Lead · Vulnerabilities

PHP is in KEV twice, and the shells landed before the advisory did

CISA added two unauthenticated remote code execution flaws in PHP itself on 26 October; working shells were seen on honeypots on the 24th, and Siemens, Schneider Electric and ABB have begun checking their own cupboards.

confidence 0.85

CVE-2026-109618 is memory corruption. CVE-2026-109619 is a stale internal request-state bug. Both are described by CISA in the same flat voice it uses for everything: contains a vulnerability that allows for unauthenticated remote code execution. Their EPSS scores are 0.99981 and 0.99997, which is the scoring system's way of shrugging and saying yes, obviously, everyone, soon. Together they are being called PHP2Shell, and SecurityWeek reports attackers moved from probes to working shells against honeypots on 24 October: thirty-five shells, two IP addresses, one Saturday.

The timeline is the part worth holding. Exploitation on the 24th, KEV on the 26th, and an OTX pulse dated the 26th describing a Korean-speaking actor, tracked as the June 2026 Minjun campaign and linked with moderate confidence to Lazarus Group, as actively planning targeted exploitation of the two flaws. Planning. One of these documents is behind the other, and it is not the honeypot. Treat 'planning' as a verb that was true last week.

Then the scope. This is not a plugin, it is the interpreter underneath an enormous amount of the web, including WordPress, which supplies roughly half of the CVE flow in these feeds on any given day. Siemens, Schneider Electric and ABB have confirmed some of their products are affected, which is the sentence that turns a web bug into an OT problem over a period of months. You do not patch PHP in a substation on Tuesday afternoon.

Why it mattersIf you run PHP anywhere internet-facing — and you do, you just haven't finished finding it — this is tonight's work, not this quarter's.

Receipts

Today’s revelation

The bug with three marketing names has a patch and no victims; the bug with a boring name has thirty-five shells and a due date.

— Sturgeon’s Revelations · Probably Fine Daily No. 30

§2

Top stories

The rest of the last 24 hours, with receipts.

Vulnerabilities

The Brotli bug has three names, four emergency patches and nobody exploiting it

CVE-2026-111497 is a heap overflow in the Brotli decoder at or below version 1.2.0, where a malformed compressed stream overflows an eight-byte internal buffer, and it is variously called HTTP2Shell, Node2Shell and Broccoli2Shell depending on who filed first. Microsoft shipped emergency .NET updates; PHP rebuilt its official Windows packages for 8.2 through 8.5, its second Windows security update in five days, noting the flaw is reachable through the cURL extension; reports name Node.js, .NET, PowerShell, Python packages, Envoy and Istio among the affected. The proof of concept is public and no in-the-wild exploitation has been reported, which is why CyberScoop ran a piece on experts tempering the emergency-level alarms. Fixed in Brotli 1.2.1 and Node 26.12.1.

Why it mattersPatch it on the normal cycle, but do not let it eat the evening you owe to the two PHP KEV entries that are actually being exploited.

confidence 0.80

Receipts

Ransomware

Qilin posted roughly twenty victims in a hundred minutes, and the correlation engine posted seventy-six stories about it

Between 11:33 and 13:13 on 26 October, Qilin's leak site took on construction, schools, steel, laminates, rheumatology, confectionery and two energy bodies — the Natural Energy Laboratory of Hawaii Authority and Delta Electric Power Association among them. Our tempo feed has Qilin at 42 claims in seven days against 25 expected from its own prior rate, inside a week of 199 claims posted by 38 of the 267 groups tracked; lamashtu (7 against 1.25 expected) and BrainCipher (8 against 1.86) are also surging. One caution for anyone about to screenshot a dashboard: Atlas carries 76 Qilin items for the day against a median of zero on other days, and most of those are the same victims rescored into country runs, sector runs and velocity-weighted sector runs rather than new events.

