Lead · Vulnerabilities

The deadline was Thursday. It is Thursday.

CISA put the two PHP2Shell use-after-free flaws on the exploited list and ordered federal agencies to patch by today, while one suspected China-nexus operator has already rooted 25 servers and reached a US government-affiliated network.

confidence 0.85

CVE-2026-109618 and CVE-2026-109619 are both rated 9.2, both sit in the PHP engine's session.upload_progress handling, and both trigger during multipart request processing, which is to say during the ordinary act of someone uploading a file to a website. CISA confirmed active exploitation, added them to the Known Exploited Vulnerabilities catalog, and gave federal agencies until Thursday. You are reading this on Thursday.

The exploitation is not theoretical, but it is also not uniform. On 25 October, researchers observed what they describe as an AI-assisted attack by a suspected China-nexus actor that rooted 25 servers and breached a US government-affiliated network, chaining PHP2Shell with a second exploit called Fragnesia to get root on firewalls, taking two servers at that one organisation. Separately, an exposed staging server at 96.126.130.81 showed an operator who spent 9 to 11 October extorting Japanese real-estate websites and then picked up PHP2Shell tooling, because the tooling was lying there. Wiz, who have been watching since public disclosure on 21 October, say they have seen attempts but no successful attacks in their own telemetry.

And on Mastodon yesterday morning, a working malware analyst asked, in public, whether in-the-wild exploitation of PHP2Shell had actually been confirmed yet, because she had heard conflicting things. She is right to ask and the vendors are right to report. Both of those sentences are true at once, which is the normal condition of a Thursday. Meanwhile an infrastructure report notes the flaws reach the web management interfaces of firewalls, VPNs and application delivery controllers, which is where you put the thing that is not supposed to be reachable.

Why it mattersIf PHP is reachable from a management interface anywhere in your estate, the window for discovering that closed before the coffee did.

Receipts

Today’s revelation

A vulnerability with a brand name is patched before a vulnerability with only a number, which tells you that our prioritisation engine is, and has always been, marketing.

— Sturgeon’s Revelations · Probably Fine Daily No. 32

§2

Top stories

The rest of the last 24 hours, with receipts.

Vulnerabilities

One Brotli bug, three names, and at least one attacker whose exploit does not work

CISA added CVE-2026-111497 to the exploited catalog on Tuesday: an unchecked return value and out-of-bounds write in Google's Brotli decoder, which ships inside Node.js and a long tail of other packages, and which the internet has decided to call Node2Shell, Broccoli2Shell and HTTP2Shell depending on who is tweeting. Two honeypot operators logged attempts, one of them using an exploit that was simply broken. In the same window, attackers started probing for the freshly patched Oracle E-Business Suite flaw CVE-2026-101767, rated 9.8, days after the fix landed.

Why it mattersBrotli is a dependency you did not choose and cannot see on an asset list; find it by build manifest, not by product name.

confidence 0.80

Receipts

Vulnerabilities

CISA has added a vulnerability whose entire impact is that you will not know

Alongside the headline flaws, KEV quietly took CVE-2026-41709 in Broadcom VMware ESX: an insufficient logging vulnerability that lets an actor with admin access perform certain operations without being logged, carrying an EPSS of 0.00297. It also took CVE-2026-46300, a missing initialisation of a variable in the Linux kernel at EPSS 0.10192, and CVE-2026-48356, an unrestricted file upload in Adobe Commerce and Magento that can lead to arbitrary code execution. One of these gets you code. One of these gets you a silence in the timeline where the evidence should be.

