Lead · Vulnerabilities

CISA adds two exploited bugs, and one is the third Arista VeloCloud zero-day in four months

An orchestrator that has now been zero-dayed three times since summer is not having a run of bad luck; it is having a conversation with us.

confidence 0.90

CISA added CVE-2026-114625, a SQL injection in on-prem Arista VeloCloud Orchestrator, EPSS 0.00555, and CVE-2026-110447, an OS command injection in the Collabora Online built-in CODE Server as used within NextCloud, EPSS 0.01225. SecurityWeek, ten hours behind the catalogue, frames the Arista bug as the third VCO zero-day exploited in four months, a critical SQL injection that gets an attacker to privileged internal functionality and operator privileges.

There is a disagreement worth noticing before you write the ticket. The KEV entry says a remote attacker may reach privileged internal functionality and impact the VCO host; the OTX write-up says authenticated users with minimal privileges can escalate to superuser operator. Those are different threat models and only one of them lets you sleep, so assume the unkind one until Arista says otherwise. The Collabora entry, meanwhile, describes remote code execution that works when the CODE server isn't running, which is the most honest description of modern software I have read this month.

Three separate zero-days in the same orchestrator in four months is not a sequence of unrelated events, it is a load-bearing component being excavated by people with time. Chesterton's fence works both ways: somebody built that query path for a reason, and somebody else has now worked out what the reason was. Patch the orchestrator first. It manages everything else.

Why it mattersIf your SD-WAN controller is internet-reachable, it is the shortest path from one stolen low-privilege login to every branch you own.

Receipts

Today’s revelation

Three feeds agreeing is not corroboration. It is one feed with a hobby and two friends who repost it within ten hours.

— Sturgeon’s Revelations · Probably Fine Daily No. 27

§2

Top stories

The rest of the last 24 hours, with receipts.

Vulnerabilities

PHP2Shell: millions of attempts, no confirmed compromise, and now a second hole with no patch

CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2, leaked before their scheduled patch on 21 October, and the internet started throwing them around immediately: researchers tie the attempts to a Mirai variant called Potassium, demonstrate an ASLR bypass, and still report no confirmed successful compromise. The SANS handlers spent Thursday at raised Infocon and were back to Green on Friday, while a separate advisory piece warns that fixing this is not as simple as clicking Update. Two days after the emergency patches, PHP disclosed CVE-2026-115560, another route to running code on a web server, unpatched, affecting only unusually configured applications, which PHP considers an unlikely risk, and for which the team has published mitigations instead of a fix.

Why it mattersThe exploitation is noisy and currently unsuccessful, which is exactly the window in which you inventory your PHP builds and configurations rather than refreshing Twitter.

confidence 0.85

Receipts

Ransomware

Qilin posted a working day's worth of victims in about nine hours

Ninja Signal's tempo count has 195 leak-site claims in seven days from 41 of the 131 groups tracked, with SilentRansomGroup at 10 against 2.29 expected from its own prior rate and BrainCipher at 8 against 1.57, both at p < 0.001. Against that, Thursday's Qilin run stands out: 56 items on 23 October against a median of 1.5 on other days, with claimed victims in Italy, Mexico, Australia, Chile, Argentina, Turkey and Bangladesh, while LockBit5, N0n, Akira, Wallstreet and Orova all posted runs of their own on the same day. Before anyone builds a slide about coordinated escalation, note that ransomware.live consistently precedes ransomlook on the same victims by between 1.1 and 10.5 hours, so a lot of the apparent multi-source confirmation is one upstream observation wearing three coats.

Why it mattersBatch posting usually means affiliate throughput, not a new capability; count distinct victims, not distinct feed entries, before you brief anyone.

confidence 0.75

Receipts

AI & security

The agent has learned the kill chain, and it bills by the task

A China state-sponsored actor used an autonomous AI penetration-testing agent called ARTEX in ConnectWise attacks against hundreds of organisations, gaining privileged access to some; the OTX write-up puts the same tooling with Storm-0940 through October against IT and software vendors, aimed squarely at identity providers including Okta and Entra. Separately, researchers found exposed infrastructure belonging to affiliates of the INC and The Gentlemen ransomware crews running an "Autonomous Red Team Kill Chain Framework" named Phantom, and The Gentlemen posted three victims the same day. Dark Reading's figures sharpen it: one campaign hitting 105 sites with open-weight models, and public models obtaining full domain control for $12.