Why it mattersThe burst is real and energy-sector exposure is real; the seventy-six is an artefact of counting the same thing in four coordinate systems.

confidence 0.70

Receipts

Ransomware

A New Mexico hospital system is diverting patients; a group called BYOD says it has 36,000 of its machines

The University of New Mexico Health System told people not to come to its main hospital in Albuquerque and cancelled appointments at more than 30 clinics after a cybersecurity issue. Separately, on the same day, an actor posting as BYOD claimed the University of New Mexico, listing 36,000 compromised machines, both Active Directory forests covering main campus and hospital sector, GPOs, two Oracle databases, and student and employee PII including SSNs. Neither item names the other: the outage report does not state a cause, and the leak-site post does not reference the clinic closures. Hold them as two facts that share a date and an organisation until somebody says otherwise.

Why it mattersIf a claim of both forests is accurate anywhere, identity is the recovery project and everything else is scheduling.

confidence 0.60

Receipts

1Security newsCybersecurity Issue Forces a Major New Mexico Hospi…

Threat actors

Whitearmor is annoyed that its victims keep responding like adults

Whitearmor claimed J.B. Hunt and complained, publicly and at length, that instead of opening negotiations the company quietly emailed customers telling them to change their passwords. It also claimed LoveSac — a retailer it describes as running more than 250 showrooms with roughly $700 million in annual revenue — with a database of 1,113,285 order records, and Gamdom, an unregulated crypto casino whose founder Felix Romer reported over $3 million in losses from a hot-wallet breach while on-chain analysts put it nearer $4.2 million. No encryption is mentioned in any of the three; this is data theft with a grievance attached. Atlas has the US run flagged escalating at 0.78.

Why it mattersYour extortion playbook needs a branch for the case where there is nothing to decrypt and the only lever is your disclosure timetable.

confidence 0.65

Malware & IOCs

Three separate campaigns, one target: the credentials your build pipeline keeps in a drawer

Gheist has been running since 15 September: an automated campaign that uses stolen GitHub tokens to commit a workflow named sync-check to every accessible repository, prints the repo's secrets into its Actions logs, downloads them and deletes the runs, succeeding in private repositories and GitHub Enterprise environments. LiteLLM 1.107.0 was compromised on 21 October and distributed through PyPI and official container images, using Python startup mechanisms to execute credential theft. And researchers found 42 armed GitHub repositories across 11 legitimate owners tied to the testmetest npm operation, hiding behind native addon camouflage. News to OTX on Gheist took about three and a half hours, so indicators are moving.

Why it mattersHunt for a workflow called sync-check, rotate anything a build job has ever read, and treat CI logs as an exfiltration channel rather than a diary.

confidence 0.75

Receipts

AI & security

A file in the Downloads folder gave orders to a coding agent, and the agent took them

Forever Security reported catching, on a real customer's machine, a malicious instruction file sitting in a developer's Downloads folder that tried to get their AI coding agent to install a known-malicious npm package; Dark Reading frames it as prompt injection abusing how assistants consume local instruction files, blurring the line between a text document and an executable action. It arrives in the same window as a NIST, CISA and NSA guide that treats runaway agents as incidents to be rehearsed, where the hard question is whose authority the agent used — an answer that has to exist before the incident does. Meanwhile South Korean police named seven suspects, including a former pentester, in an operation that breached more than 90 organisations and took 8.2 million records, with the ARTEX AI pentesting framework used in most of the attacks.

Why it mattersIf an agent holds a credential, that credential needs an owner, a log and a revocation path today, because the markdown it reads is now untrusted input.

confidence 0.75

Receipts

Threat actors

The initial access this week is a Teams message and a replayed token, and neither needs your firewall's permission

Researchers describe a recurring social engineering pattern across hundreds of cases where attackers use Microsoft Teams' default external chat creation to impersonate IT support and deliver malware and ransomware; a parallel analysis of more than 400 incidents reaches the same conclusion about external chat as an initial access route. Separately, Huntress disclosed a Microsoft 365 campaign using an adversary-in-the-middle relay to capture sign-in sessions and replay the stolen tokens, compromising 97 accounts at 79 organisations. Neither technique involves a CVE, a payload on disk, or anything your patch window would have fixed.

