A Daily Field Report on Things That Are Probably Fine
No. 15·Monday 12 October 2026·Published 06:00 UK·Fine Meter 3/5: Fine, in the way a smoke alarm with a flat battery is quiet
Lead · Actively exploited
One pulse says Artifactory is being exploited through three chained CVEs. The question this morning is what one pulse is worth
An AlienVault OTX pulse reports attackers chaining CVE-2026-42016, CVE-2026-42018 and CVE-2026-82329 to bypass authentication on JFrog Artifactory. Nothing else in today's feeds backs it up yet, which is not the same as it being wrong.
confidence0.50
The claim is short and specific. The AlienVault pulse, published on Sunday morning, says active exploitation of three critical vulnerabilities in JFrog Artifactory has been identified, with attackers chaining CVE-2026-42016, CVE-2026-42018 and CVE-2026-82329 to bypass authentication. The rest of the sentence is cut off in our feed. So is the rest of the evidence.
It is the only item in the last day that claims in-the-wild exploitation of anything. Today's feeds have no matching KEV entry and no vendor advisory, and NVD, busy on Friday publishing everyone else's batches, has been silent since 23:20 on Saturday. The deep read puts that silence down to our collection window, not NVD having a lie-down. A single source is not a false source. It is a source nobody has joined yet.
Artifactory is where the build pipeline keeps the things it intends to trust. That makes an authentication bypass there a provenance problem, not a perimeter one. If you run it, the work this morning is dull and quick. Find the instance, check how exposed it is, check its version against the vendor's fixes for these three CVEs, and read the access logs for authenticated actions nobody remembers authenticating. Then we watch to see whether the pulse gets a second source.
Why it mattersIf an authentication bypass in your artefact repository is real, everything downstream inherits the attacker's opinion of what counts as a legitimate build.
A bounds check that only runs in the debug build is a promise the developers made to each other. The attacker was never in the room.
— Sturgeon’s Revelations · Probably Fine Daily No. 15
Every morning06:00 UK
Get it in your inbox. Every morning. Probably.
One email a day. The whole paper. Unsubscribe in one click.
§2
Top stories
The rest of the last 24 hours, with receipts.
Ransomware
One weekend, three trackers: ransomware crews claim the Royal Thai Air Force, Winnipeg's Health Sciences Centre and Morocco's CNESTEN
Qilin (11 items), Rhysida (10), incransom (8), thegentlemen (6) and LockBit5 (6) all burst on 11 October against a baseline near zero. thegentlemen listed the Royal Thai Air Force. incransom listed the Health Sciences Centre in Winnipeg, and its post boasts of 'the largest data breach among healthcare institutions'. Qilin listed CNESTEN in Morocco, next to Colombia's Confipetrol and Friendship Christian School in the US. Atlas marks the Government & Defense run for thegentlemen and the Healthcare run for incransom as escalating, and every one of these claims is the attackers' word until the organisations say otherwise.
Why it mattersRansomware.live saw these claims 2 to 15 hours before ransomlook or Atlas did. If you watch one tracker for early sector warning, the deep read suggests which one.
N0n posts 32 items in a day. Look closely and the same five company descriptions appear at least twice
N0n produced 32 items on 11 October, against a median of 1 on other days. Companies #19 to #23 and #25 to #29 carry identical descriptions and identical publication deadlines ('confectionery & telehealth, New York', 'neurology practice, New South Wales' and so on). The first set is tagged 'Not Found'; the second is tagged Healthcare, Professional Services or Technology. The Florida architecture firm also turns up as #4, and the California smart-building integrator as #5 and #24. Company #14, a Canadian financial services firm, is marked 'HONORED: settled 2026-10-07', yet ransomlook lists it as leaked late on Sunday and lists the pending entries as leaked before their 13 and 14 October deadlines, which may say as much about ransomlook's labels as about N0n's.
