A Daily Field Report on Things That Are Probably Fine
No. 28·Sunday 25 October 2026·Published 06:00 UK·Fine Meter 3/5: Fine-adjacent
Lead · Known Exploited
CISA adds critical flaws in Collabora Online and Arista VeloCloud Orchestrator to its exploited list, on a Friday, naturally
A document server and an SD-WAN orchestrator are now officially known to be under attack, which the attackers already knew, because they were the ones doing it.
confidence0.85
On Friday CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalogue, citing reports of active exploitation in the wild. One is in Collabora Online's Built-in CODE Server and the other is in Arista VeloCloud Orchestrator, and both are described as critical. That is all the public record gives us this morning. It is enough.
Neither product is exotic. One lets people edit documents together. The other is an orchestrator, a box whose job description is to be obeyed by the rest of the network. Attackers want both for the same reason we deploy them: a lot of trust collects in one place. If the orchestrator is compromised, you don't have a vulnerable device. You have a vulnerable opinion that every other device holds.
One caution from the deep read. All weekend the Atlas scoring feed has been labelling ransomware groups with 'KEV × ransomware fusion', which reads as if someone has tied these flaws to Qilin and friends. Nobody has. Nothing in today's feeds links any ransomware group to any specific CVE. The fusion label is the dashboard's hypothesis, not a finding. Patch these because they are exploited, not because a tile went amber.
Why it mattersIf you run Collabora's CODE server or a VeloCloud Orchestrator where anything untrusted can reach it, patch today and look for signs of compromise, in that order.
A second source that read the first source is not corroboration. It is an echo with a confidence score.
— Sturgeon’s Revelations · Probably Fine Daily No. 28
Every morning06:00 UK
Get it in your inbox. Every morning. Probably.
One email a day. The whole paper. Unsubscribe in one click.
§2
Top stories
The rest of the last 24 hours, with receipts.
Ransomware
Saturday's leak-site rush: The Gentlemen, Qilin and N0n post in bulk, and the dashboards count it twice
On 24 October several groups posted far above their usual rate. The deep read counts 24 items for The Gentlemen, 20 for Qilin and 16 for N0n, against a median of zero on other days for The Gentlemen and N0n, though many of those items are Atlas stories generated from the same listings. Qilin claimed Heber City in Utah, Commonwealth Community Bank and Britain's Castle Howard Estate. N0n listed the Arthritis Center of Riverside and Ecuador's Asisken Asistencia Médica, whose listing describes identity records for 139,006 named insurance clients. Postings arrived in batches: N0n put up four victims in about two minutes and krybit six in three. Ninja Signal's weekly tempo counts 202 claims from 43 of the 131 groups it tracks, with SilentRansomGroup at 10 against 2.27 expected and lamashtu at 7 against 1.15. Maureen from Governance, Risk and Compliance asks me to add that the country tags are wrong in places: Conax Technologies is tagged Norway in a listing that describes a manufacturer in Buffalo, New York, and Asisken is tagged Argentina although it is based in Guayaquil.
Why it mattersIf you supply, insure or bank with any of these names, send the third-party-risk email today. Build sector or country trends from the victim descriptions, not the tags.
Old bugs, new paperwork: NVD files a batch of 2017 to 2025 flaws, most with Shadowserver exploitation evidence attached
A batch of records published on Thursday 22 October at 11:17 UTC gives formal CVEs to old flaws in FineReport, DedeCMS, Weaver E-cology, SeaCMS, the Javo Spot WordPress theme and others, and most of the entries cite exploitation first observed by Shadowserver. The ones to deal with first give unauthenticated code execution. In FineReport 9.0 (CVE-2021-48014), a POST to the design_save_svg operation can write a JSP webshell. DedeCMS through 5.8.1-beta (CVE-2021-48016) executes PHP smuggled in through the HTTP Referer header. Weaver E-cology 8.0, 9.0 and 10.0 before 10.76 has an unauthenticated SQL injection (CVE-2025-71434), and Javo Spot (CVE-2017-20287) will hand wp-config.php to anyone who asks with ../../. Separately, VulDB's CTI team reports a lot of activity targeting the GeoDirectory plugin (CVE-2026-113489).
Why it mattersHunt for FineReport and DedeCMS on your estate first. The year in a CVE ID tells you when it was numbered, not how dangerous it is.
