A Daily Field Report on Things That Are Probably Fine
No. 29·Monday 26 October 2026·Published 06:00 UK·Fine Meter 3/5: Probably fine, with an asterisk
Lead · Known Exploited
CISA moves Collabora Online and Arista VeloCloud Orchestrator from 'possible' to 'already happening'
Two vulnerabilities went onto the Known Exploited Vulnerabilities list on Friday, because it is always Friday, and Arista has patched a VeloCloud Orchestrator zero-day that was used in attacks.
confidence0.85
The US Cybersecurity and Infrastructure Security Agency added two vulnerabilities to its Known Exploited Vulnerabilities catalogue on Friday. One affects the Collabora Online Built-in CODE Server and the other Arista VeloCloud Orchestrator (VCO). CISA cited reports of active exploitation in the wild. A separate report says Arista has patched a new VeloCloud Orchestrator zero-day that was exploited in attacks.
The items we have don't carry the CVE numbers, so take the identifiers and fixed versions from the vendor advisories, not from memory or a dashboard summary. Do two things this morning: find every Collabora CODE server and every VCO you own, including the ones somebody stood up for a pilot, and check whether each is patched and whether it is reachable from places it shouldn't be.
Here is the reframe. KEV is not a list of vulnerabilities. It is a list of things that have stopped being hypothetical, which is a smaller and much ruder category. An orchestrator, by definition, is the box that tells the other boxes what to do. When someone else is telling the orchestrator what to do, the rest of your diagram is decorative.
Why it mattersKEV entries are confirmed exploitation, not CVSS guesswork. Collabora CODE and VeloCloud Orchestrator go to the top of this week's patch queue, and you hunt for prior compromise as well as patching.
A gang that is cooling at 22:58 and escalating at 23:50 has not changed its behaviour in under an hour. The dashboard has, and the dashboard is the one in the board pack.
— Sturgeon’s Revelations · Probably Fine Daily No. 29
Every morning06:00 UK
Get it in your inbox. Every morning. Probably.
One email a day. The whole paper. Unsubscribe in one click.
§2
Top stories
The rest of the last 24 hours, with receipts.
Vulnerabilities
CGM CLININET: eleven CVEs in one hospital system, several of them ending in root
Eleven CVE records for the CGM CLININET hospital information system were published together on 23 October. They include: an unauthenticated /DocManagment endpoint that lets someone on the adjacent network list and download patient documents (CVE-2025-30043, fixed in 2026.MS3); Java deserialisation RCE via the administrative API (CVE-2025-30047); HL7 processes running as root while parsing untrusted data from external systems (CVE-2025-30046); Perl expression injection to root (CVE-2025-30045); and a RunCGI.pm module import that executes attacker-controlled code (CVE-2025-30050). The rest of the batch: passwords stored as unsalted MD5 (CVE-2025-30049), database and RabbitMQ credentials in a world-readable SysIO.pl (CVE-2025-30051), an rsyncd that authenticates by source IP (CVE-2025-30052), a cgm-updater listening on an open port with no authentication (CVE-2025-30053), a local root escalation through writable HL7 scripts (CVE-2025-30054), and a reflected XSS (CVE-2025-58403). Several are described as confirmed up to 2026.MS3 with later versions possibly still affected. The corpus shows no evidence of exploitation.
Why it mattersMost of these need adjacent-network access, so the control that matters is segmentation: get CLININET servers, HL7 interfaces and the updater port off any flat clinical or corporate network today, then chase fixed versions.
Qilin and N0n post 31 claims each in a day, and the trackers can't agree what any of the victims do
Qilin posted 31 items on Sunday against a median of 7 on other days, and N0n matched it with 31 against a median of 5. Qilin's list includes Commonwealth Community Bank, Heber City in Utah, White & Case and Ooredoo Myanmar, which one aggregator files under Technology and the other under Advertising & Marketing. N0n's includes Andrews Advisory Group, a Chicago financial advisory and restructuring firm whose listing describes 3,698 patient records. The Atlas tracker marked Qilin's US run as cooling at 22:58 and escalating at 23:50, and across seven days the tempo tracker counts 192 claims from 41 of 267 tracked groups, with lamashtu at 7 against 1.25 expected and SilentRansomGroup at 9 against 2.27.
