Lead · Vulnerabilities

Four edge products were exploited yesterday. The catalogue gained one entry, and it was none of them

Cisco, Palo Alto, Ivanti and Collabora all reported real-world exploitation in the same window, while CISA's Known Exploited list added an Atlassian file-exposure bug with an EPSS of 0.02777.

confidence 0.88

Cisco warned that unauthenticated remote attackers can write arbitrary files to the operating system of Secure Email Gateway and execute commands with root privileges, and that it is being exploited. Palo Alto Networks shipped a fix for CVE-2026-0322, CVSS 8.6, a remote code execution flaw in the PAN-OS management interface, described by one report as an exploited zero-day and by another as authenticated and confined to the management plane, with the vendor saying it is aware of limited exploitation and publishing IoCs. Ivanti released emergency updates after attackers chained three Connect Secure zero-days, tracked around CVE-2026-104935, to reach root without authenticating. And threat actors are backdooring Nextcloud servers through CVE-2026-110447 in the Collabora Online built-in CODE Server app.

Against that, the Known Exploited Vulnerabilities catalogue added exactly one thing: CVE-2026-21589, a files-or-directories-accessible-to-external-parties flaw across Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye Data Center, carrying an EPSS of 0.02777. That is not a criticism of the catalogue. The catalogue is a record of evidence that has survived a process, and processes have a speed. It is a criticism of using it as your only clock, because by the time a thing is written down it has been true for a while, and the part of your estate that was exposed was exposed the whole time.

The honest ordering for this morning: anything of yours with a management interface answering the open internet, then the Nextcloud boxes, then Atlassian. A management interface on the public internet is a bedroom door with a doorbell on it. While you are in there, Drupal fixed a critical Field UI flaw on 14 October in 11.4.10, 11.3.19 and 10.6.19, Next.js shipped an out-of-band patch the same day for two critical unauthenticated RCEs, and NGINX released 1.30.6 and 1.31.7 for five issues, one of which has been present in every release since May 2005. Twenty-one years is not a vulnerability window. It is a tenancy.

Why it mattersPatch order today is exploitation evidence first, catalogue second: edge appliances with exposed management planes, then Nextcloud/Collabora, then Atlassian Data Center.

Receipts

Today’s revelation

A vulnerability becomes "actively exploited" on the day somebody finishes the paperwork. It became exploited considerably earlier, and nobody sent a calendar invite.

— Sturgeon’s Revelations · Probably Fine Daily No. 19

§2

Top stories

The rest of the last 24 hours, with receipts.

Threat actors

The ad loaded. That was the whole attack

Citizen Lab says devices at Al Jazeera were infected with Candiru spyware delivered through ordinary targeted online advertisements, a technique the researchers call AdFection and describe as the first public confirmation of zero-click mercenary spyware delivered by ads. No click, no user action: the hidden code ran the moment the ad loaded, and in some cases the ad rendered off-screen in the background. OTX carried the report roughly an hour and a half before the news feeds picked it up, and Mastodon then did what Mastodon does.

Why it mattersIf an ad impression is an execution primitive, ad-blocking stops being a preference question and starts being a control with a threat model behind it.

confidence 0.80

Receipts

Ransomware

Seventy-seven leak-site items in one hour is not a crime wave, it is a cron job

Of 514 items in the window, 259 fell on 15 October and 77 in the 22:00 hour alone, against a mean of 10.1 items per hour, with Qilin accounting for 47 items in the day, N0n 28, Akira 17 and LockBit5 17 against medians near zero. The victims are real enough — Qilin listed Brame Telecom, Commune Du Tampon, Chattanooga Shooting Supplies, HyperGen and Hocon Gas inside three minutes, Akira listed Sun Valley Dairy, Videk and an Arizona law firm, LockBit5 listed five organisations in seven minutes — but the clock is the posting script's, not the intrusions'. And the two trackers are not two witnesses: ransomware.live precedes ransomlook by one to five hours on almost every shared entity, so four sources on Qilin is really one leak site, scraped twice, then signalled.