Security software turns out to be software: mod_qos inspects the wrong request, a WAF ships with a spare account, WatchGuard leaves a recovery key in a log
Four mod_qos CVEs published on Thursday include CVE-2026-114460, an off-by-one error that truncates the query string during security evaluation while the real request goes through unchanged, so prohibited content can be hidden from the filter. The other three are unauthenticated denial-of-service bugs. Penta Security's WAPPLES web application firewall has a path traversal in /webapi/file/transfer (CVE-2022-51025, part of the Shadowserver batch), made worse by a hardcoded account named systemi. WatchGuard Endpoint Security for macOS writes the FileVault Personal Recovery Key into a diagnostic log that every local user can read (CVE-2026-96293), and the WatchGuard Agent's log directory can be rewritten by any local non-administrative user (CVE-2026-115253).
Why it mattersFilters, WAFs and endpoint agents are attack surface too. Patch them on the same schedule as everything they are meant to protect.
LiteLLM traces a poisoned release of its Python package to a master key committed to a public repo in May
On Friday LiteLLM said that an Agent Platform master key, in a configuration file committed to a public GitHub repository on 27 May 2026, ultimately let an attacker steal GitHub tokens, take over the release pipeline and push a malicious version of the Python package. In the same week NVD recorded CVE-2026-111079 in Goose: when its terminal integration is enabled, it sends captured shell history verbatim to the configured LLM provider, along with any tokens or passwords typed into that history. A scoring bot on Mastodon rates a Chrome extension called 'Ask ChatGPT' 96 out of 100 for badness. Dave from procurement has not installed it. Dave was busy that morning, and we are grateful.
Why it mattersRotate any model-gateway key that has ever touched a repository, and treat AI developer tooling as a route by which secrets leave the building.
The Brotli decoder flaw behind a Node.js RCE also sits in Bun, Python packages and Envoy
CVE-2026-111497 is a memory-corruption flaw in Google's Brotli decoder that crafted compressed data can trigger. It is the flaw behind a Node.js remote code execution, and it also reaches Bun, the Python Brotli and brotlicffi packages, and Envoy proxies configured to decompress Brotli. Dropbox's esaml library showed the same lesson in miniature this week: three newly published bugs let an unauthenticated attacker crash the Erlang node with a crafted SAMLResponse or LogoutResponse, one of them by inflating attacker-supplied compressed data with no limit on the output size.
Why it mattersFind everywhere you decompress untrusted input, proxies included, and update Brotli wherever it has been bundled rather than installed.
BlackX bootkit uses the old Baton Drop flaw to get past Secure Boot and interfere with Kaspersky and Avast
BlackX, a new UEFI bootkit used in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot. It then loaded a malicious driver built to interfere with security products from Kaspersky and Avast. Two outlets carried the same report word for word, so this is one source syndicated, not two independent confirmations.
Why it mattersCheck that your Secure Boot revocation data is current, and assume endpoint tooling can be the target rather than the referee.
Google spells out that Gmail and Photos data shared with its AI features can be used for targeted ads
Google has updated its privacy policy to say that using personalised AI features in Search or Gemini could let it serve targeted ads based on users' activity in other connected Google services, Gmail and Photos among them. The change is an explanation of how the data is used, not a new security flaw. That is the point.
Why it mattersIf staff connect accounts that hold work-adjacent data to AI features, your data-handling policy now has an advertising clause it did not ask for.
Eye Security pushed more than 2 million updates to computers it did not own, to switch off an updater
Between November 2025 and March 2026, the Dutch firm Eye Security pushed more than 2 million updates to machines it did not own. The aim was to disable a background updater belonging to Time4Popcorn, which the firm said could have let an outsider take over the machine and could have fuelled a botnet. Only one outlet reported it, and that report is the source here.
Why it mattersAbandoned auto-updaters are remote-execution channels waiting for a new owner. Find them on your endpoints before someone else claims them.
The daily deep read: what is under the feeds, not on top of them.
Under the feeds: the ransomware dashboard runs 7 to 13 hours behind the leak sites it reads, so its 'escalating' labels echo those sites rather than confirm them.
Exception 01
Atlas trails leak-site claims by 7 to 13 hours, so it is not an independent source
For Deadlock (13.0h), Qilin (8.6h), Emperador (8.0h), The Gentlemen (7.4h) and N0n (7.0h), the claim appeared on ransomware.live first and as an Atlas story later. That is consistent with Atlas being a velocity-scored derivative of the same listings, so its 'escalating' labels should not count as a second source.
confidence0.70
Wrong if
Atlas stories timestamped before the matching listings, or Atlas stories citing sources other than the leak sites.
Watch
Whether new listings over the next 24 hours are again followed by Atlas stories after a similar lag.
The Gentlemen (24 items), Qilin (20) and N0n (16) far exceeded their usual rate, and victims were posted in tight batches (N0n four in about two minutes, krybit six in three), which points to bulk uploads by the operators. Each listing produces several Atlas stories, so the item counts overstate the number of victims.
confidence0.60
Wrong if
Raw ransomware.live listings matching the burst counts, rather than being far fewer.
