Lead · Vulnerabilities

PHP2Shell is on KEV with a Thursday deadline, and every confirmed shell so far landed in a honeypot

CISA says actively exploited; the only published success is 35 shells from two addresses against machines built to be broken into, and that distinction is your Wednesday.

confidence 0.82

Two use-after-free flaws in the PHP engine's session.upload_progress handling, CVE-2026-109618 and CVE-2026-109619, both rated 9.2, both triggering during multipart request processing, collectively marketed as PHP2Shell. On Monday CISA confirmed active exploitation, added them to the Known Exploited Vulnerabilities catalogue, and ordered federal agencies to patch by Thursday. That is the headline, and the headline is true.

The underneath is more interesting. SecurityWeek reports the move from probes to working shells as 35 shells launched from two IP addresses on 24 October, against honeypots. Wiz, which has been watching since public disclosure on 21 October, reports exploitation attempts and no successful compromise observed. An OTX pulse, 31 hours behind the first news report, puts it rather more briskly: UNC actors leveraging public exploit code against public, business and educational infrastructure. Nobody here is lying. Three people are describing the same tide from three different beaches, and only one of them has a camera.

What this means in a room with a patch window in it: the exploit works, reliably, from public code, which is the only part of the question you actually need answered. Siemens, Schneider Electric and ABB have already confirmed that some of their products are affected, which is the industrial sector's traditional way of telling you this will take months. CISA has set Thursday. The tide sets Friday, and it is always Friday.

Why it mattersIf you run PHP anywhere a stranger can post a multipart request, you are in scope today, and the clock is federal.

Receipts

Today’s revelation

Every "actively exploited in the wild" begins life as "somebody's honeypot did its job"; the distance between those two sentences is where your entire week goes.

— Sturgeon’s Revelations · Probably Fine Daily No. 31

§2

Top stories

The rest of the last 24 hours, with receipts.

Vulnerabilities

The bug with four names gets a fifth: CISA KEV, alongside Adobe Commerce

The KEV feed itself carried two additions dated 27 October: CVE-2026-48356, an unrestricted upload of file with dangerous type in Adobe Commerce and Magento leading to arbitrary code execution (EPSS 0.30582), and CVE-2026-111497, an unchecked return value in Google Brotli that lets a remote unauthenticated attacker corrupt adjacent decoder state memory, disclose memory contents, cause denial of service or potentially execute code from a crafted compressed stream (EPSS 0.55483). The Brotli flaw is the one the week has been calling Node2Shell, HTTP2Shell and Broccoli2Shell depending on which press release reached you first, and it reaches into Node.js, .NET, PowerShell and Python packages. Microsoft shipped emergency .NET updates for it. One decoder, four names, one very long asset-inventory conversation.

Why it mattersBrotli is a dependency of your dependencies; KEV status means the question is no longer whether you ship it but where.

confidence 0.85

Receipts

Ransomware

UNM Health diverts ambulances, and the crew that locked it offers the hospital key back for nothing

The University of New Mexico Health System told people not to come to its main hospital in Albuquerque, cancelled appointments at more than 30 clinics, suspended outpatient surgeries and diverted ambulances to systems in Albuquerque and Santa Fe for about two hours on Monday. The leak post from the actor tagged BYOD claims 36,000 machines, both AD forests covering main campus and the hospital sector, GPOs, two Oracle databases and student and employee PII including SSNs. A day later the same actor posted an update offering the decryption key free for the hospital sector only, saying they had not known the machines were assisting patients in real time. The claim arrived on ransomlook first, with the press 4.1 hours behind it.

Why it mattersYour identity estate is the blast radius: two forests and the GPOs that join them is the whole organisation, not a department.

confidence 0.78

Receipts

Ransomware

The off switch had a good week: GMO tells customers to power down, Moldova pulls 80+ services

Japan's GMO Group urged Onamae Desktop Cloud customers to disconnect from the internet and shut their computers down after an intruder who had already breached the platform threatened to detonate ransomware; a widely shared summary puts the exposure at up to 26,739 customer servers, says the roughly ¥8 billion (about $50 million) demand was refused and that stolen data was published. In the same news cycle, Moldova took more than 80 public services offline after a cyberattack. Two organisations, two continents, one control, and it is the control nobody puts on a maturity model because it scores zero for automation.