Why it mattersThe volume is real but the labels are not. Before a sector conclusion goes into a briefing, check victim names against your own suppliers and ignore the momentum arrows.
AI agents keep shipping with a 'yes' button that anyone can press
Researchers found a malicious AGENTS.md instruction file in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package. The same week's CVEs found the same habit elsewhere. PraisonAI before 4.6.59 approves a pending dangerous tool call when any non-bot user in the approval channel posts something classified as approval, such as 'yes'; renders tool arguments unescaped into its approval dashboard; and lets the streaming recipe path skip the dangerous-tool policy. Aider through 0.86.2 auto-loads a committed .aider.conf.yml without a trust prompt and runs its commands with shell=True, AgenticSeek hardcodes Flask debug mode on all interfaces, and Google's ADK for Java dev server skipped WebSocket origin checks before 1.13.0. Meanwhile OpenAI says it will train its most advanced models with no live internet access, under a headline about agents demonstrating VM escapes and secret cross-sandbox communication.
Why it mattersTreat agent config and instruction files (AGENTS.md, .aider.conf.yml) as executable code in reviews and EDR rules. Patch PraisonAI, Aider and ADK, and find any agent tooling bound to 0.0.0.0.
One LiteLLM key committed in May ended in a malicious release of the package
LiteLLM disclosed on Friday that an Agent Platform master key had been published to a public GitHub repository in late May 2026, after a configuration file was committed on 27 May. It says that key ultimately let the threat actor steal GitHub tokens, hijack the release pipeline and push a malicious version of the popular Python package.
Why it mattersIf you pulled LiteLLM in the affected window, compare installed versions against the project's advisory. Then check whether your own CI tokens would survive a single leaked config file.
Tailscale SSH can turn one owned device into root elsewhere, no patch yet; ASUS routers give root in factory-default state
A researcher has published Tailscale SSH flaws that let a single compromised device on a tailnet get root on other servers it can already reach. The attack needs Tailscale SSH configured to allow port forwarding and an attacker who already controls a device. Tailscale says a fix is coming. Separately, ASUS disclosed CVE-2026-75775, root command injection on routers in their factory-default state; CVE-2026-75779, CSRF chained to root command execution through a logged-in administrator; and CVE-2026-93489, where a nearby unauthenticated user can forge an access ticket and perform administrator operations.
Why it mattersUntil Tailscale ships its fix, audit ACLs for SSH port-forwarding permissions and remove any that nobody can justify. Never leave ASUS kit sitting in its default state on a network.
Falcon, Emperador and WhiteArmor publish big-name claims with suspiciously exact numbers
Falcon claims 738 GB from Astrana Health (470 GB compressed), including regulatory audit reports and reimbursement tables, and 82 GB from the mass-tort law firm Weitz & Luxenberg, including privileged attorney-client communications; the two posts went up within an hour of each other. Emperador claims AB InBev and lists 329,244 social-listening alerts and 2,510 corporate emails. WhiteArmor claims Hisense's GCRM document store and a LoveSac database of 1,113,285 order records, and accuses J.B Hunt of quietly emailing customers to change their passwords instead of negotiating. It then announced that its VPS provider had banned its account, taking whitearmor.cc and most of its posted data offline, and said it would be back within a day or two. None of it is confirmed.
Why it mattersThese claims are written to pressure the victims, not to inform you. Check third-party exposure to the named firms and wait for a victim statement or a verifiable sample before you brief anyone.
BlackX bootkit uses the old Baton Drop flaw to get past Secure Boot
A new UEFI bootkit named BlackX, used in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver. The driver is designed to interfere with Kaspersky and Avast security products. The report appeared word for word in two outlets, so count it as one source, not two.
Why it mattersOld boot-chain flaws stay useful to attackers until the vulnerable components are actually revoked on your fleet. Check your Secure Boot revocation status. Don't assume the green tick means it's current.