Why it mattersAn ESX logging gap is not a detection problem on Tuesday, it is an incident-report problem in March; patch it and check your retention while you are in there.

confidence 0.82

Receipts

Ransomware

GMO told 26,739 servers to turn themselves off, refused ¥8bn, and is now paying for names

GMO Internet urged Onamae Desktop Cloud customers to disconnect from the internet and power their servers down before a ransomware payload planted during the intrusion could fire; up to 26,739 customer servers may be affected, the ¥8bn (about $50m) demand was refused, and stolen data was published anyway. On 28 October the group opened a reward programme paying up to $1m in total for tips that lead to an arrest or an indictment. It is a busy fortnight in Japan: Japan Airlines has warned that passport numbers, frequent flyer numbers, email addresses and phone numbers for about 2,000 customers were taken, Sony Network Communications has confirmed roughly 2.5 million records, and researchers describe three attacks on Japanese targets in which one operation ran 44 AI agents to automate the work.

Why it mattersIf you host customer workloads, write down now who has authority to tell every tenant to power off, because that decision has to be made in minutes and it will not be made by a dashboard.

confidence 0.75

Receipts

Ransomware

The hospital outage reached the feeds seventeen hours before the statement did

On Monday evening a leak-site post from an actor tracked as byod claimed 36,000 machines at the University of New Mexico, both Active Directory forests covering main campus and the hospital sector, group policy objects, two Oracle databases and student and employee personal data including social security numbers. The next afternoon UNM Health confirmed a cyberattack with system outages: ambulances diverted for about two hours on Monday to health systems in Albuquerque and Santa Fe, and outpatient surgeries and appointments suspended for the remainder of the day. The claim preceded the public reporting by about 17.6 hours.

Why it mattersLeak-site monitoring is not intelligence theatre; for your sector peers it is frequently the earliest signal you will get that a shared supplier or neighbour is down.

confidence 0.80

Receipts

Ransomware

The Gentlemen do not run an attack campaign, they run a content calendar

On 26 October the group posted 31 items against a median of 4.5 on other days, roughly 22 victims inside about two hours, each entry accompanied by a tidy corporate biography: Vietnam Airlines, a claim against SAP's Latin America and Caribbean arm, FPT Software, the water technology firm WABAG, Cherry Bekaert, SK Capital Partners, the Swedish municipality of Svedala and the Bavarian town of Eichstätt. Ransomlook carried the batch about 27 hours before Atlas reflected it, so most of the apparent corroboration across trackers is mirroring, not confirmation. Across the whole board, the week's tempo shows 192 leak-site claims from 38 of 267 tracked groups, with Booba Project surging to 10 claims against 2.38 expected from its own prior rate, rhysida at 6 against 1.29, and qilin at 39.

Why it mattersSeveral of the named victims are IT and software providers, so the disclosures that matter to you may arrive via a supplier two weeks from now rather than from this list today.

confidence 0.70

AI & security

The models are now on both sides of the engagement, and somebody is attacking the attack robots

Anthropic reported that an unreleased model found flaws in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits, built in the lab after prompting rather than observed in the wild. Researchers analysing three exposed server environments described a Japan-focused operation running 44 AI agents to automate intrusion work, and a separate exposed staging server laid out an n0n ransomware operator's complete AI-assisted extortion workspace, encryptor source and all. Meanwhile unprotected Cairn AI intrusion harnesses are being systematically compromised by unknown actors since around 20 October, and a different attacker has been scanning relentlessly for credentials while impersonating crawlers from OpenAI, Anthropic and Meta.

Why it mattersTreat your agent infrastructure as production attack surface: it holds credentials, it acts, and other people's automation is already looking for it.

confidence 0.72

Receipts

Policy

A good week for the other side of the ledger, which we should write down before we forget it

The FBI seized virtualine[.]net on 27 October under Operation Omegaline, taking the primary domain of a bulletproof hoster that also traded as Omegatech on AS202412 and was advertised on criminal forums. The Australian Signals Directorate got inside the backend of an Amadey operation and cut the operator off from 180,000 infected computers worldwide. Interpol's third Operation Serengeti produced 1,462 arrests across 20 African countries and the United States and recovered $105m, and Artem Stryzhak, 36, was sentenced to 70 months for his role in Nefilim and Hive attacks on hospitals, government bodies and large businesses between 2018 and 2021.