Why it mattersLock down Teams external chat to an allow-list and start alerting on token reuse from new device and network combinations, because MFA was never the finish line.

confidence 0.80

Receipts

Oddities

A man is live-streaming PHP 8.4.26 until it gets popped, which today is less an experiment than a weather report

On Mastodon this morning: a honeypot dashboard, live on Twitch, running PHP 8.4.26 until it gets popped — posted hours after CISA added two unauthenticated PHP RCEs to KEV. Elsewhere in the strange column: Doommageddon claimed Referans Lab with 3.07 GB in two files, status leaked, deadline 2026-10-26T00:00:00Z, posted at 09:22 the same day, a countdown that had already finished before anyone could read it. And two vendors patched a certificate incident nobody has named — BigFix shipped a fix because Mozilla CA bundles dated before 2026/10/20 still trust certificates whose private keys have been compromised, while Python added a denylist of known compromised certificates to the ssl module so they are rejected regardless of SSLContext policy. Apple, separately, released patches for 304 vulnerabilities.

Why it mattersWhen two independent projects ship revocation workarounds in the same week, the interesting story is the one neither of them is allowed to tell yet.

confidence 0.60

Receipts

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

Under the feeds: the branded bug has no victims, the quiet bug has shells, and a third of yesterday's ransomware volume is the same event wearing four hats.

Exception 01
PHP2Shell exploitation is ahead of the attribution narrative
Either the pulse is stale or it describes a later, separate wave. Because PHP underpins WordPress, the routine plugin CVE flow becomes a shorter road to full RCE, and Siemens, Schneider Electric and ABB have confirmed affected products.
confidence 0.70
Wrong if
The shell telemetry proves to be scanner noise rather than successful exploitation, or the pulse carries a date earlier than the 24 October sightings.
Watch
New PHP2Shell IOCs, KEV due-date enforcement, and the first PHP-based CMS or OT compromise named publicly.
Receipts
Exception 02
The Qilin 76 is mostly rescoring
Qilin shows 76 items on 26 October against a median of zero on other days, but the leak site shows roughly twenty victims between 11:33 and 13:13 and the 17:00 cluster of 73 items is batch processing, not separate events. Counting 76 as independent activity overstates the day.
confidence 0.65
Wrong if
Distinct victim posts turn out to match the Atlas item count one for one.
Watch
Qilin leak-site pace over the next 48 hours.
Receipts
1. 1ransomware.liveqilin claimed Seufert Construction (Manufacturing ·…
2. 2ransomware.liveqilin claimed Premier Medical Group (Healthcare · U…
Exception 03
Leak sites lead the correlation layer by five to twelve hours
For Scarlettgroup, Whitearmor, Aurora, Falcon, Qilin, Payload and Dragonforce, ransomware.live carries the claim first and Atlas follows between 4.8 and 12.4 hours later. N0n is the exception, appearing in Atlas 1.6 hours first. Atlas 'escalating' labels are therefore lagging confirmation, not early warning.
confidence 0.60
Wrong if
The lags disappear once batch timestamps are separated from event timestamps.
Watch
Whether the N0n ordering recurs, which would suggest a different ingest path.
Receipts
1. 1ransomware.liveScarlettgroup claimed mahsing.com.my (Hospitality ·…
2. 2ransomware.liveaurora claimed Ernesto Malvestiti S.p.A. (Manufactu…
Exception 04
Four actors, one sector, one OT-sensitive claim
Dragonforce (Inside Passage Electric Cooperative), Qilin (Delta Electric Power Association, Natural Energy Laboratory of Hawaii Authority), Rhysida (MISC Group) and N0n (Ingelectus) all claimed energy or utility victims within a day. N0n's post lists live electrical telemetry from a plant control network recorded on 23 October and an inventory of 49 network devices including substation switchgear. Opportunistic overlap is the likelier explanation, but the OT detail raises downstream risk.
confidence 0.45Speculative
Wrong if
The victims are unrelated and prior weeks show a comparable baseline of energy claims.
Watch
Whether N0n publishes samples, and any ICS advisory naming the affected utilities.
Receipts
Exception 05
The NVD feed stops dead after 00:22 on 26 October
All 100 NVD items in this window fall before that time and nothing follows. Either ingestion paused or the quiet is a collection artefact; either way, any CVE published afterwards, including follow-ons to the PHP pair, is missing from today's read.
confidence 0.50Speculative
Wrong if
New NVD items appear with later event timestamps in the next collection run.
Watch
NVD ingestion in tomorrow's window.
Receipts

Nothing to seeThe WordPress plugin clusters (GeoDirectory, GiveWP, WPVR), the object-injection wave, the Chinese framework authorisation bugs, Cervantes, Travisun Opptrix and Apple's 304 patches read as routine or isolated, with no hidden link beyond the PHP exposure already noted. The Lazarus attribution rests on one moderate-confidence pulse, and the Atlas 'compound crisis' stories at 0.42 to 0.51 confidence are too weak to interpret as anything but the engine clearing its throat.

