and no single incident is named, so treat it as weak.
confidence 0.25Speculative
Wrong if
Other DFIR vendors report normal capacity, or the comments trace back to one firm's staffing problem.
Watch
Large disclosures or SEC 8-Ks in the next week.
Receipts

Nothing to seeThe Atlas compound-crisis stories, the hashtag bursts and the big hourly clusters are social-media posting volume and the Curious Worm batch, not coordinated attacker activity. ThreatFox's Unknown Loader, Mozi and Remcos uploads are routine bulk. The darknet breach claims (2.7 billion SSNs, the Toyota and Japan items) are unverified and weakly linked, and the WordPress plugin flood in NVD is real but spread across dozens of unrelated products.

Deep read: 763 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueThu 19 Nov7d
At least one ransomware or extortion leak-site claim published between now and 19 November will name an MSP or its downstream customers in connection with ScreenConnect or N-central access.
Wrong ifNo leak-site post or vendor advisory in that window ties a named victim to either platform.
Receipts
f-2026-11-12-1
Confidence0.35
DueTue 24 Nov12d
The Xen Orchestra authentication bypass currently tracked only as VSA-2026-062 will be assigned a CVE identifier, appear in CISA KEV, or both, by 24 November.
Wrong ifBy 24 November the flaw still has no CVE identifier and no KEV entry.
Receipts
f-2026-11-12-2
Confidence0.55
DueThu 19 Nov7d
N0n will post at least 20 further leak-site claims to ransomware.live between now and 19 November, continuing the surge flagged in today's tempo read.
Wrong ifFewer than 20 new N0n claims appear on ransomware.live in that window.
Receipts
1. 1Ransomware tempo · Ninja Signal graphNinja Signal ransomware tempo for 2026-11-12. In th…
f-2026-11-12-3
Confidence0.60

Scorecard

1 partly · 1 wrong · 2 open

open
No public vendor or CISA advisory ties the Ivanti Connect Secure exploitation chain to a specific named threat actor or ransomware group by 2026-11-12.
Called Mon 2 Nov · due Thu 12 Nov
No item in today's feed names a threat actor behind CVE-2026-111357 Ivanti chain; Ivanti/CISA advisory items mention other CVEs only.
partly
At least one of Everstake's two scheduled releases (582.69 Gb due 10 November, 473.05 Gb due 12 November) appears on the leak sites, with the victim named, by 13 November 2026.
Called Tue 3 Nov · due Fri 13 Nov
Everstake actor on ransomware.live posted a new claim (ki*****o.com, redacted) on 2026-11-11, but neither the 582.69 Gb nor 473.05 Gb Everstake releases appear as named/published victims; the new entry is still redacted.
open
IHG Hotels & Resorts does not publicly confirm the BYOD intrusion claim.
Called Thu 5 Nov · due Thu 12 Nov
No IHG statement or regulatory filing acknowledging the BYOD intrusion claim appears in today's feed by the 12 November deadline.
wrong
No independent confirmation of the Whitearmor claim against the named shipping line will appear in these feeds; it stays an unverified leak-site listing.
Called Sun 8 Nov · due Fri 13 Nov
Maersk publicly confirmed the breach attributed to WhiteArmor ransomware, with a company statement reported in mainstream outlets.
Receipts

Glossary of terms you will be expected to nod at

Agentic (n.): Permitted to make the same mistakes as a tired junior, at the clock speed of a datacentre, with none of the self-doubt and a valid set of your credentials. See also: 18 API calls in 30 minutes, 17 of them denied, which the vendor describes as containment and the attacker describes as a map.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge, last 24 hours: 56 hostile sources profiled — 30 scanners, 21 bot crawlers, 3 targeted operators, 2 brute forcers — sending 4,287 requests between them, of which 16 went past reconnaissance into actual exploitation attempts, across 6,434 addresses from 106 countries with 1,857 seen for the first time today. Seven groups of addresses shared a behavioural fingerprint, which is the polite way of saying one tool wearing several hats. Top hostility was 7.7 out of 10, awarded jointly to 85.204.70.100 and 129.221.248.33, both asking our login path for WordPress files we do not have and reaching credential-access in the kill chain while doing it. One address sent three requests shaped like CVE-2017-9841 at the phpunit path, which continues to be sprayed at the internet with the patient optimism of a man feeding a parking meter in a field. Raw logs never left the server; only these findings did.

