Lead · Vulnerabilities

Ivanti shipped fixes for two of the three flaws. The attackers were only ever using all three

Volexity says a chain of three zero-days in Ivanti Connect Secure gave unauthenticated root on a fully patched VPN, exploitation runs back to at least 1 October, and one flaw in the chain still has no fix.

confidence 0.85

On Tuesday the story was a single actively exploited zero-day in the Ivanti Connect Secure gateway, patch immediately, nothing more to say. By Tuesday evening Volexity had described three zero-days chained together to run commands as root without logging in, with Ivanti having fixed two of them and telling customers on affected versions to act immediately. CVE-2026-104935 is the headline flaw, an authentication bypass leading to remote code execution with elevated privileges, and reporting notes it was only partially discovered and partially patched back in July, which is a sentence that should be read slowly and then read again.

CISA told admins to update now, noting exploitation in zero-day attacks since at least 1 October, and honeypots have logged 105 exploit attempts. Ivanti was also one of three edge vendors shipping fixes this week, with Citrix, Fortinet and Ivanti between them patching 29 vulnerabilities. If you patched on Tuesday morning off the first headline and closed the ticket, you patched one bug in a chain of three and the chain is the product.

This is the uncomfortable bit. The remote access box is the thing you bought so that everyone could work from somewhere else, which means it is internet-facing, holds credentials, and runs as root when it is annoyed. Patch to the latest version, then go and look: nobody has promised you the box was clean when the fix landed, and a device exploited two weeks ago is not made innocent by a new build number.

Why it mattersAssume pre-patch compromise: patch, then hunt on the appliance, rotate anything it held, and do not treat the first-reported CVE as the whole incident.

Receipts

Today’s revelation

A patch that fixes two bugs in a chain of three is not remediation; it is a pause in the attacker's typing, which you have agreed to call a resolution.

— Sturgeon’s Revelations · Probably Fine Daily No. 18

§2

Top stories

The rest of the last 24 hours, with receipts.

Vulnerabilities

Four KEV additions in one batch, and two of them are designed to be used together

CISA added four entries on 14 October: Ahsay AhsayCBS improper authentication (CVE-2026-105133) and command injection (CVE-2026-105134), which the advisories explicitly say chain to each other through the random parameter; Cisco Secure Email Gateway relative path traversal (CVE-2026-76519), allowing an unauthenticated remote attacker to write arbitrary files to the operating system; and Palo Alto Networks PAN-OS code injection (CVE-2026-0322), which lets an authenticated attacker with network access run code as root on the firewall. Palo Alto confirmed CVE-2026-0322 was exploited as a zero-day in attacks against firewalls. One is a backup server, one is a mail gateway, one is the firewall, and all three sit exactly where ransomware crews prefer to arrive.

Why it mattersBackup appliances and perimeter gear are the shortest route from the internet to your recovery plan; inventory Ahsay, SEG and PAN-OS today, not at the next change window.

confidence 0.95

Receipts

Vulnerabilities

Cisco's email gateway is being attacked by email, which is at least thematically consistent

Cisco published an advisory on Wednesday saying attackers are exploiting a critical flaw in Secure Email Gateway in which a sender with no login sends a message with a crafted attachment and, if it lands, writes files to the appliance's operating system; reporting describes the result as remote unauthenticated command execution with root privileges. CISA's KEV entry for the same product the previous day lists CVE-2026-76519, relative path traversal, unauthenticated arbitrary file write. The delivery mechanism is the one thing you cannot turn off, because the appliance exists to accept mail from strangers.

Why it mattersPatch SEG now and then check it for files that have no business being there; this one needs no click from a user and no credential from anybody.

confidence 0.80

Receipts

Ransomware

Seven leak sites fired at once on Tuesday, and lockbit5 posted four victims in three minutes

Against a median of zero on other days in the window, 14 October brought bursts from lockbit5 (11 items), akira (9), eclipse (6), and dragonforce, nightspire, incransom and rhysida at five apiece. The lockbit5 postings landed at 11:28, 11:29, 11:30 and 11:31, which is a batch upload rather than four separate bad nights; akira listed three food and manufacturing firms within two minutes of each other, incransom claimed 1.53 TB from a Brazilian finance company, and Eclipse listed a Japanese newspaper and a Taiwanese pharmaceutical firm. Separately, reporting this week says organisations are describing threats of stalking, violence and abduction against staff, and a vendor report claims a rise in physical threats against executives and their families; those claims are hard to verify and should be handled as such.