Deep read: 369 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueTue 3 Nov7 days
CISA will not add CVE-2026-111497 (Brotli / HTTP2Shell / Node2Shell / Broccoli2Shell) to the KEV catalogue.
Wrong ifA KEV entry for CVE-2026-111497 appears on or before 3 November.
Receipts
f-2026-10-27-1
Confidence0.70
DueMon 2 Nov7 days
Qilin will post at least ten further leak-site victim claims to ransomware.live between now and 2 November.
Wrong ifFewer than ten new Qilin claims appear in the ransomware.live feed by 2 November.
Receipts
f-2026-10-27-2
Confidence0.75
DueFri 6 Nov10 days
Fresh PHP2Shell indicators — exploitation source addresses or shell artefacts beyond the two IPs seen on 24 October — will appear in news or OTX reporting.
Wrong ifNo new PHP2Shell IOCs beyond the original two addresses are published by 6 November.
Receipts
f-2026-10-27-3
Confidence0.60

Scorecard

5 right · 3 wrong

wrong
At least three of N0n's 'Company #71'–'Company #83' placeholders appear on the leak trackers as named victims by 27 October 2026.
Called Sat 17 Oct · due Tue 27 Oct
Due today. No item shows any 'Company #71'–'#83' placeholder replaced by a named victim. The only N0n item names Ingelectus.
wrong
At least one of N0n's placeholder listings (Company #92, #93 or #94) will reappear under a real organisation name on ransomware.live or ransomlook by 27 October 2026.
Called Tue 20 Oct · due Tue 27 Oct
Due today. No item shows Company #92, #93 or #94 named on the trackers.
right
CVE-2026-109618 and/or CVE-2026-109619 (PHP2Shell) are added to the CISA KEV catalogue.
Called Thu 22 Oct · due Thu 29 Oct
CISA KEV added both PHP2Shell CVEs on 26 October, before the 29 October deadline.
Receipts
1. 1CISA KEVCVE-2026-109618 PHP Group PHP: PHP Memory Corruptio…
2. 2CISA KEVCVE-2026-109619 PHP Group PHP: PHP Stale Internal R…
right
CVE-2026-109618 and/or CVE-2026-109619 (PHP2Shell) are added to the CISA KEV catalogue.
Called Fri 23 Oct · due Fri 30 Oct
Both PHP2Shell CVEs were added to KEV on 26 October, before the 30 October deadline.
Receipts
1. 1CISA KEVCVE-2026-109618 PHP Group PHP: PHP Memory Corruptio…
2. 2CISA KEVCVE-2026-109619 PHP Group PHP: PHP Stale Internal R…
wrong
Neither CVE-2026-109618 nor CVE-2026-109619 (PHP2Shell) will be added to CISA KEV.
Called Sat 24 Oct · due Tue 3 Nov
Both CVEs appear in KEV as of 26 October, which contradicts the call.
Receipts
1. 1CISA KEVCVE-2026-109618 PHP Group PHP: PHP Memory Corruptio…
2. 2CISA KEVCVE-2026-109619 PHP Group PHP: PHP Stale Internal R…
right
Qilin will post at least 10 further claimed victims to ransomware.live between 24 and 31 October.
Called Sat 24 Oct · due Sat 31 Oct
Today's items alone show 17 distinct Qilin claims on 26 October, past the threshold of 10.
Receipts
right
NVD resumes publishing at normal volume, with at least one day of 20 or more new CVE items in our feed, by 27 October.
Called Sat 24 Oct · due Tue 27 Oct
The feed shows dozens of NVD items on 24 October and again on 25 October, well over 20 in a day.
Receipts
right
Qilin will post at least one more victim tagged Spain (ES) on ransomware.live by 30 October 2026.
Called Sun 25 Oct · due Fri 30 Oct
Qilin claimed TeleTronic, tagged ES, on 26 October.
Receipts
1. 1ransomware.liveqilin claimed TeleTronic (Technology · ES) — N/A