Why it mattersIf your incident plan has no documented, authorised way to turn large things off quickly, you do not have an incident plan, you have an essay.

confidence 0.70

Receipts

Ransomware

Monday was the loudest leak-site day of the window: 291 of 524 items landed on 27 October

Ninja Signal's tempo for today counts 203 leak-site claims in seven days from 40 of the 267 groups tracked, with Booba Project surging at 10 claims against 2.4 expected from its own prior rate, qilin at 44 against 25.41, and everest at 10, all at p below 0.001. The day-level picture is starker: Everest posted 28 items on 27 October against a median of zero on other days, Booba Project 26, Play 24, The Gentlemen 21 (and 31 the day before under a different spelling), WhiteArmor 13. The named victims are the usual spread of ordinary organisations — Bristol City Council claimed by Wallstreet, two US credit unions by qilin, the Belgian municipality of Machelen by rhysida with 1.3 million files and about 2.9 TB. Caveat worth holding: ransomlook and ransomware.live mirror each other with lags of one to twenty-five hours, so a good share of the apparent corroboration is the same post, seen twice.

Why it mattersBatch posting looks like a campaign on a chart; count distinct victims, not distinct feed rows, before you brief anyone.

confidence 0.65

Receipts

AI & security

Model keys are now loot: a stealer for developer keyrings, poisoned instruction files, and a breach of agent decision logs

Four separate items, one direction of travel. The 'Aokigahara' stealer targets developer keyrings and AI assistants, exposing AI sessions, business data and developer infrastructure from one endpoint. A technique seen in the wild abuses how coding assistants consume local Markdown instruction files, which blurs the line between a text document and an executable action. Warp disclosed a breach at a third-party vendor that exposed AI agent decision logs and user telemetry. And unprotected Cairn AI intrusion-testing harnesses have been systematically compromised since around 20 October by automated campaigns inserting malicious tasks. Meanwhile NIST, CISA and NSA have published guidance treating runaway agents as incidents to be rehearsed, where the hard question is whose authority the agent used — and that answer has to exist before the incident does.

Why it mattersAgent identity, agent memory and agent logs are now production assets with production consequences; inventory them before someone else enumerates them for you.

confidence 0.72

Receipts

Vulnerabilities

Tailscale is patching almost a dozen SSH flaws in public, because the details went out before the fixes did

The Tailscale security team is working through close to a dozen vulnerabilities in Tailscale SSH that could be used to steal credentials, crash servers and gain root privileges. Details of the set, dubbed 'Tailworm', went public over the weekend before any fixes had shipped, so the vendor is now writing patches with an audience. There is no exploitation reported in these items; there is, however, a published map.

Why it mattersTailscale SSH sits on the path into things you consider internal; know whether you have it enabled before you decide this is somebody else's story.

confidence 0.78

Receipts

Vulnerabilities

A 9.5 in UEFI firmware, below the operating system and below Secure Boot

Reported this morning via infosec Mastodon pointing at Ars Technica: CVE-2026-97631 in TianoCore EDK II, the open-source UEFI codebase baked into firmware by most server vendors and cloud providers, rated 9.5. The flaw is a memory-corruption issue in an ICMP component that allows code execution before the operating system loads, and the posts are explicit that Secure Boot does not protect you because the chain of trust is itself the weak point. Remediation is firmware updates from your server or cloud provider. One sourcing caveat, stated plainly: in our window this arrived through social posts and a linked news story, not through NVD or KEV.