Why it mattersCount victims, not posts, and treat a burst as a release schedule until a second, genuinely independent source says otherwise.

confidence 0.75

Receipts

Ransomware

Seven organisations listed in about four minutes, all of it tagged Salesforce

Between 15:31 and 15:35 an outfit calling itself 'the seven deadly sins' posted seven listings with countdowns of 60 and 72 hours: Canva at 200M+ rows and 2M+ Salesforce CRM records, iHeartJane at 19M+ with Case/Contact/Account data, Harness at 2.5M+ leads and contacts, Verano at 2.4M+ including loyalty and invoice history, Globeia at 920K+, Cradlewise at 3.2M+ and Hospital Sírio-Libanês at 3.5M+. The claims are unverified, the write-ups read like pitch decks, down to 'Company value ~$40B val', and the victim mix does not sit comfortably behind one connected-app compromise — which means either several routes in, or inflation. The countdowns land around 18-19 October, which is when we find out which.

Why it mattersIf you run Salesforce, today is the day to inventory connected apps, integration users and API tokens rather than wait for the timer.

confidence 0.60

Threat actors

Roughly 700 French supermarkets, unpatched fridge controllers, and nobody has claimed it

The refrigeration attack on French retail has widened to Copeland and Dixell controllers, with roughly 700 stores affected and no group claiming responsibility. A companion report puts the loss at hundreds of stores and millions of euros, and places the cause squarely on outdated OT firmware managed by third parties. That is the whole modern pattern in one sentence: the asset is yours, the firmware is somebody's contract, and the patch is nobody's Tuesday.

Why it mattersAsk your facilities and managed-service providers today, in writing, which controller firmware they run and when it was last updated.

confidence 0.65

Receipts

Policy

The Legal Aid Agency breach did not get bigger. It got older

The Legal Aid Agency, an executive agency of the Ministry of Justice, says attackers who breached its systems in April 2025 took records dating back to 1978, after a forensic review widened the previously disclosed scope. A second account states most of the data concerns applications, claims and payments submitted between 2007 and 2025, so the two figures have not yet been reconciled in public. The first report ran roughly six hours ahead of the main security press, which tells you something about where disclosure actually surfaces.

Why it mattersScope statements move for eighteen months after an incident; treat the first number as provisional and plan notification capacity for the later one.

confidence 0.70

Receipts

AI & security

The agents did substantial parts of an attack, and the scanners now want your model keys

Researchers report the first confirmed incident in which large language model-driven agents executed substantial portions of an attack, going from an exposed job-submission endpoint to full server takeover within 24 hours, while the Aoki infostealer has added credentials for Claude, OpenAI's Codex, Cursor, Codeium and Gemini to its collection list. Our own edge saw the same shift in miniature overnight: one scanner sent 442 requests hunting /.env, /.env.local and /.env.development, with /gemini.env in the same sweep. The counterweight is worth keeping: one analysis argues AI is dumbing attacks down and that serious actors are barely touching it, and ANY.RUN linked 1,258 public sandbox analyses to campaigns merely impersonating AI products between April and October 2026. Both things are true, which is the uncomfortable bit.

Why it mattersModel API keys belong in the same inventory, rotation schedule and alerting as cloud credentials, starting with whatever is in your repositories.

confidence 0.70

Receipts

Malware & IOCs

A firewall-shaped domain hosting dozens of Vidar C2 paths, and poisoned Arch helpers

ThreatFox ingested dozens of Vidar command-and-control URLs in roughly a minute, spread across the ih., yk. and ti. subdomains of 888-fw.com with short per-campaign path slugs such as /wu, /m42 and /q1d. The same batch carried six Sliver listeners on port 31337 and a Cobalt Strike C2 on 44.214.239.245:443, which is the long-running joke that defaults are forever. Separately, a threat actor uploaded malicious packages to the Arch User Repository impersonating the popular helpers yay and paru, pushing malware that runs with root privileges.

Why it mattersBlock the 888-fw.com subdomains and the listed C2 addresses today, and check which of your engineers installed an AUR helper this week.

confidence 0.70

Receipts

1ThreatFoxSliver IOC: 64.227.97.214:31337 (ip:port) — Indicat…

Oddities

The leak site that could not identify its own victim

The actor iah6477 posted a victim called 'hensley' with an AI-generated description reading, in full sincerity, that the name alone is not sufficient to identify a specific company because multiple businesses operate under it; another of its listings tags camden-living as GB while describing a United States real estate firm; and the same crew appears on the other tracker as iah647. Extortion has reached the stage of outsourcing its victim research to a model that hedges. Elsewhere in the strange column, a kernel flaw allowing code inside a virtual machine to read host memory has been given the number CVE-2026-99999, nicknamed PwnEscape, demonstrated against Vercel's live cloud sandboxes and confirmed by Vercel.