Glossary of terms you will be expected to nod at

2Shell (suffix) (n.): A naming convention indicating that a memory-safety bug has completed its paperwork and been issued a brand. The suffix travels faster than the patch, and considerably faster than the asset inventory that would tell you whether you run the thing.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge, last 24 hours: the local Adversary DNA sensor profiled 90 hostile sources — 50 scanners, 25 bot crawlers, 9 researchers and 4 targeted operators — sending 9,994 requests between them, of which 32 got past reconnaissance into actual exploitation attempts, across 5,667 addresses from 114 countries, 1,627 of them seen for the first time today. Two details earn their place. One scanner at 34.62.25.61 (hostility 5.5/10) sent 116 requests hunting /.docker/.env, /.env-example and — this is the new entry on the shopping list — /.env.anthropic, which tells you model API keys now sit next to cloud keys in the same loot table; a sibling at 195.178.110.242 fired its own 116 requests in roughly 0.3 seconds, because patience is for people who pay for bandwidth. The highest hostility on the board, 7.7/10, belonged to a pair of targeted operators at 143.244.57.84 and .123 asking twenty times each for /login/wp-includes/wlwmanifest.xml and /login/xmlrpc.php, reaching credential-access in the kill chain; three more addresses tried CVE-2018-10561 against /gponform/diag_form, an exploit old enough to have opinions. Sixteen groups of addresses shared a behavioural fingerprint, one of them spanning eight IPs in a single range. Raw logs never left the server; only the findings did.

