A Daily Field Report on Things That Are Probably Fine
No. 23·Tuesday 20 October 2026·Published 06:00 UK·Fine Meter 3/5: Not entirely fine
Lead · Supply chain
The backup was the way in: ConnectWise suspends Cloud Backup after confirming an intrusion, and researchers say its credentials opened Microsoft 365 tenants
The thing you keep in case of disaster has become the disaster's front door, and the vendor says customer impact is unconfirmed, which is not the same word as unaffected.
confidence0.80
On Friday ConnectWise said it was investigating 'attempts of unauthorized access associated with the ConnectWise Cloud Backup environment'. On Saturday it confirmed the access. By Monday the cloud services were suspended, and they remain unavailable while the company carries out what it calls remediation and security validation, which is a calm way of saying that someone is reading logs they had hoped never to read.
For everyone downstream, the important sentence comes from researchers, not the vendor: attackers authenticated into Microsoft 365 tenants using ConnectWise credentials. ConnectWise says customer impact remains unconfirmed. Both statements can be true at once, and that is how most Mondays go. One outlet already calls it a supply chain attack, and the coverage is written with downstream MSPs in mind, because an MSP tool is a key ring. A key ring does not fail one door at a time.
A backup is a second copy of the company that exists so the first one can die. We give it the widest read access in the estate and the least supervision, on the theory that it only reads. This is a category error: anything that can read everything is the estate, seen from the attacker's chair. The work this week is unglamorous. List every credential and app consent that ConnectWise holds in your tenants, rotate what you can, and read the sign-in logs for those identities before someone else reads them out to you in a report.
Why it mattersIf you or your MSP use ConnectWise Cloud Backup, treat its Microsoft 365 credentials as exposed until shown otherwise and check the tenant sign-in logs today.
The backup is the only complete copy of the company that nobody watches, which is why it is the copy the attacker reads first.
— Sturgeon’s Revelations · Probably Fine Daily No. 23
Every morning06:00 UK
Get it in your inbox. Every morning. Probably.
One email a day. The whole paper. Unsubscribe in one click.
§2
Top stories
The rest of the last 24 hours, with receipts.
Vulnerabilities
Plex2Shell exploited a day after the proof of concept, against a patch that shipped on 3 August
Four chained flaws in Plex Media Server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, one rated CVSS 8.6) give unauthenticated remote code execution. An SSRF in /player/timeline yields an admin token, and an ELF binary is then dropped in the Codecs directory. The fix shipped in 1.43.3.10861 on 3 August. Exploitation began a day after the 16 October proof of concept and delivers the XMRig miner and a Linux reverse-proxy backdoor named, with admirable candour, 'myawesomeproxy'. On the same day F5 shipped out-of-band NGINX patches, including three critical code-execution flaws; Drupal warned of fast exploitation risk for a critical core RCE; a researcher showed that Broadcom's Wi-Fi setup software, still unpatched, gives root on routers to anyone within radio range; and an exploited Fortinet bug was linked to a stealthy FortiGate implant in a telecom compromise.
Why it mattersFor Plex the vulnerable window is the gap between the August patch and your reboot, the miners have found it, and the NGINX and Drupal fixes belong in the same queue this week.
Rank Math PRO and AOMEI: malware came through the vendors' own official download and update channels
Copies of Rank Math PRO, the paid WordPress SEO plugin, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on 15 October and 07:12 UTC on 16 October carried malware that planted a self-restoring backdoor. SecurityWeek names version 3.0.123. Separately, attackers reportedly compromised AOMEI's servers and used a built-in promotional feature of its backup software to distribute malware. They tampered with configuration files briefly and then restored them to the originals to hide what they had done. And the GhostAction operator has gone from injecting malicious GitHub Actions workflows to phishing open-source developers, planting a credential stealer disguised as a font in 94 GitHub repositories.
Why it mattersIf you installed or updated Rank Math PRO in that window, treat the site as backdoored rather than updated: reinstalling over a self-restoring implant just lets it come back.
Ahold Delhaize confirms 'malicious actions' took systems offline across most of its US and European brands; Bullhorn pulls its staffing platform
Ahold Delhaize says a cyberattack forced it to take IT systems, including websites and apps, offline across most of its US and European brands. Its stores remain open, and the company says its investigation has so far found no evidence that sensitive customer data was involved. No group has claimed the attack on the leak sites we track. Separately, the staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage.
Why it mattersAn outage nobody has claimed is the uncomfortable middle of an incident. Expect either a leak-site listing or a statement about data, and if Ahold Delhaize or Bullhorn is your supplier, start those conversations now.
