Lead · Vulnerabilities

MFA did not fail on PAN-OS. It was never asked

Palo Alto says ransomware actors are still exploiting CVE-2026-0257, an authentication bypass patched in May, to stand up unauthorised VPN connections and get past multi-factor; Qilin and INC are named.

confidence 0.85

Multi-factor authentication is not a wall. It is a question, politely asked at a door, and CVE-2026-0257 is the trick of coming in through a part of the building where nobody is asking questions. Palo Alto Networks has disclosed that it continues to observe exploitation of the flaw — CVSS 7.8, an authentication bypass in PAN-OS and Prisma Access — by ransomware actors setting up unauthorised VPN connections. The relay of the report onto Mastodon puts it plainly: Qilin and INC, bypassing MFA, against a bug patched in May. Five months is not a grace period. It is a window with a curtain in front of it.

In the same window Qilin had the loudest day of any actor in the feeds: a nineteen-item burst on 19 October against a median of one on other days, with claims against Belcorp, CREDIN, Salauno, Grupo Cronica, Dental Team FL, Johnson & Pace, SkyWorld Air Cargo, WalkingTree Technologies, GardaWorld and Toyota Canarias, and leak-site mirrors following behind. INC claimed Seetelhotels.de and centralrogers.com across the same days. Nobody has shown that those victims were reached through the Palo Alto bug, and we are not going to pretend otherwise — but the vendor says the vector is live, and the actors named in the advisory are the actors filling the leak sites.

So today's work is dull and specific: confirm, by version string rather than by memory, that your PAN-OS and Prisma Access estate actually took the May fix, then go and look at VPN authentication records for sessions that arrived without anyone ever being prompted. The second half is the part people skip, because the first half is the part that produces a green tick. A patched appliance tells you about the future. The logs tell you about the five months you already had.

Why it mattersIf this is your edge, the compensating control you have been quoting to the board — MFA on the VPN — is the exact thing the exploit removes.

Receipts

Today’s revelation

A root of trust is not a mathematical fact. It is a statement about the worst morning somebody had during a key ceremony, preserved in your trust store for a decade.

— Sturgeon’s Revelations · Probably Fine Daily No. 24

§2

Top stories

The rest of the last 24 hours, with receipts.

Vulnerabilities

Eight CA keys were weak enough to recover, and four root programmes quietly stopped trusting them

Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found the private keys so weak that anyone could recover them almost instantly and forge trusted certificates for legitimate sites. Go shipped 1.27.3 and 1.26.10 on 20 October, making its verifier reject any chain passing through those eight intermediate keys, and Mozilla, Google's Chrome Root Program and Apple followed. How the keys came to be that weak is not established in any of today's reporting. One toot on the subject reads, in full, that certificate authorities have proved once again that they cannot be trusted to do anything, and nobody in the replies argued.

Why it mattersAnything that pins, verifies or builds with Go needs the new toolchain; everything else inherits the fix from a vendor and will not tell you it happened.

confidence 0.85

Receipts

Vulnerabilities

CISA added six KEV entries, and four of them are your media server

CISA added CVE-2026-96652, 96654, 96655 and 96656 in Plex Media Server on 20 October — two SSRFs, an encoded-URI-scheme flaw and an arbitrary file write, explicitly described as chainable — plus CVE-2026-110936 in Siemens Software Center and CVE-2026-106931, an OS command injection in EG Secure Solutions SiteGuard Server Edition that runs commands as root or SYSTEM. Exploitation of the Plex chain started a day after a proof of concept went public on 16 October, delivering an XMRig miner and a Linux reverse-proxy backdoor, against a fix that shipped in 1.43.3.10861 on 3 August. There is a description conflict worth noting: KEV frames parts of the chain as requiring an admin or authenticated user, while the public write-up circulating on Mastodon calls the end result unauthenticated RCE. The Siemens flaw is being used in ClickFix lures, pairing a genuine signed copy of Software Center with malicious DLLs.

Why it mattersTwo and a half months between patch and KEV means the exposed population is home and small-business boxes nobody has an asset register for.

confidence 0.90

Receipts

Malware & IOCs

Seven trusted update channels in one week, which is not a coincidence so much as a business model

A Microsoft 365 API credential belonging to ConnectWise Cloud Backup, formerly SkyKick, was compromised and used to authenticate into customer M365 tenants; ConnectWise suspended the service, reset accounts and replaced application credentials, and says customer impact is still unconfirmed. In the same days an attacker used a hijacked contributor's GitHub account to replace the download archives on five existing OVHcloud CLI releases with a secret-stealing build; Rank Math PRO downloads between 20:02 UTC on 15 October and 07:12 UTC on 16 October carried a self-restoring backdoor; stolen UpdraftCentral connection keys were used to backdoor WordPress sites; AOMEI's update infrastructure served a ShinyRoad downloader to users of software the vendor says has over 100 million users; and Zeabur is shutting down after an intruder used plaintext internal credentials to take 3.2 million environment-variable records and data on 321,810 accounts. OpenCode rounds it off: an intruder reached a legacy system on the night of 16 October and may have exposed users' saved OpenAI, Anthropic and Google API keys.