56hostile sources profiled

4,287requests from them

16reached exploitation

7shared-DNA clusters

7.7/10top hostility

6,434addresses at our edge

1,857first seen today

106countries

The WTF list

WTF #1
Looking for your AI keys
34.78.49.147, a scanner (hostility 5.4/10), sent 123 requests to one of our sites, probing for /.env.anthropic, /.env, /.env-sample, /.docker/laravel/app/.env.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownThu 12 Nov, 01:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```
WTF #2
The most determined visitor
85.204.70.100, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
attribution: unknownThu 12 Nov, 01:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation → credential-access · DNA 82a939927b85
```
WTF #3
Trying CVE-2017-9841 on us
1 address sent 3 requests shaped like CVE-2017-9841 exploitation (/vendor/phpunit/phpunit/…), including 2400:6180:10:200::f6a8:4000.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: phpunit-rce
```
WTF #4
Same DNA, different addresses
207.175.85.46, a scanner (hostility 5.1/10), sent 132 requests to one of our sites, probing for /.env, /.aws/.env, /.docker/laravel/app/.env, /.docker/.env.
Why it’s weird11 IPs share one behavioural fingerprint (DNA 18e39c4b41fb): one tool or one operator rotating addresses: 34.62.31.226, 34.78.49.147, 34.22.159.76, 34.22.204.254, 207.175.237.228 and more.
attribution: unknownThu 12 Nov, 01:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```
WTF #5
The strangest shopping list
129.221.248.33, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdAsked for files almost nobody else asks for: /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml, /login/wordpress/wp-incl.
attribution: unknownThu 12 Nov, 01:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation → credential-access · DNA 82a939927b85
```
WTF #6
In a hurry
84.17.60.251, a scanner (hostility 6.1/10), sent 20 requests to one of our sites, probing for //wp-includes/wlwmanifest.xml, //xmlrpc.php, //blog/wp-includes/wlwmanifest.xml, //web/wp-includes/wlwmanifest.xml.
Why it’s weirdFired 20 requests in about 1.4 seconds.
attribution: unknownThu 12 Nov, 01:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA dfef4501b216
```

§6

Tempo

Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.

291claims, 7 days

49of 277 groups active

N0n94 this week · surging

Climax Inc17 this week · new

Vortex14 this week · new

SurgingN0n — 94 claims in 7 days against 28.0 expected from its own prior rate (p < 0.001)
Surginginterlock — 12 claims in 7 days against 1.2 expected from its own prior rate (p < 0.001)
Surgingmetaencryptor — 9 claims in 7 days against 1.1 expected from its own prior rate (p < 0.001)
SurgingBlack X — 3 claims in 7 days against 0.5 expected from its own prior rate (p = 0.014)
SurgingSilentRansomGroup — 8 claims in 7 days against 3.2 expected from its own prior rate (p = 0.016)
SurgingBYOD — 6 claims in 7 days against 2.6 expected from its own prior rate (p = 0.049)

Gone quiet: global (61 days), embargo (64 days), kazu (66 days), DYSPHOR1A (67 days).

Sector pressure, 30 days

UpEducation — 1.4× its own prior share (49 claims, 34 expected)
DownAgriculture and Food Production — 0.5× its own prior share (20 claims, 38 expected)
DownProfessional Services — 0.8× its own prior share (126 claims, 151 expected)

29% of claims carry no sector label.

Brand churn

Of the 239 leak-site brands first seen since 2021-09-30, 75% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 67% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 214 old enough to judge posted on one day and never again; 37% made at least half their claims in their first week. New brands this month: 8 — newest: Curious Worm (2026-11-11, 9 claims), osiris (2026-11-11, 8 claims), Climax Inc (2026-11-10, 17 claims).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Targeting

Over the last 180 days, among brands with at least 20 labelled claims: safepay put 33% of its claims on Germany (6.3× every other brand's share); N0n put 28% of its claims on Transportation (6.2× every other brand's share); SilentRansomGroup put 100% of its claims on Professional Services (6.2× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.

Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.

Posting clock

Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 59% of its claims on Mondays, half of them in 18:00–19:59 UTC; akira posted only 2 of 196 claims at weekends and half its claims in 12:00–13:59 UTC; half of thegentlemen's claims appeared in 06:00–09:59 UTC. Leak sites overall are 34% quieter per weekend day than per weekday.

all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–20:59 UTC.

Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →

§7

Ride-alongs

Free, live tools. No sign-up, no sales call.

§8

Colophon

How this edition was made, plainly.

Edition 46 was made by machine and checked by code. Every item published by 13 public threat feeds in the 24 hours to 05:05 UK (763 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $1.26. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

763items read

24hour window

$1.26cost of this edition

05:05 UTCgenerated

Sources this morning

ThreatFox175ok
Telegram126ok
Security news115ok
NVD100ok
infosec.exchange80ok
Signal Atlas51ok
RansomLook35ok
RSS25ok
ransomware.live24ok
AlienVault OTX15ok
atlas14ok
signal:ioc-family2ok
Ransomware tempo · Ninja Signal graph1ok

Get it in your inbox. Every morning. Probably.

CISA adds Cisco BroadWorks and an Openwave transcoder to KEV, both already patched

Patch Tuesday was 1,235, or 1,259, or 1,260, or 1,093, depending who counted

An agentic pentest tool read a web.config and went shopping in AWS

Four AI and cloud providers lost other people's secrets in the same window

N0n is posting at three times its own rate, and two crews emptied their drafts folder

The people you would ring about this are not answering, and Maersk is dealing with a legacy box

Exploited in the wild without a CVE: a cookie that parses to nothing takes over Xen Orchestra

35,578 Grok-built apps open to anyone, and a backdoor you can fit in ten neurons

Two RMM platforms, one day, two different mechanisms

Agentic offensive tooling has left the lab

Leak-site bursts are a scraper artefact, not an attack wave

A DFIR capacity crunch with no named incident behind it

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

Looking for your AI keys

The most determined visitor

Trying CVE-2017-9841 on us

Same DNA, different addresses

The strangest shopping list

In a hurry

Get it in your inbox. Every morning. Probably.

Sources this morning