Lead · Vulnerabilities

CISA adds a Cisco firewall zero-day whose entire payload is the firewall falling over

CVE-2026-76418 in Secure Firewall ASA and FTD is in KEV and exploited in the wild, and it is the second Cisco firewall VPN zero-day since August.

confidence 0.90

We tell ourselves the firewall is the perimeter. It is not. It is an internet-facing appliance running someone else's C, terminating remote access SSL VPN for people who are not in the building, and on Wednesday CISA added CVE-2026-76418 to the Known Exploited Vulnerabilities catalogue because an unauthenticated attacker can reach it and make it reload. Cisco has patched. Attackers were there first, which is what zero-day means when you strip the marketing off it.

The numbers are the joke and the credibility at once. CVSS 8.6, exploited in the wild, and an EPSS of 0.00574, a scoring system still sitting there mumbling that this is unlikely to be exploited while the exploitation is in the headline. SecurityWeek counts it as the second exploited Cisco firewall VPN zero-day since August. Two days earlier NVD published CVE-2026-106174, an improper locking flaw in FortiOS 8.0.0 and 7.6.4 through 7.6.6 that lets an unauthenticated attacker knock over the HTTPS management interface with crafted requests. Different vendor, same shelf of the same cupboard.

The uncomfortable version is that the denial of service is not a lesser outcome. The box that fails is the box that was holding the VPN up, the logs, the policy and most of your story about segmentation, and when it reboots you discover how much of your architecture was actually a single appliance with a confident logo on it. Patch it today, because it is Friday, and Friday is when the tide comes in.

Why it mattersIf you run ASA, FTD or an affected FortiOS build, these are unauthenticated, remote and already being used; KEV due dates will not care about your change freeze.

Receipts

Today’s revelation

A deadline you did not set is still a deadline. The leak site's release calendar is the only schedule in the incident that has never slipped.

— Sturgeon’s Revelations · Probably Fine Daily No. 33

§2

Top stories

The rest of the last 24 hours, with receipts.

Vulnerabilities

GitLab hits CVSS 10.0 and somebody tried it on Alpine Linux's own server

CISA added CVE-2026-97229 to KEV on 29 October: an integer overflow in GitLab Community and Enterprise Edition that lets an unauthenticated user run code on the server via a specially crafted regular expression, scored 10.0. Alpine Linux said on 28 October that an attacker tried to exploit it against the Alpine project's own GitLab a week after GitLab shipped the fix. EPSS for it sits at 0.18, which is a reminder that EPSS is a weather forecast and KEV is someone standing in the rain. If you self-host GitLab, the thing that holds your CI/CD, your runners and your deployment credentials is the asset in question.

Why it mattersUnauthenticated RCE on a build server is not a code-quality issue, it is a key to everything that server is trusted to push.

confidence 0.85

Receipts

Threat actors

KeyDrift steals the keys that encrypt your site-to-site traffic, and nobody agrees who is driving

Attackers exploited CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controllers, to plant a custom framework called KeyDrift that copies the keys encrypting traffic between sites and stores them for later. BleepingComputer and The Record describe UAT-11473 as a newly identified APT and note the flaw was fixed in February; SecurityWeek reports Talos tying the infrastructure to the Silent Train network that Lumen associated with Volt Typhoon. Those two accounts are not the same story, and 'for later' is the part worth reading twice: this is collection with a shelf life, not smash and grab.

Why it mattersIf you run Catalyst SD-WAN controllers, patch state from February is not reassurance; rotate the key material and go looking, because stolen keys do not show up as an alert.

confidence 0.60

Receipts

Ransomware

Extortion is now a publishing calendar, and 29 October was press day

The trackers logged 179 leak-site claims in seven days from 36 of the 267 groups monitored, with Booba Project at 17 claims against 2.35 expected from its own prior rate and rhysida at 6 against 1.38. Qilin produced a single-day pile-on across four mirrors on 29 October, listing City of Columbia SC, Proterial, W Interactive and Udima; Booba Project posted government, education and healthcare entries with stated volumes from under 1 GB to 295 GB. Everstake went one better and published a schedule: 417.94 Gb marked Published, then 494 Gb for 4 November, 370.73 Gb for 6 November and 1.35 Tb for 7 November. This is not a hacking subculture, it is a release cadence with a content calendar.