Why it mattersActor names, country tags and victim blurbs from leak-site trackers are generated content; verify before any of it reaches a customer notification.

confidence 0.60

Receipts

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

Under the feeds: one leak site scraped twice and counted four times, one genuine three-source story, and a batch window that explains most of yesterday's 'surge'.

Exception 01
The two ransomware trackers are one witness
For almost every shared entity ransomware.live appears one to five hours before ransomlook, and sometimes ten to twenty-four hours before Atlas, so multi-source counts on actors such as Qilin are inflated by scraping the same leak sites rather than by corroboration.
confidence 0.80
Wrong if
Ransomlook items carry earlier first-seen timestamps for the same leaks, or cite independent source material.
Watch
Whether the ordering holds in later windows; if it does, use ransomware.live as the earliest signal and discount the rest.
Receipts
1. 1ransomware.liveqilin claimed Brame Telecom (Technology · BR) — N/A
2. 2RansomLookqilin leaked Brame Telecom — Business Services
Exception 02
The 22:00 hour did the heavy lifting
259 of 514 items fell on 15 October and 77 in the single 22:00 hour against a mean of 10.1 per hour, with Qilin, Akira, LockBit5, N0n, Interlock and incransom all represented, which points to batch posting rather than a genuine change in operational tempo.
confidence 0.60Speculative
Wrong if
Per-actor daily counts stay elevated across 16-18 October instead of returning to baseline.
Watch
Daily counts per actor for the next three days, and whether Atlas keeps labelling the same actors escalating and cooling simultaneously.
Receipts
1. 1Security newsSecTor 2026 Reveals a Rapidly Shifting Cybersecurit…
2. 2RansomLookqilin leaked Telcoe Federal Credit Union — Banking
Exception 03
N0n is running anonymised listings with supply-chain flavour
N0n posted roughly eight 'Company #NN' entries in fifteen hours marked PENDING EXPOSURE, including a software quality assurance firm tied to a Wolters Kluwer/CCH Axcess test environment and a smart-building and surveillance integrator whose listing claims every client site, device, user and credential, which implies downstream exposure well beyond the named victim.
confidence 0.55Speculative
Wrong if
The timers expire with no de-anonymisation, or the named environments turn out to be unrelated test data.
Watch
De-anonymisation when the PENDING EXPOSURE timers expire, and any statement from the integrator's clients.
Exception 04
The PAN-OS label does not agree with itself
One report presents the PAN-OS flaw as an exploited zero-day enabling remote code execution; another describes CVE-2026-0322, CVSS 8.6, as remote code execution in the management interface under active exploitation. Your real exposure turns on whether that interface answers from the internet.
confidence 0.55
Wrong if
Palo Alto confirms in-the-wild exploitation of an unauthenticated path, or clarifies the authentication requirement.
Watch
KEV additions for PAN-OS, Cisco Secure Email Gateway and Ivanti Connect Secure over the next three days.
Receipts
Exception 05
Tracker metadata is generated, not observed
The same actor appears as iah6477 and iah647 on two trackers, victim blurbs are marked AI generated and contradict their own country tags, and Atlas assigns N0n to CA and thegentlemen to AG, BZ, TH, TW and FI, so geography and counts from these sources should be discounted.
confidence 0.65
Wrong if
Victim-level checks confirm the tagged countries and the single actor identity.
Watch
Whether the aliases merge and whether Atlas country lists stabilise on later runs.
Receipts
1. 1RansomLookiah647 leaked alera — status: public | hosting: pre…

Nothing to seeThe Siemens and NVD volume is Patch Tuesday publication timing, not a campaign; the low-quality CVE clusters from the same disclosure mill carry no cross-source structure; the state-linked items (Silent Lynx, PEERSTITCH) and the phishing-kit disruptions showed up once each and stayed there. NVD going quiet after 14 October 23:22 is almost certainly ingestion batching rather than a real silence, and only one day of data was read, so nobody here is claiming a trend.