Why it mattersInfrastructure seizures move indicators and rotate hosting; expect your Virtualine-linked blocklists to go stale and your actors to reappear somewhere cheaper.

confidence 0.85

Receipts

Oddities

Keystone is destroying 18,835 hardware wallets because the thing that proves they are real stopped proving it

An attacker who gained access to Keystone's website obtained the key its hardware wallets use to prove they are genuine, meaning someone could build counterfeit devices that pass the online check an owner uses to verify a Keystone; the company said on 26 October it will destroy 18,835 devices. Elsewhere in the archaeology department, the long-dead Popcorn Time updater turns out to have run at system boot, periodically polling its update domain and executing whatever it was served, with full privileges, on millions of computers.

Why it mattersAttestation is only as good as the secret behind it; if you rely on a vendor's genuineness check, ask where that key lives and who can reach it from a web server.

confidence 0.78

Receipts

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

Most of today's apparent cross-source confirmation is three trackers reading the same leak post at different speeds.

Exception 01
Mirroring is not corroboration
Whitearmor, n0n, rhysida, akira, aurora and panzer appear 'multi-source' only because ransomlook, ransomware.live and Atlas ingest the same leak posts with lags of roughly 1 to 37 hours. Payload and Aurora also show identical Atlas confidence values, which looks like a correlation artefact. Do not count these as independent confirmation.
confidence 0.70
Wrong if
The sites showing independent discovery methods or materially different content for the same victim.
Watch
Whether the ransomlook-first lag pattern holds in the next window.
Receipts
1. 1RansomLookwhitearmor leaked Gamdom — Gamdom is an unregulated…
Exception 02
Six WooCommerce payment plugins, one identical hole
CCAvenue, Eurobank, Mintpay, iK Pay, OPay and a plugin simply named Payment Gateway all fail to verify that a payment-confirmation callback came from the provider, in several cases because the verification secret is empty on a default install, letting an unauthenticated attacker mark arbitrary orders paid, failed or cancelled. The pattern suggests one researcher or one tool sweeping the plugin ecosystem.
confidence 0.55Speculative
Wrong if
The CVEs tracing to unrelated researchers finding independently different code paths.
Watch
More gateway plugins disclosed in the next fortnight, and any exploitation reports.
Receipts
Exception 03
The EDK II scope dispute is unresolved
SecurityWeek describes CVE-2026-97631 in TianoCore EDK II as affecting machines only while they boot over the network; the Ars-derived post describes it as hitting most servers on the planet with Secure Boot offering no protection, severity 9.5. The Mastodon thread ran about seven hours ahead of the news copy. Until the advisory's affected-configuration text settles it, assume your network-booting fleet is in scope and the rest is unconfirmed.
confidence 0.55
Wrong if
Vendor firmware advisories stating the affected configurations explicitly.
Watch
Server and cloud vendor firmware bulletins.
Receipts
Exception 04
OTX led KEV on one PHP2Shell CVE
OTX carried CVE-2026-109619 about 7.6 hours before CISA listed it, while for the Brotli flaw CVE-2026-111497 the order reversed and KEV led OTX by about 46.4 hours. Neither source is reliably first; if you only watch one, you are late roughly half the time.
confidence 0.65
Wrong if
A longer sample showing a consistent lead for one source.
Watch
Lead-lag on the next two KEV additions.
Receipts
Exception 05
Four sources stopped at the same minute, which is a feed boundary, not a ceasefire
NVD, Safepay, Everest and Booba Team all drop out of the window after 2026-10-27T15:56. A shared cutoff to the minute across one data source and three unrelated actors is an ingestion artefact, not four coincident real-world pauses. Their prior activity was bursty: Safepay 9, Everest 8 and Booba 8 items in a day.
confidence 0.60Speculative
Wrong if
New items from those actors or NVD with event times after the cutoff appearing in the next window.
Watch
Next window's source counts for NVD and those three actors.
Receipts

Nothing to seeNo timing clusters surfaced. There is no evidence linking Volt Typhoon's Silent Train framework to PHP2Shell, and nothing beyond shared geography connecting the GMO, JAL, Sony and CyberStrikeAI incidents in Japan. The CVE numbering oddities are weak and batch reservation explains them. The law-firm claims from leakeddata are low quality and unconfirmed.