Why it mattersLeak-site volume on any one day measures the aggregator's ingestion as much as the attacker's week; count victims over a week, not a morning, and pass the coercion reporting to HR and physical security rather than the SOC channel.

confidence 0.85

Receipts

AI & security

Six days, a public model, and a full Chrome chain: the discovery side has quietly stopped being the hard part

XBOW says it chained three then-unknown Chrome bugs into an attack that runs code on a Windows machine when the user merely loads a page, built in six days by directing AI agents running OpenAI's publicly available model, with the Chrome full chain reported at a $250,000 value. In the same window, a flaw in Linux's vhost subsystem (CVE-2026-74580) was disclosed that gives a local user kernel read and write across nearly a decade of kernel versions and, in one virtualisation setup, lets an untrusted guest write to host memory; an AI pentesting agent found a critical OTP bypass on a major insurer's production login on its own; and Booz Allen's lab reports AI models meeting every objective across eight scenarios and reaching an industrial control network from a perimeter compromise in just over 16 minutes. The tools are also eating themselves: a bug in Claude Code Desktop's preview pane is reported to allow zero-click theft of SSH keys, AWS credentials and OAuth tokens from developers.

Why it mattersYour patch window was sized for a world where finding the bug took longer than deploying the fix; that assumption is now the control you are relying on and it is not holding.

confidence 0.80

Receipts

Vulnerabilities

Patch Tuesday was the largest ever, and nobody can agree on how large

BleepingComputer counted 1,411 flaws and three zero-days, one exploited and two publicly disclosed; SecurityWeek counted 1,413 including the exploited Windows security feature bypass CVE-2026-96951; the SANS Internet Storm Center counted 1,417, of which 76 are critical and seven critical need no customer action; Krebs said more than 1,400 and noted September's record was nearly 1,000, about ten times Redmond's normal monthly load. Adobe added 140 across ten products and browser updates fixed 114 more. The exact total is less interesting than the fact that four competent outlets reading the same release notes landed on four different numbers.

Why it mattersTriage by exploited-and-reachable, starting with CVE-2026-96951; a four-figure patch list cannot be worked top to bottom by anybody who also intends to sleep.

confidence 0.70

Receipts

Policy

A billion phishing messages, 187 laptops and one arrest in a village: the takedown day

Microsoft, Health-ISAC, Japan's JC3 and a coalition including Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs seized domains behind the CoGUI, Haozi and Iron Man phishing kits and the YAM Store marketplace, an ecosystem tied to more than a billion malicious messages aimed at over 75,000 organisations in 150 countries. The US Department of Justice charged 14 people, arrested two and seized about 187 laptops across more than 40 Texas locations used in North Korean remote IT worker schemes. North Macedonian police with the FBI arrested the alleged administrator of the OLVX credential market, and the UK sanctioned the Cryptomus crypto platform over Russian money laundering tied to ransomware and darknet payments.

Why it mattersInfrastructure takedowns move the spam baseline for weeks, not years; expect new sending domains and keep the phishing detections tuned rather than declaring victory.

confidence 0.90

Receipts

Threat actors

Someone turned the fridges up to 50°C in hundreds of French supermarkets, and the bugs were known a year ago

On the night of 11 October attackers took remote control of refrigeration at hundreds of French supermarkets and warmed it to 50°C, forcing stores to discard stock, several chains said; access was through the Danfoss controller that runs all of a store's fridges and freezers. A researcher who spoke to Infosecurity Magazine says bugs enabling exactly this kind of remote-control attack on refrigeration controllers had been known for over a year. This is a physical-consequence attack reached through a management channel that nobody in the store has ever logged into.

Why it mattersIf a third party remotely manages anything in your estate that has a temperature, a motor or a door, that connection is in scope and probably is not in your asset register.

confidence 0.75

Receipts

Oddities

An $86 million crypto heist traced to a circuit board hidden under the screen

Investigators have linked an $86 million crypto theft to a hardware implant in Ledger signer devices: a small circuit board concealed beneath the signers' screens that read user data and transmitted it to the attackers. Ledger has now asked resellers and distributors across Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and pull products from shelves while it investigates device tampering. The supply chain here is not an npm registry; it is a shelf, a box and a courier.

Why it mattersTamper-evidence on hardware you receive is a control, not a formality, and any device that displays what you are signing can be made to display something else.

confidence 0.80

Receipts

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

The edge-device story changed shape mid-cycle, the KEV batch was one event not a trickle, and several feeds fell silent at the same minute.