Watch
Distinct victims per actor compared with Atlas story counts on 25 and 26 October.
Country and sector tags contradict the victim descriptions
Conax is tagged NO but described as US-based. Asisken is tagged AR but described as being in Guayaquil, Ecuador. choicegoodwill.com is tagged as US retail but described as an Indian real estate developer. Frommann is tagged Energy but annotated as Manufacturing. Geographic or sector trends built on these tags are unreliable.
confidence0.70
Wrong if
A systematic check showing these mismatches are rare beyond this handful.
Watch
Compare tagged country with described location for each new listing.
Shadowserver-attributed CVEs are a backfill, not new disclosure
The NVD records published together on 22 October at 11:17 UTC cover 2017 to 2025 flaws in products such as Weaver E-cology, FineReport, DedeCMS and SeaCMS, with exploitation evidence first observed by Shadowserver. They record exploitation that already happened; they are not new findings.
confidence0.60
Wrong if
The batch turns out not to be tied to Shadowserver data, or later NVD items arrive in the same pattern.
Watch
Whether CISA KEV or vendor advisories pick up any of these CVEs in the next week.
Qilin's 'escalating' Spain run rests on one visible victim
Atlas flagged an escalating Qilin run in Spain (confidence 0.78), but the only visible Spanish listing is Miljaus Producciones from 23 October. One victim is a thin basis for calling it an escalation.
confidence0.50Speculative
Wrong if
More Spanish Qilin victims appearing within days.
Watch
New Qilin listings tagged ES over the next three to five days.
Nothing to seeThere is no sign of coordination between unrelated actors, and no ransomware group is tied to any specific CVE, whatever the fusion labels suggest. The Atlas 'compound crisis' and seismic stories look like a generic geopolitical rule, not cyber activity. Two social posts are single-source and unverified: one linking a headline that China-linked hackers used agentic AI against 2,250 Microsoft 365 tenants, and one tracking a LockBit listing of a Lebanese hospital. The quiet on NVD after 00:20 on 24 October is most likely the end of a batch, not a lull. The SalatStealer and SmartLoader IOC loads both start at 06:27, which tells us about the feed pipeline rather than the actors.
Deep read: 288 items read
§4
Forecast
Dated, falsifiable calls. We mark our own homework in public.
Today’s calls
DueCallConfidence
DueFri 30 Oct5 days
Qilin will post at least one more victim tagged Spain (ES) on ransomware.live by 30 October 2026.
Wrong ifNo new Qilin listing tagged ES on ransomware.live between 25 and 30 October 2026.
At least one new ransomware.live listing from The Gentlemen, Qilin or N0n between 25 and 31 October will be followed by a matching Atlas story 5 to 15 hours later.
Wrong ifEvery matching Atlas story arrives within 5 hours, after 15 hours, or before the listing, or no matching Atlas story appears at all.
At least one of FineReport CVE-2021-48014, DedeCMS CVE-2021-48016 or Weaver E-cology CVE-2025-71434 will be added to CISA's KEV catalogue by 8 November 2026.
Wrong ifNone of the three appears in the KEV feed by 8 November 2026.
The moment a vulnerability stops being something the attackers know and becomes something we know. It always happens on a Friday.
§5
From our edge
Live attacks on our own servers in the last 24 hours. Yes, really ours.
Our own servers had their usual weekend of visitors. In the last 24 hours the Adversary DNA sensor profiled 94 hostile sources (34 researchers, 29 scanners, 24 bot crawlers and 5 targeted operators), which sent 3,071 requests between them. 59 went past reconnaissance into exploitation attempts, and 11 groups of addresses shared a behavioural fingerprint. One cluster of 32 IPs looked like a single tool or operator rotating addresses. A scanner at 35.240.58.49 skipped the pleasantries and asked for /.aws/credentials.bak, /.docker/config.json and /.env.anthropic, so AI API keys are now on the same shopping list as cloud keys. Another, 104.199.36.53, fired 115 requests in about 0.4 seconds looking for .env files. Two targeted operators, at 7.7 out of 10 hostility, worked through WordPress xmlrpc.php and wlwmanifest.xml paths as far as credential access. Someone is still spraying CVE-2018-20062 at the internet as though it were new. Raw logs never left the server; only these findings did.