Why it mattersIf domain control costs twelve dollars of inference, the economics of "too small to be targeted" have quietly stopped working.

confidence 0.65

Receipts

AI & security

The agent economy's plumbing had a bad week: LiteLLM poisoned, x402 wallets unbounded

Attackers used compromised GitHub CLI OAuth tokens to push and approve malicious LiteLLM packages on PyPI and Docker, which is a supply chain attack conducted entirely with legitimate credentials and no malware worth the name. In the same window, V12 reported on 22 October that AI agents paying for API calls through the x402 SDKs could be induced to sign away their full balance of a supported token by a malicious API, because the default client set no spending limit until releases on 18 August added one.

Why it mattersModel API keys and agent wallets are now credentials with a spending limit problem, and nobody has written the rota for rotating them.

confidence 0.80

Receipts

Threat actors

Two state campaigns, no shared infrastructure, both living under the operating system

Kaspersky attributes BlackX, a UEFI bootkit that bypasses Secure Boot on fully patched Windows hosts that have not applied DBX revocations, to APT41, in a campaign against diplomatic entities in Tajikistan, Uzbekistan and Turkmenistan in early 2026; persistence sits in firmware, below the OS, where your EDR has no opinions. Separately, ESET describes Sandworm working with UAC-0099 against a Ukrainian grain logistics company: spearphishing on 16 July 2025 delivering the MATCHWOK backdoor, then MythicRatatoskr, an Yggdrasil-enabled mesh network backdoor, in a destructive wiping attack. They are reported on the same day and share no indicators, which is worth saying out loud before someone draws an arrow between them. Iran's Prince of Persia, meanwhile, parked a Tornado C&C server on US shared hosting, its first US-based server since 2016.

Why it mattersPatched is not the same as revoked: if you have never pushed DBX updates, your Secure Boot tick is a tick and nothing else.

confidence 0.80

Receipts

Vulnerabilities

The patch pile nobody will get to until Monday: 72 ArubaOS flaws, 176 Atlassian entries, four GitLab RCEs traced to one regex engine

HPE shipped fixes for 72 ArubaOS vulnerabilities, eight of them maximum-severity authentication bypass and code execution issues, and Atlassian's October bulletin lists 176 vulnerability entries covering 75 flaws, including 14 critical, all in third-party components. Ruby released 4.0.9, 3.4.12 and 3.3.13 to fix three bugs in Onigmo, the regex engine, which turn out to sit behind four critical GitLab RCEs patched over the past month, and Pillow, the most-used image library for Python, has CVE-2026-112900, where an EPS file's name is passed to Ghostscript and becomes an operating system command. Microsoft also confirmed Windows Server 2016 stops getting security updates in January 2027, which is a patch problem with a procurement answer.

Why it mattersFour critical GitLab RCEs collapsing into three upstream regex bugs is the whole argument for dependency inventory, delivered free of charge.

confidence 0.85

Receipts

Malware & IOCs

Credentials are being harvested at the edge and read off the wire, and our own logs agree

Researchers disclosed a large-scale campaign against exposed network edge devices, Fortinet FortiGate and Palo Alto GlobalProtect among them, in which operators have obtained over 70,000 credentials, while 333 Tor exit nodes were hijacked to intercept SSH traffic and pull plaintext email.

Why it mattersEdge devices and VPN portals remain the cheapest credential source on the internet, and the collection is continuous rather than campaign-shaped.

confidence 0.80

Receipts

Oddities

A ransomware crew announced its own website and the trackers logged it as a victim

Whitearmor posted five entries on 23 October, one of which reads "Hi. We now have a clearnet domain for easy-access. WhiteArmor.cc", and both ransomware.live and ransomlook duly recorded whitearmor.cc as a claimed victim, meaning a criminal group has now successfully extorted itself in your threat intelligence pipeline. Its other claims that day, including 140,838 employee records attributed to a US logistics firm, remain unverified. Elsewhere in the strangeness, the UK government is proposing 14-year prison terms for undersea cable sabotage, because the governing law is the Submarine Telegraph Act 1885, which currently tops out at a £1,000 fine and five years.