N0n posts a batch that includes three nameless 'Company #' entries; Qilin lists victims across seven countries
N0n's leak site posted a batch: Amagi Media Labs, Finzly Corp, The Akeeli Group, Kingwood Endoscopy, Hotel DuPont, Froggys Fog and Vormittag Associates, an ERP software and hosting company, plus three entries listed only as Company #92, #93 and #94 and marked PENDING EXPOSURE. Ransomlook recorded eight of them in the same minute, which looks more like a script running than a crime wave. Qilin posted CREDIN, Salauno and Grupo Cronica within three minutes, then Dental Team FL, Johnson & Pace, SkyWorld Air Cargo and WalkingTree Technologies about an hour later, and then Toyota Canarias and GardaWorld, across Portugal, Mexico, Argentina, the US, the UK, the UAE and India. Maureen's footnote: the aggregators cannot agree what CREDIN does. One files it under Financial Services, the other under Food & Beverage.
Why it mattersVormittag customers should assume their ERP host's network is now in someone's catalogue. For several N0n victims the claimed data is configuration files and access secrets, which makes this a credential rotation job before it is a disclosure job.
confidence0.75
Ransomware
One Latham & Watkins listing, two claimed authors; Baker Donelson listed with 355 GB
Ransomware.live credits a Latham & Watkins listing to SilentRansomGroup. Four minutes later, ransomlook credits the identical, truncated text to an actor called 'leakeddata'. That is a rebrand, a repost or an aggregator mapping error, and today's data cannot tell us which. Separately, a group called redact listed Baker Donelson, describing it as a law firm and claiming 355 GB across 102,390 files.
Why it mattersLaw firms hold everyone else's secrets by design. If you share privileged material with outside counsel, find out this week what they hold and how quickly they would tell you.
Someone is shopping for your AI keys: the OpenCode breach, npm bait offering free Claude credits, and a scanner asking our servers for /.env.anthropic
OpenCode says an intruder reached a legacy system on the night of 16 October and may have exposed the OpenAI, Anthropic and Google keys that users had saved in OpenCode Console, its optional hosted service. It has notified a small number of users. A fake Web3 accelerator is pushing malicious npm packages that offer free Claude and Gemini credits, deliver information stealers and backdoors to Windows and macOS, and hijack AI agent traffic. Meanwhile MITRE's ATT&CK v20 now catalogues AI abuse alongside MFA bypass, with 15 new detection strategies backed by 38 analytics.
Why it mattersModel API keys are now cloud credentials with a bill attached: rotate anything saved in OpenCode Console, and keep .env files out of anything a web server will serve.
ClickFix now arrives with a genuine Siemens signature, and it still works for the same dull reason
Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs through ClickFix lures. On Mastodon, da_667 explained plainly why it works: users have PowerShell and the Run prompt, which almost none of them need. The responsibility for closing those routes lies with the company that left them open, not with the user who followed a convincing fake Cloudflare prompt.
Why it mattersRemove the Run dialog and PowerShell from users who do not need them. A signature proves who built the binary, not who put the DLL next to it.
Federal investigators suspect a ransom negotiator ran the ShinyHunters extortion site
KrebsOnSecurity reports that US federal investigators pursuing ShinyHunters, the group that recently stole highly sensitive data from the FBI, have identified executives at two ransomware negotiation firms who had unusually close relations with the extortion group. The headline says investigators suspect a negotiator ran the group's extortion site. This is a single report, sourced to people close to the investigation.
Why it mattersIf your incident plan names a negotiation firm, ask this week what due diligence you did on them and what they will be able to see.
The daily deep read: what is under the feeds, not on top of them.
Beneath the volume: three actors posting in batches, two aggregators that disagree with each other, and a week of supply-chain incidents that may or may not be a single story
Exception 01
N0n's posting looks like one scripted bulk publication, placeholders included
N0n has 34 actor-tagged items on 19 October, against a median of 2 on other days. Ransomlook mirrored the listings within the same minute, and three entries are 'Company #92/#93/#94' PENDING EXPOSURE placeholders. That looks like one scripted publication rather than separate intrusions announced in sequence. One named victim, Vormittag Associates, is an ERP and hosting vendor, which puts its customers at risk too.
confidence0.60
Wrong if
The listings turn out to have been posted hours apart on the actor's own site, and the same-minute mirror time reflects only ransomlook's scrape.
Watch
Whether the three placeholders become named victims within 72 hours, and whether any Vormittag customers disclose breaches.
Exception 02
ConnectWise sits in the same window as Rank Math, AOMEI and Bullhorn, with no shown link
ConnectWise confirmed unauthorised access to Cloud Backup and suspended cloud services, and researchers report Microsoft 365 tenants accessed with ConnectWise credentials. The Rank Math PRO, AOMEI and Bullhorn incidents fall in the same window. No link between them has been shown, so this is shared timing, not a campaign.
confidence0.55Speculative
Wrong if
ConnectWise's investigation finds the Microsoft 365 access unrelated or confined to its own tenants, and the other vendor incidents turn out to have independent causes.