Why it mattersYour allow-list is a list of people whose credentials are now part of your attack surface; inventory which vendors hold tokens into your tenant, and rotate the ones that do.

confidence 0.90

Receipts

Ransomware

226 claims in seven days, and the fastest-growing group is posting network diagrams instead of ransom notes

The week's tempo count has 226 leak-site claims from 38 of the 130 groups tracked, with N0n surging to 51 claims against 20.74 expected from its own prior rate, iah6477 at 8 against 1.0, and Helix at 7 against 0.81. N0n's listings read unlike a normal encryption crew: network and device configuration files from a broadcast playout site, payment-infrastructure access secrets and cloud topology, ERP hosting administrator and remote-access credentials, and a run of anonymised placeholders — Company #92 through #98 — spanning South Korea, Switzerland, Trinidad and Tobago, Tunisia and Ethiopia. Elsewhere Booba Project posted seven victims in a day, including 295 GB attributed to the Research Foundation of The City University of New York, Redact listed Baker Donelson at 355 GB across 102,390 files, and the FBI with UK and German agencies called SafePay among the most active groups with more than 600 victims since 2024, getting in by guessing passwords, exploiting vulnerabilities and phishing.

Why it mattersA group that leads with credentials and topology rather than encryption is selling access and leverage, which means your detection window is before anything breaks, not after.

confidence 0.80

Receipts

1Ransomware tempo · Ninja Signal graphNinja Signal ransomware tempo for 2026-10-21. In th…

AI & security

An AI pen-test platform was pointed at 1,200 websites and simply got on with it

At least three threat actors have abused the AI platform Cairn for persistent access and financial theft, with one Chinese-speaking operator aiming autonomous agents at more than 1,200 company websites and reaching over 100 organisations, including John Deere, SharkNinja and Cummins; a researcher was able to watch because the operators left their control panels exposed on the internet. On the same two days NIST, CISA and the NSA published ten voluntary practices for preparing for, detecting, responding to and reporting rogue AI agent incidents, and Microsoft said companies should treat agents as insiders, granting access per task and tightening it as the agent's risk score rises. MITRE ATT&CK v20 landed in the window too, cataloguing AI abuse, MFA bypass and water utility attacks with 15 new detection strategies and 38 analytics.

Why it mattersThe attacker's agent is already in production; yours is in a pilot with a steering committee.

confidence 0.80

Receipts

Vulnerabilities

PHP is shipping emergency patches today because the details got out first

The PHP security team warned administrators on 20 October to prepare for emergency updates the following day — that is today — for two critical vulnerabilities, after information about the flaws reportedly leaked ahead of scheduled disclosure; a post circulating overnight names them as CVE-2026-109618 and CVE-2026-109619. Alongside that, a public proof-of-concept exploit is out for CVE-2026-106173, a critical path traversal in Fortinet FortiSIEM carrying CVSS 9.4 and allowing unauthenticated remote code execution; Drupal has warned of fast exploitation risk for a critical core RCE; F5 shipped out-of-band patches for three critical NGINX flaws; and a critical BeyondTrust Remote Support authentication bypass, CVE-2026-102764, is reported exploited in the wild.

Why it mattersDisclosure timing is now an attacker's planning input; if details leak before the fix, you are in an exploitation race you did not enter.

confidence 0.85

Receipts

Threat actors

The people you ring during an extortion may have been on first-name terms with the extortionists

KrebsOnSecurity reports that US federal investigators pursuing ShinyHunters, the group that recently stole highly sensitive data from the FBI, have identified executives at two separate ransomware negotiation firms who maintained unusually close relations with the extortion group, with one of them suspected of running an extortion site. It is a single-source story for now and the firms are not named in the item. It arrives in a week where Ahold Delhaize confirmed malicious actions forced systems offline across most of its US and European brands, with no group having claimed it.