Deep read: 632 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueThu 5 Nov7 days
CISA adds at least one further vulnerability to the Known Exploited Vulnerabilities catalog.
Wrong ifNo new KEV entries appear in these feeds between 29 October and 5 November.
Receipts
f-2026-10-29-1
Confidence0.90
DueSun 8 Nov10 days
The Gentlemen post at least five new named victims to their leak site in a single day.
Wrong ifNo day between 29 October and 8 November shows five or more Gentlemen victim posts on ransomlook or Atlas.
Receipts
1. 1Ransomware tempo · Ninja Signal graphNinja Signal ransomware tempo for 2026-10-29. In th…
f-2026-10-29-2
Confidence0.55
DueMon 9 Nov11 days
A public vendor or CERT report names a third distinct operator using PHP2Shell, beyond the suspected China-nexus actor and the Japanese real-estate extortion staging server.
Wrong ifNo such report appears in these feeds by 9 November.
Receipts
f-2026-10-29-3
Confidence0.45

Scorecard

2 right · 2 partly · 1 open

open
Majinahanashi's pending Jons Civil Engineering Company Ltd. (JCEL) post moves from PENDING to published by the end of 29 October 2026, in line with its stated 28 October schedule.
Called Mon 26 Oct · due Thu 29 Oct
No JCEL listing status (published or still pending) visible in today's feed items; due date is today 29 October.
partly
Qilin will post at least ten further leak-site victim claims to ransomware.live between now and 2 November.
Called Tue 27 Oct · due Mon 2 Nov
Qilin posted at least 2 claims visible in today's feed (Hawaii Law Enforcement FCU, NuVista FCU) but tempo signal notes 39 Qilin claims in last 7 days, strongly suggesting ≥10 new claims since 27 Oct; due date 2 November not yet passed so cannot fully settle.
Receipts
partly
No named, non-honeypot organisation will be publicly reported in these feeds as successfully compromised via CVE-2026-109618 or CVE-2026-109619 by 4 November.
Called Wed 28 Oct · due Wed 4 Nov
China-linked actors exploited PHP2Shell (CVE-2026-109618/19) and rooted firewalls including breaching a US government-affiliated network, and CISA confirmed active exploitation, but no specific named non-honeypot victim organisation was publicly attributed by name in these feeds; due date 4 November not yet passed.
Receipts
right
Booba Project will post at least five further leak-site claims across ransomware.live or ransomlook by 4 November.
Called Wed 28 Oct · due Wed 4 Nov
Booba Project posted at least 8 named victim claims on 27 October alone (Hudson River Museum, BASS Medical Group, Kerckstede vzw, RCOA, Charter Township of Commerce, KING FAMILY MEDICAL, City of Big Spring, Aesthetic Specialty Centre), exceeding the threshold of 5 by 28 October.
right
NVD items timestamped after 2026-10-27T01:31 will appear in our feed by 31 October, confirming the silence was an ingestion boundary rather than a halt at the source.
Called Wed 28 Oct · due Sat 31 Oct
NVD items with timestamps from 2026-10-25 and 2026-10-26 appear in today's feed, confirming the silence was an ingestion boundary, not a source halt.
Receipts

