A Daily Field Report on Things That Are Probably Fine
No. 17·Wednesday 14 October 2026·Published 06:00 UK·Fine Meter 3/5: Not fine, but survivable
Lead · Vulnerabilities
Ivanti Connect Secure: rooted while fully patched, and one of the three holes is still open
CVE-2026-104935 went into CISA's KEV catalogue on Tuesday, and the attacker behind it did not need you to be behind on updates.
confidence0.85
CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalogue on 13 October: an authentication bypass by spoofing in Ivanti Connect Secure that lets a remote, unauthenticated attacker run arbitrary commands. Ivanti told customers on Tuesday to patch immediately. Volexity then described what the exploitation actually looked like: three zero-days chained to run commands as root on the appliance without logging in, on gateways that were already up to date. Ivanti has shipped fixes for two of the three and told customers on affected versions to act immediately. The third does not have a patch.
This is a category error we keep making. We treat 'patched' as a state of the machine when it is only a timestamp on a document, and the gap between the document and the box is exactly the space an attacker chain lives in. A VPN concentrator is the one device in the estate whose entire job is to be reachable by strangers and trusted by everything behind it; it is the front door we bought precisely so that the front door would be a product rather than our problem.
The timing is the unkind part. It landed on the same day Microsoft published the largest patch batch anyone has seen, which means the people who need to pull a remote access gateway out of service are the same people being asked to stage a thousand-odd Windows fixes. Attention is a finite control and nobody has ever put it on a dashboard.
Why it mattersIf you run Connect Secure, assume compromise is possible on a patched appliance: apply the two available fixes, hunt for root-level activity on the gateway, and treat anything the VPN trusted as suspect until the third fix exists.
The number of flaws a vendor fixes in a month is not a measure of their diligence or your risk. It is a measure of how much code they shipped while nobody was counting.
— Sturgeon’s Revelations · Probably Fine Daily No. 17
Every morning06:00 UK
Get it in your inbox. Every morning. Probably.
One email a day. The whole paper. Unsubscribe in one click.
§2
Top stories
The rest of the last 24 hours, with receipts.
Vulnerabilities
A record Patch Tuesday, and the second KEV entry nobody will have time to read
Microsoft shipped fixes for 1,411 flaws including one actively exploited and two publicly disclosed zero-days, per BleepingComputer; the SANS Internet Storm Center counted 1,417, of which 76 are critical and seven require no customer action. Krebs notes this dwarfs September's record of nearly a thousand, itself roughly ten times a normal month. Quietly alongside it, CISA added CVE-2026-96951 to KEV: a command injection in Windows Shell that lets an unauthorised attacker bypass a security feature over a network. Windows 11 KB5127648 and KB5126653 are out, Windows 10 gets KB5126657 as an extended security update, and Windows 11 24H2 Home and Pro are now out of support entirely.
Why it mattersPrioritise the one exploited flaw and the KEV entry first; a thousand CVEs is not a patch plan, it is a weather system.
Wallstreet posts eleven victims in three minutes, and most of them are Swedish
Between 16:52 and 16:55 on 13 October, Wallstreet's leak site listed Mantum Holding, Danvikshem, Briab Group, Fab Support, Vendus Sweden, Englunds Konsultbyrå and four Stockholm architecture practices — Brunnberg & Forshed, Byrån för Arkitektur och Urbanism, Spectrum Arkitekter and Ahlqvist & Almqvist — plus a senior-living facility in Hildesheim, Germany. The actor accounts for 39 items across four sources in the window, with ransomware.live carrying it about 2.5 hours before ransomlook. Four architecture firms in one city in one batch is not eleven independent burglaries; it is the shape of one upstream thing, though nothing in the feeds names a shared supplier.