Deep read: 514 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueFri 23 Oct7 days
CISA KEV adds at least one of the PAN-OS (CVE-2026-0322), Ivanti Connect Secure (CVE-2026-104935 chain) or Cisco Secure Email Gateway flaws by 23 October.
Wrong ifKEV carries none of these three products in an entry dated on or before 23 October.
Receipts
f-2026-10-16-1
Confidence0.60
DueFri 23 Oct7 days
After the 60 and 72 hour countdowns expire on 18-19 October, at least one of the seven organisations listed by 'the seven deadly sins' will have data published on the leak site or issue a public statement, by 23 October.
Wrong ifAll seven listings remain in countdown or quietly disappear with no publication and no victim statement by 23 October.
f-2026-10-16-2
Confidence0.45
DueWed 21 Oct5 days
Qilin will not sustain yesterday's volume: at least one day between 17 and 21 October will show fewer than ten Qilin leak-site items on ransomware.live.
Wrong ifEvery day from 17 to 21 October records ten or more Qilin posts on ransomware.live.
Receipts
f-2026-10-16-3
Confidence0.75

Scorecard

2 right · 1 partly · 1 wrong · 2 open

wrong
Rejetto HFS CVE-2026-61500 picks up either an NVD record or a KEV listing in these feeds by 16 October.
Called Tue 6 Oct · due Fri 16 Oct
Due date is today (16 October) and no NVD record or KEV listing for CVE-2026-61500 appears in any of today's feed items.
right
CVE-2026-21589, the Atlassian Data Center flaw already under attack, is added to the CISA KEV catalogue.
Called Fri 9 Oct · due Mon 19 Oct
CISA KEV added CVE-2026-21589 on 15 October 2026, before the 19 October deadline.
Receipts
1. 1CISA KEVCVE-2026-21589 Atlassian Multiple Products: Atlassi…
open
No official T-Mobile breach notification or verified data sample corroborating BYOD's claim appears in these feeds.
Called Fri 9 Oct · due Fri 16 Oct
Due date is today (16 October) and no T-Mobile breach notification or verified data sample appears in today's feeds.
open
At least one of N0n's duplicated listings (Companies #19 to #23 or #25 to #29) is removed, merged or retagged on ransomware.live or ransomlook by 16 October.
Called Mon 12 Oct · due Fri 16 Oct
Due date is today (16 October); no items in today's feeds confirm removal/merge/retag of N0n's duplicate listings #19-#23 or #25-#29, but also no explicit confirmation all remain unchanged.
partly
Wallstreet posts at least three further Swedish victims to its leak site.
Called Wed 14 Oct · due Wed 21 Oct
One Wallstreet SE-tagged victim (TGM Manufacturing, US) posted but US-tagged, not Swedish; only one new entry visible; deadline 21 October not yet passed.
right
lockbit5 posts at least three further named victims to ransomware.live by 20 October 2026.
Called Thu 15 Oct · due Tue 20 Oct
lockbit5 posted at least 5 new named victims (grupoabg.com, neweramachines.com, lcww.com.eg, kidzrkooldental.com, torcivialaw.com) on ransomware.live on 15 October, meeting the threshold of three before the 20 October deadline.
Receipts

Glossary of terms you will be expected to nod at

Management interface (n.): The part of the appliance that is only reachable from the internal network, apart from the ones that are reachable from the internet, which is normally how we find out which sort we have.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge sensor profiled 86 hostile sources in the last 24 hours — 62 scanners, 18 bot crawlers, 5 targeted operators and 1 brute forcer — which between them sent 16,405 requests, with 18 going past reconnaissance into actual exploitation attempts and 6 groups of addresses sharing a behavioural fingerprint. Top hostility on the board was 8.5 out of 10; the most determined profiled visitor, 146.70.40.70 at 7.7, sent only 20 requests and still reached credential-access, which is a useful corrective to anyone ranking threats by volume. 45.138.12.185 sent 442 requests hunting environment files, /gemini.env among them; seventeen addresses shared DNA dfef4501b216 while chasing /.git/config and /.env.production; 92.118.39.126 fired 24 requests in about a tenth of a second; two hosts, 209.38.91.228 and 94.26.0.103, sprayed fifteen requests shaped like CVE-2017-9841 against phpunit paths, which is a nine-year-old exploit still earning its keep. Across the day, 2,807 addresses reached our edge from 90 countries and 993 of them were new to us. Raw logs never left the server; only these findings did.