Glossary of terms you will be expected to nod at

Insufficient logging (n.): A vulnerability in which nothing bad needs to happen for you to be unable to prove it didn't. Now on the federal exploited list, which means the absence of evidence has a due date.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge, meanwhile, had an entirely ordinary day, which is the point. The sensor profiled 65 hostile sources out of 4,251 addresses seen from 109 countries, 1,412 of them new today, and those 65 sent 5,866 requests between them; 32 went past reconnaissance into actual exploitation attempts and 7 groups shared a behavioural fingerprint. The busiest was a scanner on 2a06:98c0:3600::103 at hostility 6.4, which sent 83 requests across three of our sites asking politely for /wp-admin/install.php and /.git/config. Seventeen addresses shared a single fingerprint, DNA 3076742860d3, which is one tool or one operator rotating IPs and calling it diversity. One scanner fired twenty requests in about 1.4 seconds looking for //xmlrpc.php and wlwmanifest.xml, three addresses tried CVE-2015-2051 against /hnap1 as though the intervening years had not happened, and the sensor's most confident match of the day was Mirai or a variant at 48 per cent. Raw logs never left the server. Only the findings did.

65hostile sources profiled

5,866requests from them

32reached exploitation

7shared-DNA clusters

7.7/10top hostility

4,251addresses at our edge

1,412first seen today

109countries

The WTF list

WTF #1
The most determined visitor
2a06:98c0:3600::103, a scanner (hostility 6.4/10), sent 83 requests to 3 of our sites, probing for /wp-admin/install.php, /.git/config.
Why it’s weirdHighest hostility on the board; its kill chain reached weaponization.
attribution: unknownThu 29 Oct, 03:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA c0f8c6b5a5ea
```
WTF #2
Same DNA, different addresses
185.191.171.15, a bot crawler (hostility 0.4/10), sent 96 requests to 2 of our sites, probing for /threat-check/PsExec.
Why it’s weird17 IPs share one behavioural fingerprint (DNA 3076742860d3): one tool or one operator rotating addresses: 85.208.96.202, 185.191.171.5, 185.191.171.2, 85.208.96.196, 85.208.96.210 and more.
attribution: unknownThu 29 Oct, 03:00 UTC
Detail
```
kill chain: reconnaissance → exploitation · DNA 3076742860d3
```
WTF #3
Trying CVE-2015-2051 on us
3 addresses sent 4 requests shaped like CVE-2015-2051 exploitation (/hnap1), including 218.13.149.41, 157.230.24.130, 172.234.162.56.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: dlink-hnap
```
WTF #4
The strangest shopping list
85.204.70.116, a scanner (hostility 6.3/10), sent 20 requests to one of our sites, probing for //wp-includes/wlwmanifest.xml, //xmlrpc.php, //blog/wp-includes/wlwmanifest.xml, //web/wp-includes/wlwmanifest.xml.
Why it’s weirdAsked for files almost nobody else asks for: //wp-includes/wlwmanifest.xml, //xmlrpc.php, //blog/wp-includes/wlwmanifest.xml, //web/wp-includes/wlwmanifest.xml, //wordpress/wp-includes/wlwmanifest.xml.
attribution: unknownThu 29 Oct, 03:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA dfef4501b216
```
WTF #5
In a hurry
82.102.18.126, a scanner (hostility 6.3/10), sent 20 requests to one of our sites, probing for //wp-includes/wlwmanifest.xml, //xmlrpc.php, //blog/wp-includes/wlwmanifest.xml, //web/wp-includes/wlwmanifest.xml.
Why it’s weirdFired 20 requests in about 1.4 seconds.
attribution: unknownThu 29 Oct, 03:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA dfef4501b216
```
WTF #6
Somebody we might know
139.59.240.56, a scanner (hostility 5.8/10), sent 24 requests to 2 of our sites, probing for //images/images/cache.php, //cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php, //images/images/images/images/images/images/images/images/cache.php, //images/images/images/images/images/images/images/cache.php.
Why it’s weirdThe sensor's most confident campaign match of the day: Mirai or variant (Omni/Gafgyt lineage) at 48%.
attribution: Mirai or variant (Omni/Gafgyt lineage) (sensor's best match, 48%)Thu 29 Oct, 03:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA bccc30d19899
```

§6

Tempo

Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.

192claims, 7 days

38of 267 groups active

qilin39 this week · surging