Watch
ConnectWise advisories, disclosures by MSP customers, and any ransomware claims that name MSP clients.
Qilin's volume is real; the aggregators' sector labels are not
Qilin is the only actor visible in all four ransomware sources (38 items). It posted in two batches roughly an hour apart. The aggregators disagree on sector labels: CREDIN is 'Food & Beverage' on ransomlook and 'Financial Services' on ransomware.live. The count is reliable; the victim metadata is not.
confidence0.65
Wrong if
The batch times turn out to be scrape artefacts, or Qilin's counts on earlier days were similar.
Watch
Confirmation from GardaWorld, and whether Qilin repeats the batch rhythm tomorrow.
Latham & Watkins attributed to two different actors
Ransomware.live credits SilentRansomGroup and ransomlook credits 'leakeddata' with identical, truncated text, so this is a rebrand, a repost or a mapping error. Separately, 'redact' leaked Baker Donelson in the same sector. Law firms as a target set is plausible, but the actors are probably different groups.
confidence0.50Speculative
Wrong if
The leak-site entry itself shows a single named actor, or 'leakeddata' turns out to be a known alias of SilentRansomGroup.
Watch
A corrected actor name on either aggregator, or a comment from the firm.
Plex2Shell: exploitation a day after the PoC, with a patch gap of about two and a half months
Exploitation started about a day after the 16 October PoC, against a patch released on 3 August, so the story is the unpatched window. Taken with the NGINX, Drupal and FortiGate items, it shows already-patched bugs being turned into weapons quickly.
confidence0.55
Wrong if
The PoC or the first exploitation predates 16 October, or telemetry shows little real scanning.
Watch
Exploitation counts for Plex and NGINX, and any KEV additions.
AI API keys as a target, by theme rather than by coordination
The OpenCode Console breach and the fake accelerator's npm packages both go after AI API keys and agent traffic. This is a shared theme, not proven coordination.
confidence0.40Speculative
Wrong if
The two incidents show no shared infrastructure or actors, and OpenCode confirms no keys were exposed.
Watch
OpenCode's disclosure of impact and its advice on key rotation.
Nothing to seeMost of the cross-source overlap on actors is aggregators mirroring each other, and lead-lag times of hours mostly reflect scrape schedules. The Atlas stories are templated repeats; the 77-item hour at 17:00 on 19 October is a batch artefact, not an event; the Mirai and Mozi IOC batches look like feed ingestion. The geopolitical Atlas items (seismic sequences and 'compound crises') show no cyber link. N0n's 'healthcare escalation' is not supported by this window's victims. No new CISA KEV entry appears in this window.
Deep read: 282 items read
§4
Forecast
Dated, falsifiable calls. We mark our own homework in public.
Today’s calls
DueCallConfidence
DueTue 27 Oct7d
At least one of N0n's placeholder listings (Company #92, #93 or #94) will reappear under a real organisation name on ransomware.live or ransomlook by 27 October 2026.
Wrong ifOn 27 October all three entries are still unnamed placeholders, or have been removed without being named.
f-2026-10-20-1
Confidence0.45
DueFri 30 Oct10d
A ransomware or extortion group will claim Ahold Delhaize on a leak site tracked by ransomware.live or ransomlook by 30 October 2026.
Wrong ifBy 30 October neither aggregator has a listing that names Ahold Delhaize or one of its brands.
No official T-Mobile breach notification or verified data sample corroborating BYOD's claim appears in these feeds.
Called Fri 9 Oct · due Fri 16 Oct
No T-Mobile notification, filing or data sample appears in any item through 20 Oct, past the 16 Oct due date.
wrong
SonicWall CVE-2026-102255 is added to the CISA KEV catalogue.
Called Sat 10 Oct · due Tue 20 Oct
No KEV item for CVE-2026-102255 appears in today's feed, and the call is due today.
wrong
At least one of N0n's named maritime victims has data published or its listing state changed on ransomware.live or ransomlook on or after the 2026-10-19 13:27 UTC deadline.
Called Tue 13 Oct · due Tue 20 Oct
After the 19 Oct deadline, the N0n listings that changed (Amagi, Finzly, Akeeli, Kingwood, Hotel DuPont, Froggys Fog) are not maritime. No named maritime victim shows a change.
open
None of KFC, MoneyGram, Confluent, BigID or Placer AI publicly confirms a breach in these feeds by 18 October.