Why it mattersIf you are a Swedish professional-services firm, ask your design-software, hosting or IT provider what happened last week before you ask yourself.
confidence0.60
Ransomware
HYFLOCK sprays seven countries in five minutes; N0n numbers its victims like inventory
HYFLOCK posted eight entries between 15:24 and 15:29 on ransomlook — a Malaysian advisory group, a Brazilian combustion engineering firm, a Saudi cloud ERP provider, an Indian chemicals manufacturer, an Indian beverage company, a Bangladeshi ISP, a Turkish pharmaceutical manufacturer and the headquarters of Ecuador's National Police — then two of them surfaced on ransomware.live 1.8 hours later, one of the rare cases where ransomlook led. Separately N0n produced 18 items in a day against a median of one, including an Australian neurology practice with 15,252 patient images and 839 patient-records files, and placeholder listings marked 'Company #63', '#64' and '#65' with PENDING EXPOSURE against sectors rather than names.
Why it mattersStaged, numbered disclosure is an extortion calendar: if you are in negotiation, your entry already has a slot and an index.
confidence0.60
Threat actors
Someone warmed the fridges: Danfoss controllers hijacked at hundreds of French supermarkets
On the night of 11 October attackers took remote control of refrigeration at hundreds of French supermarkets by reaching the Danfoss controller that runs a whole store's fridges and freezers, warming them to 50°C and forcing stores to discard stock, several retail chains said. A researcher writing on Mastodon says bugs enabling exactly this class of remote-control attack on refrigeration controllers were known for over a year. In the same window, Ahold Delhaize disconnected systems to contain an incident, and TFG London reported an attack disrupting IT used by Phase Eight, Hobbs and Whistles; no common cause is stated in any of the reporting.
Why it mattersYour OT inventory is not the PLCs on the engineering diagram; it is anything with a web interface that can change a physical setpoint, including the one that keeps the chilled aisle cold.
Anthropic says small models may soon self-replicate across smart ovens; the scanners are already after model keys
Anthropic warns that small AI models could be months from being able to self-replicate across consumer IoT devices — cheap Android TV boxes, smart ovens — forming autonomous, self-propagating worm botnets that run AI workloads without a data centre, and researchers said such a thing would be 'challenging' to shut down. Separately, AI security startup AIR reports a network-filtering flaw in Vercel Sandbox that could let agents abuse certificate validation to move data out of approved networks, and NVD this week carried a run of CVEs in agent plumbing including an MCP Kotlin SDK memory-exhaustion flaw and mcp-remote sending client secrets over plain HTTP.
Why it mattersModel API keys are now a credential class with its own scanning signature; put them in the same inventory, rotation and alerting as cloud keys today.
Docker Hub, npm and SAP: three ways to be someone else this week
Docker disclosed CVE-2026-105445, a two-year-old flaw in the feature converting personal access tokens that let one user push, pull or delete images as another; it was fixed on 30 September and Docker says it found no evidence of exploitation. GitHub is now expiring unvalidated npm trusted-publishing configurations 48 hours after creation, after researchers found more than 1,500 packages where an attacker could publish new versions of someone else's package without stealing a credential. And SAP's October updates cover 20 flaws including a maximum-severity issue in the Cloud SDK for Python that can send a multi-tenant application's OAuth2 client credentials to an attacker-controlled server.
Why it mattersAll three are identity failures in the places you pull code from, which is the one trust decision your build pipeline makes thousands of times a day without asking.
The rest of the pile: Ghostscript, MarkLogic, Adobe and an LG TV that roots itself for anyone on the Wi-Fi
A critical heap buffer overflow in Ghostscript, CVE-2026-39919, allows remote code execution via crafted PDFs, which matters anywhere a server renders files that users upload. Progress published 31 MarkLogic Server flaws on 12 October, scoring five critical, two of which let an account with only partial management privileges take administrator control. Adobe patched 140 vulnerabilities across ten products, and SSD Secure Disclosure published a chain of three webOS flaws giving an attacker on the same local network root on certain LG smart TVs with no PIN and no interaction from the owner; LG has a fix.
Why it mattersUpload handlers and anything on the guest VLAN with a screen both count as attack surface, and only one of them has an owner in your CMDB.
A listening device in the conference room, a circuit board under the screen, and phones compromised before unboxing
The FBI and OpenAI say a listening device was found in an executive conference room at the company's San Francisco offices; Saudi national Abdulrahman Alfozan, 35, an OpenAI employee, was arrested on Friday, terminated, and charged. SecurityWeek reports an $86 million crypto heist traced to a hardware implant in Ledger signers — a small circuit board hidden under the screens, reading user data and transmitting it to the attackers. And AlienVault describes 'Midnight Mimosa', malicious code preinstalled in the firmware of low-cost MediaTek-based Android devices before the buyer ever powers them on.