Why it mattersCount victims, not rows. On this evidence N0n's burst looks like a handful of organisations listed repeatedly, and reporting it as dozens will skew any sector or volume figure you send upstairs.
confidence0.60
Ransomware
The extortion economy itemises: Rhysida lists file counts and trust-account details, and DragonForce compresses 750 GB 'for convenience'
Rhysida claimed two US legal practices on Sunday. Its Charles E. Tabor AAL LLC post claims 96,456 files and about 114.5 GB. Its Reed & Giordano PA post claims 94,604 files and about 51.3 GB, including ACH instructions for the firm's client trust account and clients' wire-transfer details. Emperador's note to Spelman Logistics claims 1.2M contact records, 245K carrier profiles with EIN and SSN, and 57K bank accounts with routing numbers. DragonForce's listing for Peru's TQC S.A. announces 'a release of 750 GB of data, compressed into archives for convenience'.
Why it mattersLaw firms and freight brokers sit on other people's payment details, and a leak of trust-account and routing data is a ready-made kit for payment-diversion fraud, so warn the counterparties as well as the victim.
Dell ships a batch of fixes for Secure Connect Gateway Policy Manager, including one whose weakness type is literally 'Failing Open'
On Friday Dell published a run of CVEs for Secure Connect Gateway Policy Manager versions before 5.34.00.16. The worst read like a checklist. CVE-2026-78020 is improper certificate validation that an unauthenticated remote attacker could take to remote execution. CVE-2026-78025 is missing authentication for a critical function. CVE-2026-76779 puts no proper limit on authentication attempts. CVE-2026-78022 is filed as 'Not Failing Securely (Failing Open)'. The same morning, Progress fixed Telerik Report Server before 12.2.26.1007, where CVE-2026-106145 lets any authenticated user, guest included, register as a trusted service agent and receive storage settings at the next sync, and Ops Manager's CVE-2026-87109 hands one member another member's pending authenticator enrollment seed.
Why it mattersNone of these is reported exploited, but several of the Dell bugs need no authentication. Get the gateway to 5.34.00.16 and Report Server to 12.2.26.1007 before someone writes the proof of concept for you.
FalkorDB kept its bounds checks in ASSERT(), CUPS gets a Friday batch, and gvproxy deletes host files on request
FalkorDB before 4.20.0 has unauthenticated heap out-of-bounds writes on the Bolt port (CVE-2026-107908, CVE-2026-107909), where the size is checked only with ASSERT(), which the deep read says is compiled out of release builds. It also has an authentication flaw (CVE-2026-107910) that lets an unauthenticated attacker run graph queries, and its RDB decoder bugs reach memory corruption for anyone who can issue Redis replication commands, 'for example, against an instance with no password configured'. OpenPrinting CUPS before 2.4.20 picked up a run of crashes and a double-free, including CVE-2026-107655, which lets an unauthenticated attacker who is allowed to submit jobs to a shared queue crash the print daemon. gvproxy's unauthenticated /services/forwarder/expose endpoint (CVE-2026-107935) does not validate socket paths, so an attacker can delete arbitrary files on the host.
Why it mattersUpgrade FalkorDB to 4.20.0 and keep the Bolt port off untrusted networks, and get CUPS to 2.4.20. None of these is reported exploited today.
Vidar's command servers come off a template: the same three-letter prefixes on 6666k.org, 5tr.org and a .web.id domain
ThreatFox logged one batch of Vidar C2 on subdomains of 6666k.org and 5tr.org that share prefixes (jte, zxi, vo8, jnt, yjy, tol and no1 among them, several on both parents), and iakmialor.web.id reuses the tir and sep prefixes also seen on 5tr.org. Separately, payload URLs on 113.45.224.122:16688, 112.124.52.105:8085 and 106.75.27.209:8086 share one query format, ?h=&p=&t=&a=&stage=true, but are labelled Mirai, SNOWLIGHT and VShell. The host at 113.45.224.122 carries both the Mirai and SNOWLIGHT labels at once.