Why it mattersIf it lands below the OS, none of your endpoint telemetry is a witness; this is a vendor-firmware campaign, not a patch Tuesday.

confidence 0.55

Receipts

Oddities

The leak site that cannot confirm its own victims exist

Everest's burst of claims on 27 October arrived with AI-generated victim descriptions, several of which decline to play along: of 'SleepEx LabRetriever', the blurb says it does not correspond to any organisation that can be verified and the name's unusual construction suggests it may be fictional or a test; 'Burris & MacOmber' and 'Point Robotics' get similar treatment; three others just say N/A. Elsewhere, the actor ULose published two entries to its leak site named 'zzq-test' and 'probe-011637cabbf94076', country code 'zz', which is what testing in production looks like when the production is extortion. And WhiteArmor took time out of a busy posting day to tell KuCoin, in writing, that it is not a hacktivist group and focuses mainly on data extortion and ransomware, which is the closest thing this week has produced to a mission statement.

Why it mattersVictim counts on leak sites are marketing artefacts; treat an unverified name as unverified until something outside the leak site says otherwise.

confidence 0.68

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

One real cross-feed vulnerability story, a mountain of mirrored leak posts, and two feeds that stopped at the same minute.

Exception 01
PHP2Shell: the news led the threat feed by 31 hours, and the sources disagree about impact
The same CVE pair appears in cyber-news, OTX and RSS. Cyber-news reported first; OTX followed 31 hours later with a pulse describing UNC actors against public, business and education targets, while Wiz reports attempts and no successful compromise. The 35 working shells came from honeypots, so they demonstrate that the exploit code works, not that anyone has been compromised. Do not brief the OTX pulse as confirmed victim compromise.
confidence 0.60
Wrong if
A named victim, or telemetry from a non-honeypot environment, showing successful compromise.
Watch
The KEV deadline on Thursday, vendor patch notes, and whether OTX or Wiz revise their claims in the next 48 hours.
Receipts
Exception 02
The KEV entries we hold are not the PHP CVEs
Cyber-news and RSS both report that CISA added the PHP2Shell flaws to KEV with a Thursday deadline. The two KEV items in our own window, dated 27 October, are CVE-2026-48356 (Adobe Commerce and Magento) and CVE-2026-111497 (Google Brotli). Both things can be true, and the simplest reading is that our KEV pull is incomplete, but we cannot confirm the PHP listing from the catalogue data we have.
confidence 0.35Speculative
Wrong if
Reading the live KEV catalogue and finding CVE-2026-109618 and CVE-2026-109619 listed, or not.
Watch
The next KEV pull.
Receipts
Exception 03
The 27 October burst may be a scrape, not a wave
291 of 524 items in the window fall on 27 October, with Everest, Booba Project, Play, The Gentlemen and WhiteArmor all spiking against near-zero medians. No timing clusters were detected, and ransomware.live typically leads ransomlook by one to two hours on the same posts, which is mirroring rather than corroboration. This is consistent with batch posting or a scraping effect as much as a coordinated campaign.
confidence 0.40Speculative
Wrong if
If the 27 October items share a single scrape time or backfill, or the same posts carry earlier dates elsewhere, it is an ingestion artefact.
Watch
Daily counts for these groups on 28 and 29 October; a fall back to baseline means one-off batch.
Receipts
1. 1ransomware.liveBooba Project claimed Regent Christian Online Acade…
2. 2RansomLookwhitearmor leaked Kucoin — Dear Kucoin, We are NOT…
Exception 04
NVD and SafePay both go silent at 2026-10-27T01:31
The NVD feed (81 items) and the SafePay actor (9 items) stop at the same minute. An identical cutoff across an unrelated vulnerability source and a single ransomware crew points at a shared collection boundary, not at two independent real-world events. SafePay's burst on 26 October followed by total silence is most likely the same artefact.
confidence 0.50Speculative
Wrong if
New NVD entries or SafePay posts timestamped after 2026-10-27T01:31.
Watch
The next NVD pull; if it is still empty, the pipeline is broken and should be treated as such.
Receipts

Nothing to seeNo timing clusters were found anywhere in the window. Most cross-source ransomware overlap is ransomlook and ransomware.live carrying the same leak post twice, which is not independent corroboration however satisfying it looks on a graph. The OTX 'UNC actors' claim carries no attribution detail we can see. Many of the 'x:' entities are duplicates of the 'actor:' entities and should not be counted twice.