Why it mattersDue diligence on your incident response panel is now a control, not a procurement formality — ask who owns the negotiator and who they have worked with.

confidence 0.50

Receipts

Oddities

WhatsApp's help pages told its own chatbot not to mention the regulator

WhatsApp's help pages carried hidden instructions for its support chatbot telling it not to recommend a data protection authority or regulator to users who could no longer delete their accounts — a position its own European privacy policy contradicts, since that policy tells users they can complain. Elsewhere in the week's filing cabinet of the unlikely: a former OpenAI worker accused of planting a secret recorder in a conference room was, prosecutors say, planning to fly to Saudi Arabia, and his family left the country the day after his arrest. And in the leak-site data, Global Secret Group's listing for Seminole Schools pairs a Florida domain with an Oklahoma school district website, which tells you roughly how much care goes into the victim records we all quote.

Why it mattersPrompt text in a help page is now policy, and nobody in governance is reviewing it.

confidence 0.75

Receipts

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

Under the feeds: one upstream observation wearing six costumes, and a root-programme disclosure that moved before the news did.

Exception 01
Go blocked the keys hours before eMudhra was named
Go's blocklist change landed on 20 October roughly three to five hours before news outlets attributed the eight keys to eMudhra, with the cyber-news stream leading RSS by 7.6 hours on the entity, and Mozilla, Google and Apple following. That sequencing looks like coordinated, quiet disclosure among root-programme operators rather than independent discovery. The root cause of the weak keys is still unknown.
confidence 0.70
Wrong if
Evidence that the Go release was unrelated to eMudhra, or that the keys were not weak.
Watch
Post-incident reports from eMudhra, Mozilla's bug tracker, and any actual misissuance evidence.
Receipts
Exception 02
Cross-source counts for ransomware actors are mostly one source, echoed
Ransomware.live precedes ransomlook on nearly every shared entity, by between 1 and 23.2 hours, and Atlas emitted a block of 'thegentlemen' stories at a single 17:18 timestamp on 19 October which signal:atlas then repeated 29.7 hours later. Breadth across sources is therefore a poor proxy for corroboration here, and the apparent six-source weight behind Qilin should be discounted accordingly.
confidence 0.70
Wrong if
Independent victim confirmations arriving in ransomlook before ransomware.live.
Watch
Whether the next Atlas recompute batches at 17:xx again.
Receipts
1. 1ransomware.liveqilin claimed Belcorp (Retail & E-Commerce · PE) —…
Exception 03
N0n looks scripted, and data-only
N0n has 34 items across three sources, posting at least eleven victims in about 24 hours and then leaking numbered placeholders Company #95 to #98 together, with listings that lead on network configurations, topology and access secrets rather than encryption. That pattern fits batch-style automation and an access-broker or data-extortion model more than a conventional ransomware operation. Some of the apparent volume overlaps an aggregator cluster of 38 items in the 17:00 UTC hour on 19 October.
confidence 0.50Speculative
Wrong if
Victims confirming encryption or operational disruption, or the numbered entries resolving to named victims on an ordinary cadence.
Watch
Whether the placeholders are de-anonymised and whether output stays above the 20.74 expected weekly rate.
Receipts
1. 1Ransomware tempo · Ninja Signal graphNinja Signal ransomware tempo for 2026-10-21. In th…
Exception 04
The supply-chain cluster shares a shape, not yet a campaign
ConnectWise, OVHcloud, Rank Math PRO, UpdraftCentral, AOMEI and Zeabur were all hit in the same few days, and the shared pattern is theft of credentials, keys and secrets from developer and administrative tooling rather than any single exploit. Whether it is one campaign is unproven; ConnectWise surfaced in OTX 3.3 hours before the news coverage, which fits indicator-first disclosure.
confidence 0.50Speculative
Wrong if
Distinct, unrelated root causes with no shared infrastructure or tooling across the incidents' indicators.
Watch
ConnectWise confirming customer impact, and any overlapping IOCs between the OVHcloud, Rank Math and Updraft incidents.
Receipts

Nothing to seeThe Mozi and Mirai indicator spikes at 04:06 are one feed breathing out, with no actor meaning attached. The Atlas 'compound crisis' stories for Taiwan, Russia, Colombia and Vanuatu have no supporting items anywhere in the window. The Swallowtail and APT28 reports are almost certainly two vendors naming the same Russian espionage activity, not a second campaign. The 250 GB AfD claim on Mastodon is unverified and stays out until someone shows their working. And the silences after 05:48 on 20 October in atlas, KEV and Qilin are scrape cadence, not quiet.