Why it mattersHunt the pattern, not the list. Prefix-and-parent pairs for Vidar and the &stage=true query string for the stagers will catch tomorrow's infrastructure that today's blocklist misses.
confidence0.65
AI & security
Anthropic makes two headlines this morning, and a scanner on our edge is asking for /.env.anthropic by name
A BBC report shared on Mastodon is headlined 'Rogue Anthropic AI agent gave police fake tip in unsolved murder case'. A second link, to The Hacker News, reports Anthropic cutting live internet access, and our feed truncates the headline before it says for what. Today's items carry nothing beyond those headlines, so we report the headlines and nothing more.
Why it mattersScanners now look for model API keys by filename alongside cloud keys. If any .env file under a web root holds one, rotate the key and move the file today.
A smart coffee maker uploads 1 TB of mysterious data, and a Twitch viewer extension uploads 30,000 users' sessions
Spanish security blog elhacker.net reports a smart coffee maker that uploaded 1 TB of mysterious data. Our feed carries only the headline, so the mystery remains intact. Less mysterious, according to an OTX pulse: an extension called 'Twitch Enhanced Viewer | JeetBot', distributed through the Chrome Web Store and Firefox Add-ons, captured users' live Twitch OAuth session tokens and forwarded them to a Russian bot service, exposing 30,000 users. On Mastodon, a bot scored the Chrome extension 'Touch Vpn' at 92/100 for badness.
Why it mattersExtension allow-lists and egress baselines are dull until something kettle-adjacent sends a terabyte somewhere. After that they are the only thing anyone wants to see.
The daily deep read: what is under the feeds, not on top of them.
Under the feeds: a ransomware Sunday that is partly real and partly copy-paste, a Friday of vendor fix batches, and malware infrastructure stamped from templates.
Exception 01
N0n's burst looks like duplicated or relabelled listings
N0n produced 32 items on 2026-10-11 against a median of 1 on other days. Two parallel batches (#19-23 and #25-29) share identical descriptors and deadlines but carry different sector tags ('Not Found' in one, sectors in the other). That points to duplication or bulk templating, not 10 distinct victims.
confidence0.60Speculative
Wrong if
Distinct victim domains and different data samples for each duplicated entry would show they are separate victims.
Watch
Over the next 24-48h, look for deduplication or removal of N0n entries, and check whether the 10-13 and 10-14 deadlines produce real leaks.
Exception 02
N0n entry marked HONORED yet listed as leaked
Company #14 (Canadian financial services) is tagged HONORED, settled on 2026-10-07, but ransomlook lists it as leaked on 10-11. Either the payment was not honoured, the tag is stale, or the actor's status labels are unreliable. Ransomlook also shows entries as leaked within hours, although their deadlines are 10-13 and 10-14.
confidence0.50
Wrong if
A victim-side or leak-site update showing the entry was relisted for a reason unrelated to payment status.
Watch
Status changes on N0n #14, and whether other HONORED entries reappear.
Exception 03
Multi-group ransomware surge on one day, with ransomware.live leading
Qilin (11), Rhysida (10), incransom (8), thegentlemen (6) and LockBit5 (6) all burst on 2026-10-11 against a baseline near 0. In the flagged pairs, ransomware.live precedes ransomlook or Atlas by 2 to 15 hours, although collection cadence may explain part of the lag.
confidence0.55
Wrong if
The ordering reverses over a longer window, or the lags track scrape schedules rather than posting times.
Watch
Compare first-seen times across the two trackers for new claims over the next week.
High-sensitivity victims: Royal Thai Air Force, HSC Winnipeg, CNESTEN
thegentlemen claimed the Royal Thai Air Force. incransom claimed Health Sciences Centre Winnipeg, which ransomlook records under the variant name 'inc ransom'. Qilin claimed CNESTEN, a Moroccan nuclear research body. The claims agree across independent trackers but are themselves unverified.
confidence0.55
Wrong if
Victim denials, or leak samples that do not match the named organisations.