86hostile sources profiled

16,405requests from them

18reached exploitation

6shared-DNA clusters

8.5/10top hostility

2,807addresses at our edge

993first seen today

90countries

The WTF list

WTF #1
Looking for your AI keys
45.138.12.185, a scanner (hostility 4.4/10), sent 442 requests to one of our sites, probing for /.env, /.env.local, /.env.development, /config.php.
Why it’s weirdWent straight for AI credentials: /gemini.env. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownFri 16 Oct, 00:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation · DNA f54b5889aafb
```
WTF #2
The most determined visitor
146.70.40.70, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
attribution: unknownFri 16 Oct, 00:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation → credential-access · DNA 82a939927b85
```
WTF #3
Trying CVE-2017-9841 on us
2 addresses sent 15 requests shaped like CVE-2017-9841 exploitation (/vendor/phpunit/phpunit/…), including 209.38.91.228, 94.26.0.103.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: phpunit-rce
```
WTF #4
Same DNA, different addresses
34.130.52.167, a scanner (hostility 6.3/10), sent 277 requests to one of our sites, probing for /.git/config, /.env, /.env.local, /.env.production.
Why it’s weird17 IPs share one behavioural fingerprint (DNA dfef4501b216): one tool or one operator rotating addresses: 20.197.26.190, 20.204.146.105, 151.240.45.25, 95.153.31.12, 167.172.90.23 and more.
attribution: unknownFri 16 Oct, 00:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA dfef4501b216
```
WTF #5
The strangest shopping list
20.214.147.109, a targeted operator (hostility 6.2/10), sent 113 requests to 2 of our sites, probing for /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /3PJcpMFsD8B.php, /z70.php.
Why it’s weirdAsked for files almost nobody else asks for: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /3PJcpMFsD8B.php, /z70.php, /1.php.
attribution: unknownFri 16 Oct, 00:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation · DNA 938595d2ae44
```
WTF #6
In a hurry
92.118.39.126, a scanner (hostility 6.2/10), sent 24 requests to one of our sites, probing for /dev/.git/config, /.git/HEAD, /admin/.git/config, /app/.git/config.
Why it’s weirdFired 24 requests in about 0.1 seconds.
attribution: unknownFri 16 Oct, 00:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 30414a1527be
```

§6

Ride-alongs

Free, live tools. No sign-up, no sales call.

§7

Colophon

How this edition was made, plainly.

Edition 19 was made by machine and checked by code. Every item published by 13 public threat feeds in the 24 hours to 05:05 UK (514 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.98. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

514items read

24hour window

$0.98cost of this edition

04:05 UTCgenerated

Sources this morning

NVD100ok
ThreatFox100ok
Signal Atlas81ok
Security news57ok
RansomLook54ok
infosec.exchange38ok
ransomware.live37ok
atlas18ok
AlienVault OTX10ok
RSS9ok
signal:ioc-family8ok
signal:kev1ok
CISA KEV1ok

Get it in your inbox. Every morning. Probably.

The ad loaded. That was the whole attack

Seventy-seven leak-site items in one hour is not a crime wave, it is a cron job

Seven organisations listed in about four minutes, all of it tagged Salesforce

Roughly 700 French supermarkets, unpatched fridge controllers, and nobody has claimed it

The Legal Aid Agency breach did not get bigger. It got older

The agents did substantial parts of an attack, and the scanners now want your model keys

A firewall-shaped domain hosting dozens of Vidar C2 paths, and poisoned Arch helpers

The leak site that could not identify its own victim

The two ransomware trackers are one witness

The 22:00 hour did the heavy lifting

N0n is running anonymised listings with supply-chain flavour

The PAN-OS label does not agree with itself

Tracker metadata is generated, not observed

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

Looking for your AI keys

The most determined visitor

Trying CVE-2017-9841 on us

Same DNA, different addresses

The strangest shopping list

In a hurry

Get it in your inbox. Every morning. Probably.

Sources this morning