N0n18 this week

Whitearmor15 this week · new

SurgingBooba Project — 10 claims in 7 days against 2.4 expected from its own prior rate (p < 0.001)
Surgingrhysida — 6 claims in 7 days against 1.3 expected from its own prior rate (p = 0.002)
Surgingqilin — 39 claims in 7 days against 25.4 expected from its own prior rate (p = 0.007)
Surgingeverest — 8 claims in 7 days against 2.8 expected from its own prior rate (p = 0.007)
SurgingFalcon — 3 claims in 7 days against 0.4 expected from its own prior rate (p = 0.007)
Surgingemperador — 10 claims in 7 days against 4.5 expected from its own prior rate (p = 0.017)

Gone quiet: lynx (61 days), AiLock (64 days), abyss (64 days), blackwater (66 days).

Sector pressure, 30 days

UpTransportation — 2.2× its own prior share (71 claims, 33 expected)
UpEducation — 1.9× its own prior share (51 claims, 26 expected)
UpEnergy & Utilities — 1.6× its own prior share (38 claims, 25 expected)
UpHealthcare — 1.4× its own prior share (114 claims, 81 expected)

22% of claims carry no sector label.

Brand churn

Of the 229 leak-site brands first seen since 2021-09-30, 76% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 68% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 212 old enough to judge posted on one day and never again; 39% made at least half their claims in their first week. New brands this month: 9 — newest: Whitearmor (2026-10-23, 15 claims), Mimori (2026-10-20, 2 claims), THE SEVEN DEADLY SINS (2026-10-16, 8 claims).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Targeting

Over the last 180 days, among brands with at least 20 labelled claims: safepay put 34% of its claims on Germany (6.6× every other brand's share); N0n put 34% of its claims on Transportation (7.5× every other brand's share); Storm put 78% of its claims on the United States (2.1× every other brand's share). Widest spread: nightspire across 10.4 effective sectors.

Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.

Posting clock

Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 64% of its claims on Mondays, half of them in 19:00–19:59 UTC; akira posted only 1 of 196 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 36% quieter per weekend day than per weekday.

all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.

Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →

§7

Ride-alongs

Free, live tools. No sign-up, no sales call.

§8

Colophon

How this edition was made, plainly.

Edition 32 was made by machine and checked by code. Every item published by 13 public threat feeds in the 24 hours to 05:05 UK (632 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $1.26. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

632items read

24hour window

$1.26cost of this edition

05:05 UTCgenerated

Sources this morning

NVD191ok
RansomLook107ok
Security news100ok
infosec.exchange84ok
Signal Atlas42ok
atlas27ok
AlienVault OTX24ok
RSS21ok
ransomware.live21ok
signal:ioc-family8ok
CISA KEV4ok
signal:kev2ok
Ransomware tempo · Ninja Signal graph1ok

Get it in your inbox. Every morning. Probably.

One Brotli bug, three names, and at least one attacker whose exploit does not work

CISA has added a vulnerability whose entire impact is that you will not know

GMO told 26,739 servers to turn themselves off, refused ¥8bn, and is now paying for names

The hospital outage reached the feeds seventeen hours before the statement did

The Gentlemen do not run an attack campaign, they run a content calendar

The models are now on both sides of the engagement, and somebody is attacking the attack robots

A good week for the other side of the ledger, which we should write down before we forget it

Keystone is destroying 18,835 hardware wallets because the thing that proves they are real stopped proving it

Mirroring is not corroboration

Six WooCommerce payment plugins, one identical hole

The EDK II scope dispute is unresolved

OTX led KEV on one PHP2Shell CVE

Four sources stopped at the same minute, which is a feed boundary, not a ceasefire

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

The most determined visitor

Same DNA, different addresses

Trying CVE-2015-2051 on us

The strangest shopping list

In a hurry

Somebody we might know

Get it in your inbox. Every morning. Probably.

Sources this morning