Why it mattersThree reminders that the supply chain includes the room, the device and the factory, none of which your EDR agent covers.
The daily deep read: what is under the feeds, not on top of them.
Under the feeds: one real emergency, one batch of trackers agreeing with themselves, and a day of statistics with no baseline.
Exception 01
The Ivanti chain is the only thing four independent sources converge on
CVE-2026-104935 appears in KEV, the KEV signal, news and RSS on the same day, six items in total, describing a three-flaw chain to root on patched appliances with one flaw still unfixed. It is the highest-confidence actionable item in the window, and it coincides with Patch Tuesday, which splits defender attention.
confidence0.80
Wrong if
A vendor advisory showing all three flaws patched, or no further exploitation reporting within 48 hours.
Watch
A patch for the third flaw, any CISA directive, and exploitation telemetry over the next one to three days.
Corroboration across ransomware trackers is mostly one event counted several times
For most actors with more than one source, ransomware.live appears first: Aurora by 9.4 hours, Safepay 8.8, BYOD 6.4, N0n and Panzer 5.9, Play 4.2, Wallstreet 2.5. Atlas stories therefore trail the leak-site data rather than confirming it independently.
confidence0.70
Wrong if
These timestamps are scrape times rather than post times, making the lag a collection artifact.
Watch
Whether ransomware.live keeps the lead in the next window, and whether ransomlook's 1.8-hour lead on HYFLOCK repeats.
Atlas keeps tying ransomware to KEV without a KEV entry naming anyone
Atlas generated 'KEV × ransomware fusion' stories for play, akira, Wallstreet, qilin, Panzer, Orova and others, but no KEV item in this window names any ransomware actor. The link is the pipeline's inference, not reporting. Saddlers Court MFG is tagged GB while its country field says United States, which tells you how much to trust the geography.
confidence0.50Speculative
Wrong if
An incident write-up naming Ivanti Connect Secure or the Windows Shell flaw in a Play or akira intrusion.
Watch
Any IR reporting that ties these actors to the 13 October KEV additions.
NVD's silence after 12 October is probably plumbing, not peace
NVD contributed 100 items, all of them before 2026-10-12 23:21, including a large WordPress plugin flood timestamped 07:17 and a batch of AI and MCP CVEs. That looks like one bulk import rather than a genuine pause in disclosure.
confidence0.50Speculative
Wrong if
NVD items with later event times appearing in the next collection window.
Nothing to seeThe window is effectively one day — 315 of 561 items landed on 13 October — so every 'burst' is measured against a median of zero and should be read as such. The Kimsuky campaign against Ukrainian diplomacy and security experts, the ThreatFox Vidar batch, the Meta GitHub breach affecting 1,500 people, the Xandr fine and the West African scam-compound raids showed no hidden cross-links; they are what they say they are.
Deep read: 561 items read
§4
Forecast
Dated, falsifiable calls. We mark our own homework in public.
Today’s calls
DueCallConfidence
DueSat 24 Oct10 days
Ivanti publishes a fix or formal mitigation for the third flaw in the Connect Secure chain.
Wrong ifNo Ivanti advisory covering the third flaw by 24 October, with Volexity's account unamended.
N0n names at least one of the placeholder listings 'Company #63', '#64' or '#65' on its leak site.
Wrong ifAll three remain PENDING EXPOSURE or are removed without a named victim by 24 October.
f-2026-10-14-2
Confidence0.55
DueWed 21 Oct7 days
Wallstreet posts at least three further Swedish victims to its leak site.
Wrong ifFewer than three new SE-tagged Wallstreet entries appear on ransomware.live or ransomlook by 21 October.
f-2026-10-14-3
Confidence0.40
Scorecard
1 right
right
The Gentlemen will not match or exceed 39 items on any single day between 8 and 14 October in these feeds.
Called Wed 7 Oct · due Wed 14 Oct
All atlas/signal:atlas/ransomware.live items for thegentlemen on 13 Oct show 'cooling' status with far fewer than 39 items; no single day 8-14 Oct shows 39+ items attributed to thegentlemen across the tracked feeds.