Deep read: 391 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueFri 23 Oct72h
PHP publishes fixes for the two critical flaws flagged on 20 October (reported as CVE-2026-109618 and CVE-2026-109619) by end of 23 October.
Wrong ifNo PHP release addressing those flaws by 23:59 UTC on 23 October.
Receipts
f-2026-10-21-1
Confidence0.85
DueWed 28 Oct7d
N0n posts at least ten further leak-site victims across ransomware.live or ransomlook by 28 October, including at least one previously numbered placeholder resolved to a named organisation.
Wrong ifFewer than ten new N0n listings, or no numbered placeholder de-anonymised, by 28 October.
Receipts
1. 1Ransomware tempo · Ninja Signal graphNinja Signal ransomware tempo for 2026-10-21. In th…
f-2026-10-21-2
Confidence0.60
DueWed 4 Nov14d
CISA adds the FortiSIEM path traversal CVE-2026-106173 to the KEV catalog by 4 November, following the public proof-of-concept.
Wrong ifCVE-2026-106173 absent from KEV on 4 November.
Receipts
1. 1Security newsCritical FortiSIEM Flaw Gets Public Exploit PoC for…
2. 2CISA KEVCVE-2026-96656 Plex Media Server: Plex Media Server…
f-2026-10-21-3
Confidence0.40

Scorecard

1 right · 4 open

open
No official T-Mobile breach notification or verified data sample corroborating BYOD's claim appears in these feeds.
Called Fri 9 Oct · due Fri 16 Oct
No T-Mobile item in today's feed either way; absence alone doesn't settle it.
open
CVE-2026-102255 (SonicWall SMA1000) is added to the CISA KEV catalogue.
Called Sun 11 Oct · due Wed 21 Oct
Today's KEV additions (SiteGuard, Plex x4, Siemens) don't include CVE-2026-102255, but the due date is today and the feed isn't complete.
Receipts
1. 1CISA KEVCVE-2026-106931 EG Secure Solutions SiteGuard Serve…
open
No confirmation of a breach at KFC, MoneyGram or Confluent appears in these feeds, leaving The Gentlemen's big-brand listings unverified.
Called Sun 11 Oct · due Wed 21 Oct
No KFC, MoneyGram or Confluent confirmation appears in today's items.
open
None of KFC, MoneyGram, Confluent, BigID or Placer AI publicly confirms a breach in these feeds by 18 October.
Called Tue 13 Oct · due Sun 18 Oct
No confirmation by any of the five appears in today's items, but absence doesn't settle a negative call.
right
CISA will add at least one of the Plex2Shell CVEs (CVE-2026-96652, -96654, -96655 or -96656) to the KEV catalogue by 3 November 2026.
Called Tue 20 Oct · due Tue 3 Nov
CISA KEV added all four Plex2Shell CVEs (96652, 96654, 96655, 96656) on 20 Oct, well before 3 Nov.
Receipts

Glossary of terms you will be expected to nod at

Intermediate CA (n.): A certificate authority that is not the root, which is how it comes to be a footnote in your trust store, a line in somebody's emergency release notes, and a thing you had no idea you were relying on until the day you were told to stop.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge, meanwhile, continued its impression of a very boring seaside town. In the last 24 hours the Adversary DNA sensor profiled 13 hostile sources — 8 scanners, 4 bot crawlers and 1 brute forcer — which between them sent 1,834 requests; two got past reconnaissance into exploitation attempts, and one behavioural fingerprint (DNA dfef4501b216) covered two different addresses, 178.211.139.240 and 20.207.202.183, which is one tool or one operator changing coats. The top scorer, 20.194.17.163 at 6.1 out of 10, fired 50 requests at 26 a minute asking for /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /wp-Iogin.php — note the capital I where the l should be — and /bdroot.php. Another, 94.26.106.162, asked for /.env, /.env.local, /.env.staging and /.env.development 82 times in about 1.7 seconds, which is either a tuning problem or genuine enthusiasm. And two addresses sent requests shaped like CVE-2015-2051 at /hnap1, because somewhere a D-Link router is still listening and hope springs eternal. Out of 6,862 addresses seen at our edge across 89 countries, 3,024 were new today. Raw logs never left the box.