Why it mattersTwo of the dated Everstake entries land inside the next fortnight, which is a notification clock running for somebody whether or not they have started it.

confidence 0.70

Receipts

Vulnerabilities

PHP2Shell: the mass exploitation did not arrive, and that is the finding

CISA told federal agencies to patch a high-severity Linux kernel privilege escalation bug, Fragnesia, that attackers are chaining with the PHP2Shell flaws in the wild. One firm has listed around half a dozen PHP2Shell exploitations and another identified a well-targeted suspected Chinese campaign against US government-affiliated servers, which is a long way from the internet-wide catastrophe the first week promised. A research note explains why: working exploits had to be fitted to each target's exact PHP build, with the exception of systems that share one image, such as network appliances, where one tuned exploit reaches every device that runs it.

Why it mattersYour bespoke PHP estate is accidentally hard to exploit at scale; your identical fleet of appliances is accidentally easy, and that is the inventory question to answer today.

confidence 0.75

Receipts

AI & security

The model wrote the exploit, and the benchmark has a percentage to two decimal places

Anthropic said on 27 October that its model wrote an exploit using CVE-2026-98432, a Linux kernel TCP flaw rated 9.8 by the kernel's own CVE team and affecting Ubuntu, RHEL and other distributions, and separately that an unreleased version found and chained multiple vulnerabilities across Chrome, Safari, Android, Windows and Linux. Google launched Gemini 4 Carbon the same week, claiming 88.2% on SEC-bench Pro and rolling it out first to vetted cyber defenders through its Fairwind Programme. These are vendor claims from the people selling the models, and they should be read as such. They are also the same claim defenders have been making nervously for two years, now printed on the box.

Why it mattersThe window between a public CVE and a working exploit is the only genuinely scarce resource in patch management, and both vendors are advertising that they can shorten it.

confidence 0.60

Receipts

AI & security

Someone installed real Claude Code and real Codex on enterprise machines and turned the sandbox off

An unauthorised relay service has been installing genuine OpenAI Codex and Anthropic Claude Code command-line tools on enterprise systems and reconfiguring them to route every request through the relay, with the sandbox flipped to full access; Dark Reading reports the same service supplying regions where those products are not officially sold. Around it: a fake Solana starter kit on GitHub positioned to trick AI coding agents into installing a NetSupport RAT, a returning Hugging Face crypto-mining campaign with one model downloaded over 28,000 times, Aurora ransomware abusing Cursor Agent, fake ChatGPT and Claude desktop apps delivering miners under the name Yoba, and 26,400 cloud and AI credentials found still working across 7.25 million public Gitee repositories. The defences showed up too, Cisco open-sourcing Project Quarry for agent attacks that only emerge across sequences of benign steps, and GitHub previewing an npm install-time firewall.

Why it mattersA coding agent with the guardrails removed is a developer workstation with an extra pair of hands and no joining instructions; inventory where agents run and what they are allowed to reach.

confidence 0.55

Receipts

Threat actors

Binance is investigating up to $5.8 billion, and the small jobs are still the instructive ones

Binance is investigating a potential breach involving up to $5.8 billion in digital assets, which would make it the largest cryptocurrency hack on record if it holds. Polymarket suspended trading after a third-party service was compromised to serve wallet-draining JavaScript, with about $2.5 million traced to a suspected attacker wallet, and a fake trading app called Padre Terminal that was on the Apple App Store has been linked to roughly $23,000 taken from 27 Solana wallets. Research also tracked Russian-language traffer teams pivoting their affiliate-fraud models onto prediction markets since spring 2026, which is the ecosystem following the money with less friction than any of us follow a change request.

Why it mattersTwo of the three were third-party supply chain and app-store trust, not exchange cryptography; the control that failed was 'who else gets to run code in front of your users'.

confidence 0.60

Receipts

Oddities

An email address, a ransomware group called Booba Project, and a phone call you should not answer

Researchers found a flaw in GNU's code forge that could have let attackers backdoor Bash, reached by way of a specially crafted email address, which is a sentence that should be read slowly twice. A flaw in Telegram for Android could be chained with two other bugs to take full control of a phone once the victim answered a voice call, using nothing but an ordinary Telegram account; it is fixed in version 12.10.4. And on Mastodon, somebody discovered there is now a ransomware crew operating under the name Booba Project, which has spent this week posting government and education entries while the rest of us maintain the fiction that we report on sophisticated adversaries.