Exception 01
Ivanti went from one zero-day to an incompletely patched chain in under two hours of reporting
The first items describe a single unauthenticated root RCE; later items describe three chained flaws with only two patched and a July fix that was partial. The rss feed led cyber-news by about 1.8 hours. Anyone who acted on the first wording patched a third of the problem.
confidence 0.60
Wrong if
Ivanti or Volexity confirming a single bug, fully fixed, with the chain wording traced to one mis-paraphrase.
Watch
Ivanti advisory updates, a patch for the third flaw, and a KEV entry for CVE-2026-104935.
Receipts
Exception 02
The KEV additions arrived as one batch and both KEV feeds then stopped
CVE-2026-0322 appears across four sources, the two Ahsay CVEs were added together with the Cisco SEG flaw, and both signal:kev and cisa-kev go quiet after 09:17 on 14 October, so this is a single publication event rather than a steady stream. The link to the same day's ransomware bursts is a plausible hypothesis, nothing more.
confidence 0.55Speculative
Wrong if
Later KEV additions showing the 09:17 stop was a fetch artifact, or victim reporting naming none of these vectors.
Watch
The next KEV update, and any incident report naming Ahsay or PAN-OS as the entry vector.
Receipts
Exception 03
Ransomware.live usually gets there first, by hours
Ransomware.live preceded signal:atlas or ransomlook for nightspire (8.7h), aurora (7.5h), akira (5.9h), n0n (5.5h), lockbit5 (5.0-5.4h), dragonforce (4.3h) and eclipse (1.6h), while atlas led for Wallstreet (14.1h), Orova (10.7h) and qilin (4.1h). That is feed latency, not attacker behaviour, and it is worth knowing which tab to open first.
confidence 0.50
Wrong if
The ordering reversing for the same actors over a longer window; one day of data makes small lags indistinguishable from noise.
Watch
Repeat the lead-lag over a week and see whether the atlas-first actors keep escalating.
Receipts
1. 1ransomware.liveaurora claimed Estrategias BigMat S.L.U. (Retail &…
2. 2RansomLookaurora leaked Estrategias BigMat S.L.U. — Estrategi…
Exception 04
thegentlemen burst on Monday then stopped at the same minute as the KEV feeds
18 items on 13 October against a median of 6, then silence after 09:17 on 14 October, which is the exact timestamp at which two unrelated KEV feeds also stop. A collection gap explains that better than a gang taking the afternoon off.
confidence 0.40Speculative
Wrong if
thegentlemen postings appearing after 09:17 on 14 October in the raw leak-site data.
Watch
Whether thegentlemen victims reappear on 15-16 October and whether the KEV sources resume.

Nothing to seeThe window is about a day and a half, so every burst is measured against a near-zero baseline and no trend is real yet. The Juniper seven-CVE cluster and the Docker Hub CVE are single-source in our feeds. The geopolitical items and the 03:00 UTC Mastodon spikes show no hidden link, and nothing ties the new KEV entries to any named ransomware victim.

Deep read: 470 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueThu 22 Oct7 days
CVE-2026-104935 (Ivanti Connect Secure) appears in the CISA KEV catalogue by 23:59 UTC on 22 October 2026.
Wrong ifNo KEV entry for CVE-2026-104935 in the cisa-kev feed by that time.
Receipts
f-2026-10-15-1
Confidence0.65
DueSun 25 Oct10 days
Ivanti publishes a fix or formal mitigation for the third, currently unpatched flaw in the Connect Secure chain by 25 October 2026.
Wrong ifNo Ivanti advisory update covering the third flaw appears in the rss or cyber-news feeds by that date.
Receipts
f-2026-10-15-2
Confidence0.50
DueTue 20 Oct5 days
lockbit5 posts at least three further named victims to ransomware.live by 20 October 2026.
Wrong ifFewer than three new lockbit5 victim entries on ransomware.live in that period.
Receipts
f-2026-10-15-3
Confidence0.70

Scorecard

Noted

Calls made today are graded here from tomorrow. Including the wrong ones. Especially the wrong ones.

Glossary of terms you will be expected to nod at

Partially patched (n.): The condition in which the vendor has stopped thinking about the problem and the customer has not yet started. See also: July, when it was fixed the first time.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge sensor profiled 140 hostile sources in 24 hours, 97 scanners, 32 bot crawlers, 10 targeted operators and one researcher, sending 22,444 requests between them; 37 went past looking and tried something, and 18 groups of addresses shared a behavioural fingerprint, one of them 28 addresses deep under a single DNA (dfef4501b216), which is one tool or one operator rotating hosts and calling it diversity. The two most hostile visitors, 203.159.90.72 and 146.70.194.252, both scored 7.7 out of 10 and both asked politely for /login/xmlrpc.php and three flavours of wlwmanifest.xml, reaching credential-access on the kill chain. 193.32.204.199 fired 51 requests for .git/config in about 0.8 seconds, which is not browsing. 35.245.136.185 sent 260 requests hunting /.env, /.env.local and /.env.production, the sensor's most confident campaign match of the day at 58 per cent. And three addresses sent 14 requests shaped like CVE-2017-9841 at the /vendor/phpunit/ path, because somewhere a scanner has never been told. Across the day: 3,311 addresses at our edge, 1,461 of them seen for the first time, from 114 countries. Raw logs stayed on the server; only the findings left.