Why it mattersYour intel feed's classification logic is a control, and today it classified a press release as a breach.

confidence 0.75

Receipts

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

Under the feeds: one noisy Thursday, mirrored three times, plus an NVD that stopped talking on Wednesday night.

Exception 01
Most of today's cross-source confirmation is mirroring
ransomware.live consistently precedes ransomlook on the same victims by 1.1 to 10.5 hours, and Atlas signals by 5.9 to 15.5 hours, across Lido, Zelsior, Mount Lebanon, vinsolutions, Aurora and Chaos. Treat as one upstream observation, not four.
confidence 0.70
Wrong if
Ransomlook items begin appearing before ransomware.live for the same victims, or the two feeds show disjoint victim sets.
Watch
Whether ransomlook-first cases such as emperador at 4.5 hours become routine, which would suggest independent collection.
Receipts
Exception 02
The "KEV × ransomware fusion" labels cannot be checked
Atlas attaches KEV-style fusion stories to Qilin, LockBit5, Akira and Orova, yet no KEV CVE appears anywhere in the underlying ransomware items, and Orova carries ten items with victim posts but no stated CVE linkage at all.
confidence 0.50Speculative
Wrong if
Atlas publishes the specific CVE-to-actor mapping behind the fusion stories.
Watch
Any KEV entry tied to these actors in the coming days, and whether the fusion label survives contact with it.
Exception 03
NVD went quiet after 22 October at 23:36
NVD supplied 100 items, all early in the window, in clear batch shapes: roughly nine Apache bRPC CVEs in one hour, five Unbound, three IoTDB, three OpenJ9, then nothing. That pattern looks like ingestion, not a world in which disclosure stopped.
confidence 0.60Speculative
Wrong if
NVD resumes at normal volume with no collector change, or the gap is confirmed as a genuine publication pause.
Watch
NVD item counts on 24 and 25 October.
Receipts

Nothing to seeNo actor or CVE link was shown anywhere between the ransomware activity and the two new KEV entries. The OnePlus OxygenOS root command injection, the WordPress plugin pile, the SVG parsing bugs and the OpenStack cross-project disclosure issues are individual vulnerabilities with nothing behind them. The Atlas compound-crisis country stories sit at 0.425 confidence and say nothing a defender can act on. The burnout posts from infosec.exchange are not a threat signal; they are people, and they are tired.

Deep read: 390 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueTue 3 Nov10 days
Neither CVE-2026-109618 nor CVE-2026-109619 (PHP2Shell) will be added to CISA KEV.
Wrong ifEither CVE appears in a CISA KEV entry on or before 3 November 2026.
Receipts
f-2026-10-24-1
Confidence0.65
DueSat 31 Oct7 days
Qilin will post at least 10 further claimed victims to ransomware.live between 24 and 31 October.
Wrong ifFewer than 10 distinct new Qilin victim posts appear on ransomware.live in that window.
Receipts
f-2026-10-24-2
Confidence0.70
DueTue 27 Oct72h
NVD resumes publishing at normal volume, with at least one day of 20 or more new CVE items in our feed, by 27 October.
Wrong ifNo day between 24 and 27 October shows 20 or more NVD items.
Receipts
1. 1NVDCVE-2026-114039: A weakness has been identified in…
2. 2NVDCVE-2026-48830: Improper authentication in Apache b…
f-2026-10-24-3
Confidence0.80