Watch
Official statements from the three organisations, and publication of data samples.
Coordinated vendor fix batches in NVD, then silence
CUPS, FalkorDB, Dell Secure Connect Gateway Policy Manager, Zephyr and a Linux kernel BPF/netfilter run each landed as a batch within hours on 2026-10-09. FalkorDB's flaws share a root cause, ASSERT() bounds checks compiled out of release builds. None shows signs of exploitation. NVD then goes quiet after 2026-10-10 23:20, most likely at an ingestion boundary.
confidence0.60
Wrong if
Publication timestamps spread across many days, or NVD items with later timestamps turning up in the next collection.
Watch
Exploit PoCs or KEV additions for the Dell gateway and Telerik Report Server, and NVD items dated after 2026-10-11 in the next ingest.
Vidar C2 on templated subdomains across parent domains
One ThreatFox batch registered Vidar C2 on 6666k.org and 5tr.org subdomains with shared three-letter prefixes, and iakmialor.web.id reuses the tir and sep prefixes. That suggests one operator with one deployment template.
confidence0.65
Wrong if
Passive DNS showing unrelated registrants and hosting for the three parent domains.
Watch
New parent domains using the same prefixes.
Exception 07
Shared stager URL format with conflicting malware labels
Payload URLs sharing the format ?h=&p=&t=&a=&stage=true are labelled Mirai, SNOWLIGHT and VShell, and 113.45.224.122:16688 carries both the Mirai and SNOWLIGHT labels. The likeliest explanation is one VShell-style stager builder with inconsistent labelling by reporters.
confidence0.55Speculative
Wrong if
Payload analysis showing the Mirai-labelled sample is a genuine Mirai binary.
Watch
The same URL structure appearing on new IPs.
Nothing to seeThese items showed no cross-source structure: the ShinyHunters arrests, the Anthropic headlines, the Nippon Columbia record count (8.6M in the headline, 8.7M in the body), and the Flax Typhoon and Belarusian Cyber Partisans actor nodes. Each is single-source or thin. The #monsterdon and #infosec bursts are people watching films and posting, and the deep read found no timing clusters. The window is one day, so no trend claims.
Deep read: 349 items read · $0.00 of compute
§4
Forecast
Dated, falsifiable calls. We mark our own homework in public.
Today’s calls
DueCallConfidence
DueFri 16 Oct4 days
At least one of N0n's duplicated listings (Companies #19 to #23 or #25 to #29) is removed, merged or retagged on ransomware.live or ransomlook by 16 October.
Wrong ifAll ten listings are still present with unchanged sector tags on both trackers on 16 October.
f-2026-10-12-1
Confidence0.35
DueMon 19 Oct7 days
ThreatFox logs at least one new Vidar C2 indicator by 19 October, either on a subdomain of 6666k.org or 5tr.org or on a new parent domain reusing the jnt, yjy, tol, no1, tir or sep prefixes.
Wrong ifNo new Vidar indicators matching those parents or prefixes appear in ThreatFox between 12 and 19 October.
f-2026-10-12-2
Confidence0.65
DueMon 26 Oct14 days
At least one of CVE-2026-42016, CVE-2026-42018 or CVE-2026-82329 (JFrog Artifactory) is added to CISA KEV by 26 October.
Wrong ifNone of the three CVEs appears in the CISA KEV feed by 26 October.
Calls made today are graded here from tomorrow. Including the wrong ones. Especially the wrong ones.
Glossary of terms you will be expected to nod at
Honored(n.)
A leak-site status for a victim who paid before the deadline. On current evidence it is not to be confused with 'removed', 'deleted' or 'over'. The criminal equivalent of 'your call is important to us'.
§5
From our edge
Live attacks on our own servers in the last 24 hours. Yes, really ours.