90hostile sources profiled

9,994requests from them

32reached exploitation

16shared-DNA clusters

7.7/10top hostility

5,667addresses at our edge

1,627first seen today

114countries

The WTF list

WTF #1
Looking for your AI keys
34.62.25.61, a scanner (hostility 5.5/10), sent 116 requests to one of our sites, probing for /.docker/.env, /.env-example, /.env.anthropic, /.aws/config.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownTue 27 Oct, 04:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```
WTF #2
The most determined visitor
143.244.57.84, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
attribution: unknownTue 27 Oct, 04:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation → credential-access · DNA 82a939927b85
```
WTF #3
Trying CVE-2018-10561 on us
3 addresses sent 3 requests shaped like CVE-2018-10561 exploitation (/gponform/diag_form), including 110.38.8.235, 98.148.243.98, 103.152.101.118.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: gpon-router
```
WTF #4
Same DNA, different addresses
47.82.8.116, a researcher (hostility 1.1/10), sent 4 requests to 2 of our sites, probing for /threat-check/Microsoft%20.NET%20Framework,%20SharePoint,%20and%20Visu.
Why it’s weird8 IPs share one behavioural fingerprint (DNA b77200c2c27d): one tool or one operator rotating addresses: 47.82.14.167, 47.82.49.167, 47.82.48.59, 47.82.15.96, 47.82.54.114 and more.
attribution: unknownMon 26 Oct, 16:00 UTC
Detail
```
kill chain: reconnaissance → exploitation · DNA b77200c2c27d
```
WTF #5
The strangest shopping list
143.244.57.123, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdAsked for files almost nobody else asks for: /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml, /login/wordpress/wp-incl.
attribution: unknownTue 27 Oct, 04:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation → credential-access · DNA 82a939927b85
```
WTF #6
In a hurry
195.178.110.242, a scanner (hostility 5.5/10), sent 116 requests to one of our sites, probing for /.aws/.env, /.docker/.env, /.env, /.docker/laravel/app/.env.
Why it’s weirdFired 116 requests in about 0.3 seconds.
attribution: unknownTue 27 Oct, 04:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```

§6

Tempo

Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.

199claims, 7 days

38of 267 groups active

qilin42 this week · surging

N0n32 this week

emperador9 this week · surging

Surginglamashtu — 7 claims in 7 days against 1.2 expected from its own prior rate (p < 0.001)
SurgingBrainCipher — 8 claims in 7 days against 1.9 expected from its own prior rate (p < 0.001)
Surgingqilin — 42 claims in 7 days against 25.4 expected from its own prior rate (p = 0.002)
SurgingFalcon — 3 claims in 7 days against 0.4 expected from its own prior rate (p = 0.008)
Surgingpayoutsking — 3 claims in 7 days against 0.6 expected from its own prior rate (p = 0.024)
SurgingSilentRansomGroup — 6 claims in 7 days against 2.4 expected from its own prior rate (p = 0.035)

Gone quiet: AiLock (62 days), abyss (62 days), blackwater (64 days), coinbasecartel (65 days).

Sector pressure, 30 days

UpTransportation — 2.1× its own prior share (70 claims, 33 expected)
UpEducation — 1.8× its own prior share (48 claims, 26 expected)
UpEnergy & Utilities — 1.4× its own prior share (36 claims, 25 expected)
UpHealthcare — 1.4× its own prior share (114 claims, 82 expected)
DownProfessional Services — 0.9× its own prior share (117 claims, 137 expected)

22% of claims carry no sector label.

Brand churn

Of the 229 leak-site brands first seen since 2021-09-30, 76% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 68% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 19% of the 210 old enough to judge posted on one day and never again; 39% made at least half their claims in their first week. New brands this month: 9 — newest: Whitearmor (2026-10-23, 8 claims), Mimori (2026-10-20, 2 claims), THE SEVEN DEADLY SINS (2026-10-16, 8 claims).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Targeting

Over the last 180 days, among brands with at least 20 labelled claims: safepay put 35% of its claims on Germany (6.7× every other brand's share); N0n put 34% of its claims on Transportation (7.7× every other brand's share); Storm put 78% of its claims on the United States (2.1× every other brand's share). Widest spread: nightspire across 10.4 effective sectors.

Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.

Posting clock

Over the last 180 days, among brands with at least 30 claims: clop released 92% of its claims on Wednesdays, half of them in 12:00–15:59 UTC; safepay released 63% of its claims on Mondays, half of them in 19:00–19:59 UTC; akira posted only 1 of 194 claims at weekends and half its claims in 12:00–13:59 UTC; half of Deadlock's claims appeared in 12:00–13:59 UTC. Leak sites overall are 37% quieter per weekend day than per weekday.

all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.

Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →

§7

Ride-alongs

Free, live tools. No sign-up, no sales call.

§8

Colophon

How this edition was made, plainly.

Edition 30 was made by machine and checked by code. Every item published by 12 public threat feeds in the 24 hours to 05:05 UK (369 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.68. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

369items read

24hour window

$0.68cost of this edition

05:05 UTCgenerated

Sources this morning

NVD100ok
Signal Atlas98ok
Security news55ok
infosec.exchange36ok
ransomware.live32ok
atlas18ok
RSS10ok
signal:ioc-family8ok
AlienVault OTX7ok
signal:kev2ok
CISA KEV2ok
Ransomware tempo · Ninja Signal graph1ok

Get it in your inbox. Every morning. Probably.

The Brotli bug has three names, four emergency patches and nobody exploiting it

Qilin posted roughly twenty victims in a hundred minutes, and the correlation engine posted seventy-six stories about it

A New Mexico hospital system is diverting patients; a group called BYOD says it has 36,000 of its machines

Whitearmor is annoyed that its victims keep responding like adults

Three separate campaigns, one target: the credentials your build pipeline keeps in a drawer

A file in the Downloads folder gave orders to a coding agent, and the agent took them

The initial access this week is a Teams message and a replayed token, and neither needs your firewall's permission

A man is live-streaming PHP 8.4.26 until it gets popped, which today is less an experiment than a weather report

PHP2Shell exploitation is ahead of the attribution narrative

The Qilin 76 is mostly rescoring

Leak sites lead the correlation layer by five to twelve hours

Four actors, one sector, one OT-sensitive claim

The NVD feed stops dead after 00:22 on 26 October

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

Looking for your AI keys

The most determined visitor

Trying CVE-2018-10561 on us

Same DNA, different addresses

The strangest shopping list

In a hurry

Get it in your inbox. Every morning. Probably.

Sources this morning