140hostile sources profiled

22,444requests from them

37reached exploitation

18shared-DNA clusters

7.7/10top hostility

3,311addresses at our edge

1,461first seen today

114countries

The WTF list

WTF #1
The most determined visitor
203.159.90.72, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
attribution: unknownWed 14 Oct, 06:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation → credential-access · DNA 82a939927b85
```
WTF #2
Same DNA, different addresses
40.74.77.37, a scanner (hostility 5.9/10), sent 290 requests at 3 a minute to 2 of our sites, probing for /atomlib.php, /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /file.php.
Why it’s weird28 IPs share one behavioural fingerprint (DNA dfef4501b216): one tool or one operator rotating addresses: 20.196.208.116, 20.211.27.190, 74.0.32.199, 34.116.172.94, 35.237.174.50 and more.
attribution: unknownWed 14 Oct, 06:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA dfef4501b216
```
WTF #3
Trying CVE-2017-9841 on us
3 addresses sent 14 requests shaped like CVE-2017-9841 exploitation (/vendor/phpunit/phpunit/…), including 170.64.160.127, 209.38.25.221, 94.26.0.103.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: phpunit-rce
```
WTF #4
The strangest shopping list
146.70.194.252, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdAsked for files almost nobody else asks for: /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml, /login/wordpress/wp-incl.
attribution: unknownWed 14 Oct, 06:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation → credential-access · DNA 82a939927b85
```
WTF #5
In a hurry
193.32.204.199, a targeted operator (hostility 6.2/10), sent 51 requests, probing for /template/.git/config, /data/.git/config, /www/.git/config, /code/.git/config.
Why it’s weirdFired 51 requests in about 0.8 seconds.
attribution: unknownWed 14 Oct, 23:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation · DNA 6e70267a94d8
```
WTF #6
Somebody we might know
35.245.136.185, a scanner (hostility 6.4/10), sent 260 requests to one of our sites, probing for /.git/config, /.env, /.env.local, /.env.production.
Why it’s weirdThe sensor's most confident campaign match of the day: Automated .env credential discovery scanner at 58%.
attribution: Automated .env credential discovery scanner (sensor's best match, 58%)Wed 14 Oct, 23:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 83562bd8e880
```

§6

Ride-alongs

Free, live tools. No sign-up, no sales call.

§7

Colophon

How this edition was made, plainly.

Edition 18 was made by machine and checked by code. Every item published by 12 public threat feeds in the 24 hours to 05:05 UK (470 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.77. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

470items read

24hour window

$0.77cost of this edition

04:05 UTCgenerated

Sources this morning

ThreatFox100ok
Security news97ok
infosec.exchange77ok
atlas49ok
Signal Atlas45ok
RansomLook26ok
RSS23ok
ransomware.live22ok
signal:ioc-family12ok
AlienVault OTX11ok
signal:kev4ok
CISA KEV4ok

Get it in your inbox. Every morning. Probably.

Four KEV additions in one batch, and two of them are designed to be used together

Cisco's email gateway is being attacked by email, which is at least thematically consistent

Seven leak sites fired at once on Tuesday, and lockbit5 posted four victims in three minutes

Six days, a public model, and a full Chrome chain: the discovery side has quietly stopped being the hard part

Patch Tuesday was the largest ever, and nobody can agree on how large

A billion phishing messages, 187 laptops and one arrest in a village: the takedown day

Someone turned the fridges up to 50°C in hundreds of French supermarkets, and the bugs were known a year ago

An $86 million crypto heist traced to a circuit board hidden under the screen

Ivanti went from one zero-day to an incompletely patched chain in under two hours of reporting

The KEV additions arrived as one batch and both KEV feeds then stopped

Ransomware.live usually gets there first, by hours

thegentlemen burst on Monday then stopped at the same minute as the KEV feeds

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

The most determined visitor

Same DNA, different addresses

Trying CVE-2017-9841 on us

The strangest shopping list

In a hurry

Somebody we might know

Get it in your inbox. Every morning. Probably.

Sources this morning