Security firm pushes more than 2 million updates to computers it does not own, to switch off Popcorn Time's updater
Between November 2025 and March 2026, the Dutch firm Eye Security pushed more than 2 million updates to machines it did not own. The updates switched off a background updater belonging to the abandoned Popcorn Time app, which Eye Security said could have let an outsider take over the machine. A separate report describes the abandoned app as having exposed millions of devices to RCE.
Why it mattersAbandoned software keeps its update channel, and whoever controls that channel controls the endpoint. Inventory any updaters nobody owns and remove them.
The daily deep read: what is under the feeds, not on top of them.
Under the feeds: Sunday's leak-site spike is real volume wrapped in aggregator echo, and the most solid defender signal is the CLININET batch, not the momentum arrows.
Exception 01
Qilin's burst is real, but the Atlas escalation labels are built from the same counts
Qilin had 31 items on 25 October against a median of 7, across four sources. Atlas escalation stories appear to be computed from those same leak-site counts, so they are not independent confirmation, and the aggregators contradict each other on sector labels (Ooredoo Myanmar filed as Advertising & Marketing by one, Technology by the other).
confidence0.70
Wrong if
Atlas Qilin stories citing inputs beyond leak-site posts, or Qilin volume collapsing while Atlas still says escalating.
Watch
Qilin daily counts on 26 and 27 October, and whether Atlas flips to cooling.
N0n has 31 items on 25 October against a median of 5. Victim descriptions look templated: a financial advisory firm is listed with patient records. Atlas country tags (TN, BR, KR, EG) have no matching victims here. Whether any data was really taken is unverified.
confidence0.55Speculative
Wrong if
Victims confirming breaches, or published samples matching the stated record counts.
Watch
Victim statements this week and whether N0n keeps posting in batches.
Exception 03
CGM CLININET is a coordinated release, not a campaign
The CLININET CVEs carry 2025 IDs but were all published on 23 October 2026, which points to a long-reserved coordinated disclosure. Several have no stated fix, and the corpus shows no exploitation or ransomware link.
confidence0.75
Wrong if
A vendor advisory listing fixed versions for every CVE, or the CVEs being rejected or merged.
Watch
Vendor patch notes, and any KEV entry or public PoC over the next two weeks.
NVD and the Krybit actor both stop at the same timestamp in the window (25 October, 00:21). That looks like an ingestion boundary, not real silence, so don't read anything into either going quiet.
confidence0.60Speculative
Wrong if
NVD items dated after that timestamp appearing in later windows, or Krybit posting again.
Watch
Whether NVD volume and Krybit both reappear in the next window.
Falcon and Payload 'lead-lag' links are name collisions
The links tying NVD to the Falcon and Payload leak sites match on generic words: a Linux kernel CVE that mentions the SEC2 falcon, and a Part-DB CVE about a JavaScript payload. They are almost certainly spurious. The real item is Falcon posting two large US datasets within an hour.
confidence0.70
Wrong if
An NVD CVE that actually concerns the actor's tooling.
Watch
Ignore as a threat link unless victim posts reference those products.
The same class of fault recurs across unrelated sources (PraisonAI, Aider, AgenticSeek, the AGENTS.md hijack, LiteLLM's leaked key): approval bypasses and unsafe defaults in agent tooling. It is a pattern in the feeds, not evidence of one campaign.
confidence0.50Speculative
Wrong if
Showing the items are one-offs with no shared root-cause class.
Watch
New agent-framework CVEs and package-registry incidents this week.
Nothing to seeNo timing clusters. The WordPress plugin bursts, the gose JOSE library CVEs and the bulk Linux kernel CVEs are CNA batch publishing, not coordination. The Storm-0940/Artex claim rests on a satirical-style Mastodon account and is uncorroborated, so it stays out of the news pages. The seismic and outbreak 'stories' in Atlas are low-confidence and have no supporting items.
Deep read: 364 items read
§4
Forecast
Dated, falsifiable calls. We mark our own homework in public.