94hostile sources profiled
3,071requests from them
59reached exploitation
11shared-DNA clusters
8.2/10top hostility
11,679addresses at our edge
4,468first seen today
99countries
The WTF list
WTF #1
Looking for your AI keys
35.240.58.49, a scanner (hostility 5.6/10), sent 228 requests to 2 of our sites, probing for /.aws/credentials.bak, /.docker/config.json, /.docker/.env, /.env.anthropic.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownSat 24 Oct, 17:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA 9427f6c77bf1
WTF #2
The most determined visitor
143.244.57.86, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
1 address sent 3 requests shaped like CVE-2018-20062 exploitation (/index.php), including 204.76.203.7.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
probe family: webshell
WTF #4
Same DNA, different addresses
47.79.11.64, a researcher (hostility 0.9/10), sent 8 requests to one of our sites, probing for /threat-check/D-Link%20Multiple%20Routers%20Remote%20Code%20Execution%, /threat-check/TerraMaster%20OS%20Remote%20Command%20Execution%20Vulner.
Why it’s weird32 IPs share one behavioural fingerprint (DNA b77200c2c27d): one tool or one operator rotating addresses: 47.82.50.236, 47.82.53.234, 47.82.49.67, 47.82.48.175, 47.79.51.179 and more.
attribution: unknownSun 25 Oct, 05:00 UTC
Detail
kill chain: reconnaissance → exploitation · DNA b77200c2c27d
WTF #5
The strangest shopping list
146.70.194.236, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdAsked for files almost nobody else asks for: /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml, /login/wordpress/wp-incl.
104.199.36.53, a scanner (hostility 5.5/10), sent 115 requests to one of our sites, probing for /.docker/.env, /.env, /.docker/laravel/app/.env, /.aws/.env.
Why it’s weirdFired 115 requests in about 0.4 seconds.
attribution: unknownSat 24 Oct, 17:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
§6
Tempo
Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.
202claims, 7 days
43of 131 groups active
N0n38 this week · surging
qilin29 this week
SilentRansomGroup10 this week · surging
SurgingSilentRansomGroup — 10 claims in 7 days against 2.3 expected from its own prior rate (p < 0.001)
Surginglamashtu — 7 claims in 7 days against 1.1 expected from its own prior rate (p < 0.001)
SurgingBrainCipher — 8 claims in 7 days against 1.6 expected from its own prior rate (p < 0.001)
SurgingBooba Project — 6 claims in 7 days against 2.1 expected from its own prior rate (p = 0.019)
SurgingN0n — 38 claims in 7 days against 26.6 expected from its own prior rate (p = 0.022)
NewScarlettgroup — first claim 2026-10-08; 5 so far
UpTransportation — 2.1× its own prior share (70 claims, 33 expected)
UpEducation — 1.8× its own prior share (47 claims, 26 expected)
UpHealthcare — 1.4× its own prior share (110 claims, 80 expected)
23% of claims carry no sector label.
Brand churn
Of the 80 leak-site brands first seen since 2026-06-01, 78% were still claiming 30 days after their first post and 78% were still claiming 60 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 56 old enough to judge posted on one day and never again; 41% made at least half their claims in their first week. New brands this month: 11 — newest: Whitearmor (2026-10-23, 3 claims), Mimori (2026-10-20, 2 claims), THE SEVEN DEADLY SINS (2026-10-16, 8 claims).
Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.
Targeting
Over the last 180 days, among brands with at least 20 labelled claims: safepay put 35% of its claims on Germany (6.8× every other brand's share); N0n put 36% of its claims on Transportation (8.0× every other brand's share); Storm put 78% of its claims on the United States (2.1× every other brand's share). Widest spread: qilin across 10.1 effective sectors.
Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.
Posting clock
Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 68% of its claims on Mondays, half of them in 19:00–19:59 UTC; akira posted only 1 of 181 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 39% quieter per weekend day than per weekday.
all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.
Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.
Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers
One email a day. The whole paper. Unsubscribe in one click.
§8
Colophon
How this edition was made, plainly.
Edition 28 was made by machine and checked by code. Every item published by 9 public threat feeds in the 24 hours to 05:05 UK (288 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.00. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.
288items read
24hour window
$0.00cost of this edition
05:05 UTCgenerated
Sources this morning
NVD100ok
Signal Atlas82ok
infosec.exchange39ok
atlas28ok
ransomware.live27ok
Security news6ok
signal:ioc-family4ok
RSS1ok
Ransomware tempo · Ninja Signal graph1ok
ITEMS READ: 288|SOURCES: 9|STORIES DROPPED FOR LACK OF RECEIPTS: 0|COST: $0.00|STATUS: FINE-ADJACENT
OWNER: the machine|EDITOR: the rules|CALLS OPEN: 3|NEXT REVIEW: tomorrow 06:00 UK