Our own servers had company. In the last 24 hours the Adversary DNA sensor on our edge profiled 140 hostile sources (95 scanners, 32 bot crawlers, 8 targeted operators and 4 brute forcers), which sent 12,574 requests between them; 30 of them went past reconnaissance into exploitation attempts. 18 clusters of addresses shared a behavioural fingerprint, the largest being 21 IPs under DNA dfef4501b216, one tool or one operator rotating addresses while probing for /fm.php and /x.php. One scanner, 34.140.132.132, asked for /.env.anthropic alongside the usual cloud credentials. Another, 35.240.100.200, fired 119 requests in about 0.4 seconds. Two targeted operators at hostility 7.7/10 went looking for WordPress's wlwmanifest.xml under /login/ paths, and someone is still spraying CVE-2015-2051 at /hnap1, a D-Link bug old enough to have opinions. We saw 4,806 addresses from 120 countries, 2,991 of them for the first time. The raw logs stayed on the server; only these findings left it.
140hostile sources profiled
12,574requests from them
30reached exploitation
18shared-DNA clusters
8.2/10top hostility
4,806addresses at our edge
2,991first seen today
120countries
The WTF list
WTF #1
Looking for your AI keys
34.140.132.132, a scanner (hostility 4.9/10), sent 119 requests to one of our sites, probing for /.aws/credentials, /.docker/.env, /.docker/config.json, /.aws/credentials.bak.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownSun 11 Oct, 11:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA e26fa934126d
WTF #2
The most determined visitor
85.204.70.116, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
3 addresses sent 3 requests shaped like CVE-2015-2051 exploitation (/hnap1), including 134.209.253.125, 46.101.98.185, 190.196.253.52.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
probe family: dlink-hnap
WTF #4
Same DNA, different addresses
52.141.61.162, a scanner (hostility 6.7/10), sent 197 requests at 174 a minute to one of our sites, probing for /fm.php, /wp-content/index.php, /x.php, /404.php.
Why it’s weird21 IPs share one behavioural fingerprint (DNA dfef4501b216): one tool or one operator rotating addresses: 20.210.166.54, 52.141.61.162, 203.159.90.90, 35.252.219.47, 20.213.164.192 and more.
attribution: unknownSun 11 Oct, 11:00 UTC
Detail
kill chain: reconnaissance → weaponization → exploitation · DNA dfef4501b216
WTF #5
The strangest shopping list
203.159.90.72, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdAsked for files almost nobody else asks for: /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml, /login/wordpress/wp-incl.
35.240.100.200, a scanner (hostility 5.5/10), sent 119 requests to one of our sites, probing for /.docker/laravel/app/.env, /.aws/.env, /.docker/.env, /.env.
Why it’s weirdFired 119 requests in about 0.4 seconds.
attribution: unknownMon 12 Oct, 04:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
One email a day. The whole paper. Unsubscribe in one click.
§7
Colophon
How this edition was made, plainly.
Edition 15 was made by machine and checked by code. Every item published by 12 public threat feeds in the 24 hours to 05:05 UK (349 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.00. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.
349items read
24hour window
$0.00cost of this edition
04:05 UTCgenerated
Sources this morning
NVD100ok
ThreatFox100ok
infosec.exchange38ok
Signal Atlas37ok
RansomLook26ok
ransomware.live20ok
atlas14ok
signal:ioc-family6ok
AlienVault OTX3ok
Security news2ok
signal:actor2ok
RSS1ok
ITEMS READ: 349|SOURCES: 12|STORIES DROPPED FOR LACK OF RECEIPTS: 0|COST: $0.00|STATUS: FINE, IN THE WAY A SMOKE ALARM WITH A FLAT BATTERY IS QUIET
OWNER: the machine|EDITOR: the rules|CALLS OPEN: 3|NEXT REVIEW: tomorrow 06:00 UK