Scorecard

1 right · 1 partly · 2 wrong

wrong
Ivanti publishes a fix or formal mitigation for the third flaw in the Connect Secure chain.
Called Wed 14 Oct · due Sat 24 Oct
Due 24 Oct. No item shows an Ivanti advisory, fix or mitigation for a third Connect Secure flaw.
wrong
N0n names at least one of the placeholder listings 'Company #63', '#64' or '#65' on its leak site.
Called Wed 14 Oct · due Sat 24 Oct
Due 24 Oct. No item shows Company #63, #64 or #65 being named. N0n's named claims on 23 Oct are other victims.
partly
CISA adds at least one further edge or remote-access device CVE (Fortinet, Ivanti, Cisco, Palo Alto, BeyondTrust class) to KEV by 30 October 2026.
Called Sat 17 Oct · due Fri 30 Oct
CISA added Arista VeloCloud Orchestrator (an SD-WAN edge-management product) to KEV on 23 Oct. It is not one of the named vendors, so whether it counts as the same class is arguable.
Receipts
1. 1CISA KEVCVE-2026-114625 Arista VeloCloud Orchestrator: Aris…
right
The Arista VeloCloud Orchestrator SQL injection zero-day is added to CISA KEV.
Called Fri 23 Oct · due Fri 6 Nov
CISA KEV added CVE-2026-114625, Arista VeloCloud Orchestrator SQL injection, on 23 Oct. SecurityWeek reports it as exploited.
Receipts
1. 1CISA KEVCVE-2026-114625 Arista VeloCloud Orchestrator: Aris…
2. 2Security newsAttackers Exploit Third Arista VCO Zero-Day in Four…

Glossary of terms you will be expected to nod at

Zero-day (third in four months) (n.): Not a zero-day. A component. The first one is bad luck, the second is a pattern, and the third is the product telling you where it keeps its secrets, slowly, in public, with a CVE number attached.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge, in the last 24 hours: 113 hostile sources profiled, 49 of them researchers, 32 scanners, 28 bot crawlers and 3 brute forcers, sending 6,160 requests between them, of which 72 went past reconnaissance into exploitation attempts. Thirteen groups of addresses shared a behavioural fingerprint, including one cluster of 45 IPs behaving as a single tool, and 1,258 of the 7,360 addresses we saw across 89 countries were new today. The two that made me put the mug down: a scanner at 34.52.133.111 asking 231 times for things like /.env.anthropic and /.docker/config.json, and 130.211.85.163 firing 113 requests for /.git/config, /api/.env and /sendgrid.env in about 0.4 seconds. Raw logs never left the server; only the findings did.

113hostile sources profiled

6,160requests from them

72reached exploitation

13shared-DNA clusters

8.2/10top hostility

7,360addresses at our edge

1,258first seen today

89countries

The WTF list

WTF #1
Looking for your AI keys
34.52.133.111, a scanner (hostility 4.3/10), sent 231 requests to 2 of our sites, probing for /.docker/.env, /.docker/laravel/app/.env, /.env.anthropic, /.docker/config.json.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownSat 24 Oct, 00:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 6df93820bbb8
```
WTF #2
The most determined visitor
85.204.70.104, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
attribution: unknownSat 24 Oct, 00:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation → credential-access · DNA 82a939927b85
```
WTF #3
Trying CVE-2024-4577 on us
6 addresses sent 15 requests shaped like CVE-2024-4577 exploitation (/index.php), including 2a0f:ca80:b00b:b63c::5, 45.153.34.249, 43.134.64.138.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: webshell
```
WTF #4
Same DNA, different addresses
47.82.55.22, a researcher (hostility 0.8/10), sent 9 requests to one of our sites, probing for /threat-check/Microsoft%20GDI%20Remote%20Code%20Execution%20Vulnerabil, /threat-check/F5%20BIG-IP%20and%20BIG-IQ%20Centralized%20Management%20.
Why it’s weird45 IPs share one behavioural fingerprint (DNA b77200c2c27d): one tool or one operator rotating addresses: 47.82.8.122, 47.82.55.22, 47.82.50.199, 47.82.54.185, 47.82.13.21 and more.
attribution: unknownFri 23 Oct, 09:00 UTC
Detail
```
kill chain: reconnaissance → exploitation · DNA b77200c2c27d
```
WTF #5
The strangest shopping list
20.239.201.109, a scanner (hostility 6.4/10), sent 48 requests to one of our sites, probing for /inputs.php, /ioxi-o.php, /function/function.php, /rip.php.
Why it’s weirdAsked for files almost nobody else asks for: /inputs.php, /ioxi-o.php, /function/function.php, /rip.php, /admin.php.
attribution: unknownFri 23 Oct, 09:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 83562bd8e880
```
WTF #6
In a hurry
130.211.85.163, a scanner (hostility 5.5/10), sent 113 requests to one of our sites, probing for /.git/config, /api/.env, /sendgrid.env, /.env.
Why it’s weirdFired 113 requests in about 0.4 seconds.
attribution: unknownFri 23 Oct, 09:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```

§6

Tempo

Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.