Deep read: 525 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueWed 4 Nov7 days
No named, non-honeypot organisation will be publicly reported in these feeds as successfully compromised via CVE-2026-109618 or CVE-2026-109619 by 4 November.
Wrong ifAny vendor report, press story or leak-site post naming a real victim organisation compromised through PHP2Shell.
Receipts
f-2026-10-28-1
Confidence0.60
DueWed 4 Nov7 days
Booba Project will post at least five further leak-site claims across ransomware.live or ransomlook by 4 November.
Wrong ifFewer than five new Booba Project or booba team victim posts in that window.
Receipts
1. 1Ransomware tempo · Ninja Signal graphNinja Signal ransomware tempo for 2026-10-28. In th…
2. 2ransomware.liveBooba Project claimed Regent Christian Online Acade…
f-2026-10-28-2
Confidence0.65
DueSat 31 Oct72h
NVD items timestamped after 2026-10-27T01:31 will appear in our feed by 31 October, confirming the silence was an ingestion boundary rather than a halt at the source.
Wrong ifThe NVD feed remains empty past 31 October, which makes it our pipeline and our problem.
Receipts
1. 1NVDCVE-2026-116048: A vulnerability was detected in kr…
2. 2RansomLooksafepay leaked goldencrops.com.tw — The company spe…
f-2026-10-28-3
Confidence0.75

Scorecard

3 right · 1 partly · 2 wrong

right
Public reporting of in-the-wild exploitation of CVE-2026-103849 in Magento or Adobe Commerce appears in the news feeds by 31 October 2026.
Called Sat 17 Oct · due Sat 31 Oct
CISA KEV added CVE-2026-48356 (Adobe Commerce and Magento) on 2026-10-27, confirming active exploitation before 31 October deadline
Receipts
1. 1CISA KEVCVE-2026-48356 Adobe Commerce and Magento: Adobe Co…
wrong
A public proof of concept or in-the-wild exploitation report appears for the Magento BlockStrap flaw CVE-2026-103849.
Called Sun 18 Oct · due Wed 28 Oct
No PoC or exploitation report for CVE-2026-103849 (Magento BlockStrap flaw) appears in today's feeds; the KEV addition is for CVE-2026-48356, a different Adobe Commerce CVE, and the due date of 28 October has now passed
Receipts
1. 1CISA KEVCVE-2026-48356 Adobe Commerce and Magento: Adobe Co…
right
At least one named Booba Project victim appears on a leak-site tracker, giving the escalating healthcare alerts something to stand on.
Called Thu 22 Oct · due Thu 29 Oct
Booba Project posted multiple named victim claims on ransomware.live/ransomlook on 2026-10-27, well before the 29 October deadline
Receipts
partly
Tailscale publishes a fix or advisory for the Tailscale SSH port-forwarding privilege-escalation flaws by 2 November 2026.
Called Mon 26 Oct · due Mon 2 Nov
Tailscale published an advisory warning of SSH privilege-escalation flaws and announced patches are being rushed, but fixes not yet released as of today's feeds; deadline is 2 November
Receipts
wrong
CISA will not add CVE-2026-111497 (Brotli / HTTP2Shell / Node2Shell / Broccoli2Shell) to the KEV catalogue.
Called Tue 27 Oct · due Tue 3 Nov
CISA KEV added CVE-2026-111497 (Google Brotli / Node2Shell / HTTP2Shell / Broccoli2Shell) on 2026-10-27, falsifying the prediction
Receipts
1. 1CISA KEVCVE-2026-111497 Google Brotli: Google Brotli Unchec…
right
Fresh PHP2Shell indicators — exploitation source addresses or shell artefacts beyond the two IPs seen on 24 October — will appear in news or OTX reporting.
Called Tue 27 Oct · due Fri 6 Nov
OTX and SecurityWeek reporting on 2026-10-27 describe exploitation from two IPs on 24 October and broader UNC actor exploitation, with additional IOC details published beyond the original two addresses
Receipts