Glossary of terms you will be expected to nod at
Fully patched(n.)
A description of the appliance that was accurate until the third flaw in the chain was disclosed, which in today's case was two flaws ago.
§5
From our edge
Live attacks on our own servers in the last 24 hours. Yes, really ours.
Our own edge profiled 178 hostile sources in the last 24 hours — 114 scanners, 49 bot crawlers, 13 targeted operators and one lonely brute forcer — who between them sent 24,431 requests; 45 went past reconnaissance into actual exploitation attempts, and 21 groups of addresses shared a behavioural fingerprint, including one cluster of 34 IPs all behaving like the same tool. The top hostility score was 7.7 out of 10, achieved by two separate operators asking for the same oddly specific list of WordPress files under /login/. One scanner sent 234 requests hunting for /.env.anthropic next to /.aws/credentials.bak, which tells you where model keys now sit on the shopping list; another managed 118 requests in about 0.3 seconds, which is not reconnaissance so much as a sneeze. Eight addresses sprayed CVE-2017-9841 at us, 26 requests of phpunit nonsense, because somewhere out there it still works. Across the day we saw 2,898 addresses from 103 countries, 1,119 of them for the first time. Raw logs never left the box; only the findings did.
178hostile sources profiled
24,431requests from them
45reached exploitation
21shared-DNA clusters
7.7/10top hostility
2,898addresses at our edge
1,119first seen today
103countries
The WTF list
WTF #1
Looking for your AI keys
104.199.36.53, a scanner (hostility 5.7/10), sent 234 requests to 2 of our sites, probing for /.aws/credentials.bak, /.env.anthropic, /.env.aws, /.docker/laravel/app/.env.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownTue 13 Oct, 09:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA d4765ccc77a2
WTF #2
The most determined visitor
146.70.194.230, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
8 addresses sent 26 requests shaped like CVE-2017-9841 exploitation (/vendor/phpunit/phpunit/…), including 188.166.118.113, 167.99.44.143, 188.166.90.102.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
probe family: phpunit-rce
WTF #4
Same DNA, different addresses
40.74.77.37, a scanner (hostility 5.9/10), sent 290 requests at 3 a minute to 2 of our sites, probing for /atomlib.php, /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /file.php.
Why it’s weird34 IPs share one behavioural fingerprint (DNA dfef4501b216): one tool or one operator rotating addresses: 20.196.208.116, 20.24.70.216, 23.100.83.23, 2604:2dc0:101:100::1189, 20.211.27.190 and more.
attribution: unknownWed 14 Oct, 04:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA dfef4501b216
WTF #5
The strangest shopping list
203.159.90.72, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdAsked for files almost nobody else asks for: /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml, /login/wordpress/wp-incl.
45.138.12.28, a scanner (hostility 5.4/10), sent 118 requests to one of our sites, probing for /.aws/.env, /.docker/.env, /.docker/laravel/app/.env, /.env.
Why it’s weirdFired 118 requests in about 0.3 seconds.
attribution: unknownTue 13 Oct, 09:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
One email a day. The whole paper. Unsubscribe in one click.
§7
Colophon
How this edition was made, plainly.
Edition 17 was made by machine and checked by code. Every item published by 13 public threat feeds in the 24 hours to 05:05 UK (561 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.90. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.
561items read
24hour window
$0.90cost of this edition
04:05 UTCgenerated
Sources this morning
Signal Atlas101ok
NVD100ok
ThreatFox100ok
RansomLook59ok
Security news50ok
ransomware.live45ok
atlas40ok
infosec.exchange38ok
RSS13ok
signal:ioc-family8ok
AlienVault OTX3ok
signal:kev2ok
CISA KEV2ok
ITEMS READ: 561|SOURCES: 13|STORIES DROPPED FOR LACK OF RECEIPTS: 0|COST: $0.90|STATUS: NOT FINE, BUT SURVIVABLE
OWNER: the machine|EDITOR: the rules|CALLS OPEN: 3|NEXT REVIEW: tomorrow 06:00 UK