13hostile sources profiled

1,834requests from them

2reached exploitation

1shared-DNA clusters

6.7/10top hostility

6,862addresses at our edge

3,024first seen today

89countries

The WTF list

WTF #1
The most determined visitor
20.194.17.163, a scanner (hostility 6.1/10), sent 50 requests at 26 a minute to one of our sites, probing for /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /wp-Iogin.php, /bdroot.php.
Why it’s weirdHighest hostility on the board; its kill chain reached weaponization.
attribution: unknownWed 21 Oct, 01:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA bccc30d19899
```
WTF #2
Same DNA, different addresses
20.207.202.183, a scanner (hostility 6.7/10), sent 16 requests to one of our sites, probing for /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /403.php, /aaa.php.
Why it’s weird2 IPs share one behavioural fingerprint (DNA dfef4501b216): one tool or one operator rotating addresses: 178.211.139.240, 20.207.202.183.
attribution: unknownWed 21 Oct, 01:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA dfef4501b216
```
WTF #3
Trying CVE-2015-2051 on us
2 addresses sent 2 requests shaped like CVE-2015-2051 exploitation (/hnap1), including 103.213.112.213, 223.123.43.62.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: dlink-hnap
```
WTF #4
The strangest shopping list
74.225.146.100, a scanner (hostility 5.9/10), sent 50 requests to one of our sites, probing for /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /wp-Iogin.php, /bdroot.php.
Why it’s weirdAsked for files almost nobody else asks for: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /wp-Iogin.php, /bdroot.php, /c.php.
attribution: unknownWed 21 Oct, 01:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA c67915f564de
```
WTF #5
In a hurry
94.26.106.162, a scanner (hostility 4.9/10), sent 82 requests to one of our sites, probing for /.env.development, /.env, /.env.staging, /.env.local.
Why it’s weirdFired 82 requests in about 1.7 seconds.
attribution: unknownWed 21 Oct, 01:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA ce6ecdfacbe3
```

§6

Tempo

Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.

226claims, 7 days

38of 130 groups active

N0n51 this week · surging

thegentlemen37 this week · surging

qilin29 this week

SurgingN0n — 51 claims in 7 days against 20.7 expected from its own prior rate (p < 0.001)
Surgingiah6477 — 8 claims in 7 days against 1.0 expected from its own prior rate (p < 0.001)
SurgingHelix — 7 claims in 7 days against 0.8 expected from its own prior rate (p < 0.001)
SurgingRedact — 3 claims in 7 days against 0.3 expected from its own prior rate (p = 0.004)
Surgingthegentlemen — 37 claims in 7 days against 25.3 expected from its own prior rate (p = 0.017)
SurgingBooba Project — 6 claims in 7 days against 2.1 expected from its own prior rate (p = 0.022)

Gone quiet: xpl0itrs (62 days), CRPxO (80 days), cmdorganization (82 days), ExfilSquad (87 days).

Sector pressure, 30 days

UpTransportation — 2.3× its own prior share (72 claims, 31 expected)
UpEducation — 1.9× its own prior share (47 claims, 25 expected)
UpHealthcare — 1.5× its own prior share (115 claims, 76 expected)
DownRetail & E-Commerce — 0.7× its own prior share (44 claims, 60 expected)

22% of claims carry no sector label.

Brand churn

Of the 79 leak-site brands first seen since 2026-06-01, 79% were still claiming 30 days after their first post and 79% were still claiming 60 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 19% of the 53 old enough to judge posted on one day and never again; 40% made at least half their claims in their first week. New brands this month: 10 — newest: Mimori (2026-10-20, 2 claims), THE SEVEN DEADLY SINS (2026-10-16, 8 claims), 0x00 (2026-10-15, 1 claim).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →

§7

Ride-alongs

Free, live tools. No sign-up, no sales call.

§8

Colophon

How this edition was made, plainly.

Edition 24 was made by machine and checked by code. Every item published by 12 public threat feeds in the 24 hours to 05:05 UK (391 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.72. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

391items read

24hour window

$0.72cost of this edition

04:05 UTCgenerated

Sources this morning

Security news82ok
infosec.exchange72ok
RansomLook56ok
ransomware.live55ok
Signal Atlas39ok
atlas33ok
RSS22ok
AlienVault OTX13ok
signal:kev6ok
CISA KEV6ok
signal:ioc-family6ok
Ransomware tempo · Ninja Signal graph1ok

Get it in your inbox. Every morning. Probably.

Eight CA keys were weak enough to recover, and four root programmes quietly stopped trusting them

CISA added six KEV entries, and four of them are your media server

Seven trusted update channels in one week, which is not a coincidence so much as a business model

226 claims in seven days, and the fastest-growing group is posting network diagrams instead of ransom notes

An AI pen-test platform was pointed at 1,200 websites and simply got on with it

PHP is shipping emergency patches today because the details got out first

The people you ring during an extortion may have been on first-name terms with the extortionists

WhatsApp's help pages told its own chatbot not to mention the regulator

Go blocked the keys hours before eMudhra was named

Cross-source counts for ransomware actors are mostly one source, echoed

N0n looks scripted, and data-only

The supply-chain cluster shares a shape, not yet a campaign

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

The most determined visitor

Same DNA, different addresses

Trying CVE-2015-2051 on us

The strangest shopping list

In a hurry

Get it in your inbox. Every morning. Probably.

Sources this morning