Called Tue 13 Oct · due Sun 18 Oct
No item shows KFC, MoneyGram, Confluent, BigID or Placer AI confirming a breach by 18 Oct.
partly
ConnectWise or Microsoft publishes a further public update on the Cloud Backup / SkyKick incident — revised tenant numbers, scope of data access, or customer guidance — by 26 October.
Called Mon 19 Oct · due Mon 26 Oct
ConnectWise suspended cloud services and said customer impact is unconfirmed, which is new guidance. No revised tenant numbers or Microsoft statement is shown, and the 19 Oct items may predate the call.
A leak-site entry with a number where the name should be (see Company #92, #93 and #94), meaning negotiations are ongoing. It differs from the corporate version, 'we are investigating', mainly in being honest about what is going on.
§5
From our edge
Live attacks on our own servers in the last 24 hours. Yes, really ours.
In the last 24 hours our sensor profiled 76 hostile sources (44 scanners, 27 bot crawlers, 3 targeted operators and 1 brute forcer), which sent 14,937 requests between them. Of these, 16 went past reconnaissance into exploitation attempts, and 11 groups of addresses shared a behavioural fingerprint, which suggests one tool or one operator rotating addresses. The most hostile visitor, at 7.7 out of 10, took 20 requests to work through WordPress login paths to credential access. One scanner asked for /.env.anthropic by name, as if model keys were now just another item on the shopping list. Another fired 112 requests in about 0.4 seconds, and three addresses were still spraying CVE-2024-4577 at /index.php, a known exploit that comes in like the tide whatever the patch notes say about the year. Raw logs never left the server; only these findings did.
76hostile sources profiled
14,937requests from them
16reached exploitation
11shared-DNA clusters
7.7/10top hostility
5,983addresses at our edge
1,549first seen today
82countries
The WTF list
WTF #1
Looking for your AI keys
195.178.110.242, a scanner (hostility 5.9/10), sent 1,093 requests to 3 of our sites, probing for /.docker/config.json, /.env, /.docker/.env, /.aws/.env.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownMon 19 Oct, 11:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA 50ac33006ee2
WTF #2
The most determined visitor
139.28.219.70, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
3 addresses sent 3 requests shaped like CVE-2024-4577 exploitation (/index.php), including 130.49.79.188, 185.177.72.7, 2a0f:ca80:b00b:f814::5.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
probe family: webshell
WTF #4
Same DNA, different addresses
34.94.192.5, a scanner (hostility 6.3/10), sent 277 requests at 267 a minute to one of our sites, probing for /.git/config, /.env, /.env.local, /.env.production.
Why it’s weird7 IPs share one behavioural fingerprint (DNA dfef4501b216): one tool or one operator rotating addresses: 34.94.192.5, 34.65.60.252, 143.198.88.218, 20.211.97.120, 146.70.194.236 and more.
attribution: unknownMon 19 Oct, 11:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA dfef4501b216
WTF #5
The strangest shopping list
119.59.116.39, a targeted operator (hostility 6.4/10), sent 128 requests, probing for /phpMyAdmin5/index.php, /phpmyadmin_/index.php, /db/webdb/index.php, /__phpmyadmin/index.php.
Why it’s weirdAsked for files almost nobody else asks for: /phpMyAdmin5/index.php, /phpmyadmin_/index.php, /db/webdb/index.php, /__phpmyadmin/index.php, /sql/phpmyadmin5/index.php.
attribution: unknownTue 20 Oct, 03:00 UTC
Detail
kill chain: reconnaissance → weaponization → exploitation · DNA 6e70267a94d8
WTF #6
In a hurry
34.14.99.143, a scanner (hostility 5.5/10), sent 112 requests to one of our sites, probing for /.env, /backend/.env, /.git/config, /.git/logs/HEAD.
Why it’s weirdFired 112 requests in about 0.4 seconds.
attribution: unknownTue 20 Oct, 03:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
One email a day. The whole paper. Unsubscribe in one click.
§7
Colophon
How this edition was made, plainly.
Edition 23 was made by machine and checked by code. Every item published by 8 public threat feeds in the 24 hours to 05:05 UK (282 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.00. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.
282items read
24hour window
$0.00cost of this edition
04:05 UTCgenerated
Sources this morning
Signal Atlas107ok
Security news39ok
infosec.exchange36ok
RansomLook30ok
atlas30ok
ransomware.live26ok
RSS10ok
signal:ioc-family4ok
ITEMS READ: 282|SOURCES: 8|STORIES DROPPED FOR LACK OF RECEIPTS: 0|COST: $0.00|STATUS: NOT ENTIRELY FINE
OWNER: the machine|EDITOR: the rules|CALLS OPEN: 3|NEXT REVIEW: tomorrow 06:00 UK