Glossary of terms you will be expected to nod at

In the wild (n.): Observed on a machine that was placed on the internet for the express purpose of being observed. Promoted, in the retelling, to the machine you own, and then to the deadline you have been given.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge, last 24 hours: the local Adversary DNA sensor profiled 40 hostile sources — 25 scanners, 13 bot crawlers, two targeted operators — which between them sent 7,920 requests; 13 went past reconnaissance into exploitation attempts, and four groups of addresses shared a behavioural fingerprint. The shopping list has been updated for the era: 34.156.56.233, hostility 5.6 out of 10, sent 228 requests across two of our sites asking for /.env.anthropic, /.aws/.env, /.aws/credentials and /.aws/config, which is model API keys filed next to cloud keys like they have always been there. 35.241.239.86 fired 117 requests in about half a second, entirely at AWS credential paths. Three addresses, 24 requests, sprayed CVE-2017-9841 at us through /vendor/phpunit/phpunit/, and eight IPs shared one fingerprint (DNA 672df8667b3d), which is one tool or one operator rotating addresses while the spreadsheet calls them eight adversaries. In total 4,549 addresses from 96 countries touched the edge, 1,746 of them seen here for the first time today. Raw logs never left the server; only these findings did.

40hostile sources profiled

7,920requests from them

13reached exploitation

4shared-DNA clusters

6.7/10top hostility

4,549addresses at our edge

1,746first seen today

96countries

The WTF list

WTF #1
Looking for your AI keys
34.156.56.233, a scanner (hostility 5.6/10), sent 228 requests to 2 of our sites, probing for /.env.anthropic, /.aws/.env, /.aws/credentials, /.aws/config.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownTue 27 Oct, 22:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 9427f6c77bf1
```
WTF #2
The most determined visitor
20.24.222.184, a scanner (hostility 6.5/10), sent 42 requests to one of our sites, probing for /file2.php, /general.php, /666.php, /file.php.
Why it’s weirdHighest hostility on the board; its kill chain reached weaponization.
attribution: unknownTue 27 Oct, 22:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA dfef4501b216
```
WTF #3
Trying CVE-2017-9841 on us
3 addresses sent 24 requests shaped like CVE-2017-9841 exploitation (/vendor/phpunit/phpunit/…), including 185.238.231.89, 94.26.0.103, 185.177.72.29.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: phpunit-rce
```
WTF #4
Same DNA, different addresses
94.180.163.194, a bot crawler (hostility 1.2/10), sent 60 requests to one of our sites, probing for /threat-check/%22Next%20Exploit%20Opportunities%22%3A%20How%20a%20Thre.
Why it’s weird8 IPs share one behavioural fingerprint (DNA 672df8667b3d): one tool or one operator rotating addresses: 94.180.163.194, 85.208.96.208, 185.191.171.10, 85.208.96.204, 85.208.96.197 and more.
attribution: unknownTue 27 Oct, 08:00 UTC
Detail
```
kill chain: reconnaissance → exploitation · DNA 672df8667b3d
```
WTF #5
The strangest shopping list
20.53.239.152, a scanner (hostility 6.4/10), sent 46 requests to one of our sites, probing for /wk/index.php, /inputs.php, /ioxi-o.php, /function/function.php.
Why it’s weirdAsked for files almost nobody else asks for: /wk/index.php, /inputs.php, /ioxi-o.php, /function/function.php, /rip.php.
attribution: unknownTue 27 Oct, 08:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 83562bd8e880
```
WTF #6
In a hurry
35.241.239.86, a scanner (hostility 5.5/10), sent 117 requests to one of our sites, probing for /.aws/.env, /.aws/credentials.bak, /.aws/config, /.aws/credentials.
Why it’s weirdFired 117 requests in about 0.5 seconds.
attribution: unknownTue 27 Oct, 22:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```

§6

Tempo

Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.