195claims, 7 days

41of 131 groups active

N0n43 this week · surging

qilin28 this week

SilentRansomGroup10 this week · surging

SurgingSilentRansomGroup — 10 claims in 7 days against 2.3 expected from its own prior rate (p < 0.001)
SurgingBrainCipher — 8 claims in 7 days against 1.6 expected from its own prior rate (p < 0.001)
SurgingN0n — 43 claims in 7 days against 25.0 expected from its own prior rate (p < 0.001)
Surginglamashtu — 6 claims in 7 days against 1.2 expected from its own prior rate (p = 0.001)
SurgingHelix — 5 claims in 7 days against 1.2 expected from its own prior rate (p = 0.009)
SurgingBooba Project — 6 claims in 7 days against 2.1 expected from its own prior rate (p = 0.020)

Gone quiet: blackwater (61 days), coinbasecartel (62 days), xpl0itrs (65 days), CRPxO (83 days).

Sector pressure, 30 days

UpTransportation — 2.2× its own prior share (70 claims, 32 expected)
UpEducation — 1.8× its own prior share (47 claims, 26 expected)
UpHealthcare — 1.4× its own prior share (112 claims, 78 expected)
DownRetail & E-Commerce — 0.8× its own prior share (47 claims, 61 expected)

23% of claims carry no sector label.

Brand churn

Of the 80 leak-site brands first seen since 2026-06-01, 78% were still claiming 30 days after their first post and 78% were still claiming 60 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 56 old enough to judge posted on one day and never again; 41% made at least half their claims in their first week. New brands this month: 11 — newest: Whitearmor (2026-10-23, 3 claims), Mimori (2026-10-20, 2 claims), THE SEVEN DEADLY SINS (2026-10-16, 8 claims).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Targeting

Over the last 180 days, among brands with at least 20 labelled claims: safepay put 35% of its claims on Germany (6.9× every other brand's share); N0n put 38% of its claims on Transportation (8.3× every other brand's share); Storm put 78% of its claims on the United States (2.1× every other brand's share). Widest spread: qilin across 10.0 effective sectors.

Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.

Posting clock

Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 68% of its claims on Mondays, half of them in 19:00–19:59 UTC; akira posted only 1 of 181 claims at weekends and half its claims in 12:00–13:59 UTC; half of Deadlock's claims appeared in 12:00–13:59 UTC. Leak sites overall are 41% quieter per weekend day than per weekday.

all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.

Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →

§7

Ride-alongs

Free, live tools. No sign-up, no sales call.

§8

Colophon

How this edition was made, plainly.

Edition 27 was made by machine and checked by code. Every item published by 13 public threat feeds in the 24 hours to 05:05 UK (390 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.77. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

390items read

24hour window

$0.77cost of this edition

04:05 UTCgenerated

Sources this morning

NVD100ok
Signal Atlas67ok
RansomLook49ok
Security news41ok
infosec.exchange38ok
ransomware.live37ok
atlas28ok
AlienVault OTX11ok
signal:ioc-family7ok
RSS7ok
signal:kev2ok
CISA KEV2ok
Ransomware tempo · Ninja Signal graph1ok

Get it in your inbox. Every morning. Probably.

PHP2Shell: millions of attempts, no confirmed compromise, and now a second hole with no patch

Qilin posted a working day's worth of victims in about nine hours

The agent has learned the kill chain, and it bills by the task

The agent economy's plumbing had a bad week: LiteLLM poisoned, x402 wallets unbounded

Two state campaigns, no shared infrastructure, both living under the operating system

The patch pile nobody will get to until Monday: 72 ArubaOS flaws, 176 Atlassian entries, four GitLab RCEs traced to one regex engine

Credentials are being harvested at the edge and read off the wire, and our own logs agree

A ransomware crew announced its own website and the trackers logged it as a victim

Most of today's cross-source confirmation is mirroring

The "KEV × ransomware fusion" labels cannot be checked

NVD went quiet after 22 October at 23:36

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

Looking for your AI keys

The most determined visitor

Trying CVE-2024-4577 on us

Same DNA, different addresses

The strangest shopping list

In a hurry

Get it in your inbox. Every morning. Probably.

Sources this morning