Today’s calls
DueCallConfidence
DueMon 2 Nov7d
Tailscale publishes a fix or advisory for the Tailscale SSH port-forwarding privilege-escalation flaws by 2 November 2026.
Wrong ifNo Tailscale fix or advisory for these flaws has appeared in the feeds by 2 November 2026.
Majinahanashi's pending Jons Civil Engineering Company Ltd. (JCEL) post moves from PENDING to published by the end of 29 October 2026, in line with its stated 28 October schedule.
Wrong ifThe JCEL listing is still pending, or has been removed, on 29 October 2026.
f-2026-10-26-2
Confidence0.55
DueMon 9 Nov14d
None of the CGM CLININET CVEs published on 23 October is added to CISA KEV by 9 November 2026.
Wrong ifAny CVE-2025-300xx CLININET entry appearing in KEV on or before 9 November 2026.
At least one new ransomware.live listing from The Gentlemen, Qilin or N0n between 25 and 31 October will be followed by a matching Atlas story 5 to 15 hours later.
Called Sun 25 Oct · due Sat 31 Oct
Qilin claimed ECOM (CH) on ransomware.live at 10:35 on 25 Oct. A matching Qilin Retail & E-Commerce CH story appeared at 17:50, about 7 hours later. Hossner-Textil (DE) at 17:17 was followed by a Qilin Manufacturing/DE story at 23:50, about 6.5 hours later.
The person whose approval an AI agent needs before it does something dangerous. In at least one implementation, this is anyone in the Discord channel who types 'yes'.
§5
From our edge
Live attacks on our own servers in the last 24 hours. Yes, really ours.
Our own servers had the usual unglamorous day. In the last 24 hours the Adversary DNA sensor on our edge profiled 139 hostile sources (63 researchers, 37 bot crawlers, 33 scanners and 4 targeted operators), which sent 4,435 requests between them. 96 went past reconnaissance into exploitation attempts, and 14 groups of addresses shared a behavioural fingerprint. The largest group was 54 IPs with one DNA, probing /threat-check/ paths named after D-Link and TerraMaster RCEs: one tool, or one operator rotating addresses. The highest hostility score, 7.7 out of 10, went to a targeted operator hunting WordPress wlwmanifest.xml and xmlrpc.php under /login/, as if WordPress might be hiding behind a door marked 'login'; its kill chain reached credential access. Another operator asked for /MyAdmin/, /sql/phpmyadmin4/ and /phpMyAdmin6/ at 98 requests a minute, one scanner fired 30 requests in about 3.4 seconds, and three addresses were still spraying CVE-2024-4577 at /index.php. Nobody wore the hood.
139hostile sources profiled
4,435requests from them
96reached exploitation
14shared-DNA clusters
7.7/10top hostility
8,101addresses at our edge
2,307first seen today
116countries
The WTF list
WTF #1
The most determined visitor
143.244.57.90, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
47.79.11.64, a researcher (hostility 0.8/10), sent 10 requests to one of our sites, probing for /threat-check/D-Link%20Multiple%20Routers%20Remote%20Code%20Execution%, /threat-check/TerraMaster%20OS%20Remote%20Command%20Execution%20Vulner.
Why it’s weird54 IPs share one behavioural fingerprint (DNA b77200c2c27d): one tool or one operator rotating addresses: 47.82.52.73, 47.82.55.226, 47.82.54.213, 47.82.50.72, 47.82.55.72 and more.
attribution: unknownSun 25 Oct, 08:00 UTC
Detail
kill chain: reconnaissance → exploitation · DNA b77200c2c27d
WTF #3
Trying CVE-2024-4577 on us
3 addresses sent 14 requests shaped like CVE-2024-4577 exploitation (/index.php), including 94.154.43.199, 185.177.72.7, 2a0f:ca80:b00b:8b48::5.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
probe family: webshell
WTF #4
The strangest shopping list
121.169.40.145, a targeted operator (hostility 6.4/10), sent 128 requests at 98 a minute, probing for /MyAdmin/index.php, /sql/phpmyadmin4/index.php, /mysql/mysqlmanager/index.php, /phpMyAdmin6/index.php.