203claims, 7 days

40of 267 groups active

qilin44 this week · surging

N0n24 this week

Whitearmor11 this week · new

SurgingBooba Project — 10 claims in 7 days against 2.4 expected from its own prior rate (p < 0.001)
Surgingqilin — 44 claims in 7 days against 25.4 expected from its own prior rate (p < 0.001)
Surgingeverest — 10 claims in 7 days against 2.8 expected from its own prior rate (p < 0.001)
SurgingFalcon — 3 claims in 7 days against 0.4 expected from its own prior rate (p = 0.008)
Surgingpayoutsking — 3 claims in 7 days against 0.6 expected from its own prior rate (p = 0.024)
Surgingrhysida — 4 claims in 7 days against 1.2 expected from its own prior rate (p = 0.039)

Gone quiet: lynx (60 days), AiLock (63 days), abyss (63 days), blackwater (65 days).

Sector pressure, 30 days

UpTransportation — 2.1× its own prior share (70 claims, 33 expected)
UpEducation — 2.0× its own prior share (52 claims, 26 expected)
UpEnergy & Utilities — 1.5× its own prior share (38 claims, 25 expected)
UpHealthcare — 1.4× its own prior share (116 claims, 81 expected)

22% of claims carry no sector label.

Brand churn

Of the 229 leak-site brands first seen since 2021-09-30, 76% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 68% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 19% of the 210 old enough to judge posted on one day and never again; 39% made at least half their claims in their first week. New brands this month: 9 — newest: Whitearmor (2026-10-23, 11 claims), Mimori (2026-10-20, 2 claims), THE SEVEN DEADLY SINS (2026-10-16, 8 claims).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Targeting

Over the last 180 days, among brands with at least 20 labelled claims: safepay put 35% of its claims on Germany (6.8× every other brand's share); N0n put 34% of its claims on Transportation (7.7× every other brand's share); Storm put 78% of its claims on the United States (2.1× every other brand's share). Widest spread: nightspire across 10.4 effective sectors.

Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.

Posting clock

Over the last 180 days, among brands with at least 30 claims: clop released 92% of its claims on Wednesdays, half of them in 12:00–15:59 UTC; safepay released 63% of its claims on Mondays, half of them in 19:00–19:59 UTC; akira posted only 1 of 193 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 37% quieter per weekend day than per weekday.

all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.

Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →

§7

Ride-alongs

Free, live tools. No sign-up, no sales call.

§8

Colophon

How this edition was made, plainly.

Edition 31 was made by machine and checked by code. Every item published by 13 public threat feeds in the 24 hours to 05:05 UK (525 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $1.02. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

525items read

24hour window

$1.02cost of this edition

05:05 UTCgenerated

Sources this morning

RansomLook100ok
Signal Atlas98ok
Security news88ok
NVD81ok
atlas41ok
ransomware.live41ok
infosec.exchange36ok
signal:ioc-family12ok
AlienVault OTX12ok
RSS11ok
signal:kev2ok
CISA KEV2ok
Ransomware tempo · Ninja Signal graph1ok

Get it in your inbox. Every morning. Probably.

The bug with four names gets a fifth: CISA KEV, alongside Adobe Commerce

UNM Health diverts ambulances, and the crew that locked it offers the hospital key back for nothing

The off switch had a good week: GMO tells customers to power down, Moldova pulls 80+ services

Monday was the loudest leak-site day of the window: 291 of 524 items landed on 27 October

Model keys are now loot: a stealer for developer keyrings, poisoned instruction files, and a breach of agent decision logs

Tailscale is patching almost a dozen SSH flaws in public, because the details went out before the fixes did

A 9.5 in UEFI firmware, below the operating system and below Secure Boot

The leak site that cannot confirm its own victims exist

PHP2Shell: the news led the threat feed by 31 hours, and the sources disagree about impact

The KEV entries we hold are not the PHP CVEs

The 27 October burst may be a scrape, not a wave

NVD and SafePay both go silent at 2026-10-27T01:31

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

Looking for your AI keys

The most determined visitor

Trying CVE-2017-9841 on us

Same DNA, different addresses

The strangest shopping list

In a hurry

Get it in your inbox. Every morning. Probably.

Sources this morning