Why it’s weirdAsked for files almost nobody else asks for: /MyAdmin/index.php, /sql/phpmyadmin4/index.php, /mysql/mysqlmanager/index.php, /phpMyAdmin6/index.php, /sql/webadmin/index.php.
attribution: unknownMon 26 Oct, 00:00 UTC
Detail
kill chain: reconnaissance → weaponization → exploitation · DNA 6e70267a94d8
WTF #5
In a hurry
81.171.72.93, a scanner (hostility 4.7/10), sent 30 requests to one of our sites, probing for /dump.sql, /config.php, /wp-admin/setup-config.php, /config.xml.
Why it’s weirdFired 30 requests in about 3.4 seconds.
attribution: unknownSun 25 Oct, 08:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA ce6ecdfacbe3
§6
Tempo
Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.
192claims, 7 days
41of 267 groups active
N0n36 this week
qilin25 this week
SilentRansomGroup9 this week · surging
Surginglamashtu — 7 claims in 7 days against 1.2 expected from its own prior rate (p < 0.001)
SurgingSilentRansomGroup — 9 claims in 7 days against 2.3 expected from its own prior rate (p < 0.001)
SurgingBrainCipher — 8 claims in 7 days against 1.9 expected from its own prior rate (p < 0.001)
SurgingBooba Project — 6 claims in 7 days against 2.0 expected from its own prior rate (p = 0.018)
Surgingbravox — 3 claims in 7 days against 0.8 expected from its own prior rate (p = 0.049)
Backnitrogen — first claim after 138 days of silence; 0 this week
UpTransportation — 2.2× its own prior share (69 claims, 32 expected)
UpEducation — 1.8× its own prior share (47 claims, 26 expected)
UpHealthcare — 1.4× its own prior share (112 claims, 80 expected)
22% of claims carry no sector label.
Brand churn
Of the 229 leak-site brands first seen since 2021-09-30, 76% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 67% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 19% of the 209 old enough to judge posted on one day and never again; 39% made at least half their claims in their first week. New brands this month: 9 — newest: Whitearmor (2026-10-23, 5 claims), Mimori (2026-10-20, 2 claims), THE SEVEN DEADLY SINS (2026-10-16, 8 claims).
Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.
Targeting
Over the last 180 days, among brands with at least 20 labelled claims: safepay put 35% of its claims on Germany (7.0× every other brand's share); N0n put 34% of its claims on Transportation (7.8× every other brand's share); Storm put 78% of its claims on the United States (2.1× every other brand's share). Widest spread: nightspire across 10.4 effective sectors.
Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.
Posting clock
Over the last 180 days, among brands with at least 30 claims: clop released 92% of its claims on Wednesdays, half of them in 12:00–15:59 UTC; safepay released 63% of its claims on Mondays, half of them in 19:00–19:59 UTC; akira posted only 1 of 194 claims at weekends and half its claims in 12:00–13:59 UTC; half of Deadlock's claims appeared in 12:00–13:59 UTC. Leak sites overall are 37% quieter per weekend day than per weekday.
all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.
Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.
Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers
One email a day. The whole paper. Unsubscribe in one click.
§8
Colophon
How this edition was made, plainly.
Edition 29 was made by machine and checked by code. Every item published by 10 public threat feeds in the 24 hours to 05:05 UK (364 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.00. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.
364items read
24hour window
$0.00cost of this edition
05:05 UTCgenerated
Sources this morning
NVD100ok
Signal Atlas83ok
RansomLook53ok
atlas49ok
infosec.exchange37ok
ransomware.live21ok
Security news13ok
signal:ioc-family5ok
RSS2ok
Ransomware tempo · Ninja Signal graph1ok
ITEMS READ: 364|SOURCES: 10|STORIES DROPPED FOR LACK OF RECEIPTS: 0|COST: $0.00|STATUS: PROBABLY FINE, WITH AN ASTERISK
OWNER: the machine|EDITOR: the rules|CALLS OPEN: 3|NEXT REVIEW: tomorrow 06:00 UK