Why it mattersUpdate Telegram on Android, and accept that the identifier field you never validated is somebody's execution path.

confidence 0.70

Receipts

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

Under the feeds: one enormous Thursday, four mirrors agreeing with each other, and an NVD that stopped talking

Exception 01
The Qilin spike may be a batch, not fifty incidents
Qilin appears in 50 items dated 29 October across atlas, ransomlook, ransomware.live and signal:atlas, against a median of 0 on other days in the window. Part of that is very likely a batch post or scraper backfill rather than 50 separate victims, and this data cannot tell us which.
confidence 0.60Speculative
Wrong if
The Qilin items resolve to distinct victim names with claim dates spread over preceding days, or the same victims appear earlier in other trackers.
Watch
Whether Qilin counts drop back to baseline on 30 and 31 October and whether the victim list is unique across mirrors.
Receipts
Exception 02
Your leak-site 'corroboration' is four mirrors of one source
Ransomlook led ransomware.live by about 1 to 5 hours on Everstake, Shiba and Emperador; ransomware.live led ransomlook by 1 to 2 hours on WhiteArmor and Booba Project; signal:atlas trails ransomware.live by 3 to 8 hours. No aggregator is first on everything, and agreement between them is mirroring, not independent confirmation.
confidence 0.55
Wrong if
The lags track polling intervals or timestamp-field differences rather than order of discovery.
Watch
Whether the same ordering repeats for newly observed groups over the next few days.
Receipts
Exception 03
NVD went quiet after 28 October and nobody noticed
NVD supplied 100 items, all early in the window, with nothing after 2026-10-28T19:32. Most likely an ingest cap or a poll gap rather than a pause in publication, but anything published since then is missing from this read, including detail that would sit behind the new KEV entries.
confidence 0.50Speculative
Wrong if
Later NVD items exist in the store and were excluded by the window or the 100-item cap.
Watch
Whether NVD ingestion resumes in the next collection run.
Receipts

Nothing to seeNo timing clusters at all, so there is no statistical sign of coordinated publication. Entity matches on 'payload', 's.com' and 'g.com' are extraction artefacts and mean nothing. The window is lopsided, with 216 of 381 items on 29 October, so treat every trend here as one day wearing a trend's coat.

Deep read: 382 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueSat 7 Nov8 days
At least one of Everstake's scheduled releases (the 494 Gb entry dated 4 November or the 370.73 Gb entry dated 6 November) appears as published on ransomlook or ransomware.live.
Wrong ifBoth entries pass their stated dates without a published status, or the entries disappear from the leak site.
Receipts
f-2026-10-30-1
Confidence0.70
DueMon 2 Nov72h
Qilin leak-site items fall back below ten per day across the trackers, confirming the 29 October figure was a batch rather than a sustained operational surge.
Wrong ifQilin posts ten or more distinct victim items on any single day to 2 November.
Receipts
f-2026-10-30-2
Confidence0.60
DueMon 9 Nov10 days
Public exploitation detail or a working proof of concept for GitLab CVE-2026-97229 is reported in these feeds, beyond the Alpine Linux attempt.
Wrong ifNo further exploitation reporting or PoC coverage for CVE-2026-97229 appears in the news, KEV or OTX feeds by the due date.
Receipts
1. 1CISA KEVCVE-2026-97229 GitLab Community Edition and Enterpr…
2. 2Security newsAttacker Tried to Exploit Alpine Linux’s GitLab via…
f-2026-10-30-3
Confidence0.45

Scorecard

1 right · 2 wrong

wrong
A ransomware or extortion group will claim Ahold Delhaize on a leak site tracked by ransomware.live or ransomlook by 30 October 2026.
Called Tue 20 Oct · due Fri 30 Oct
The call is due today, and no ransomware.live or ransomlook item names Ahold Delhaize or one of its brands.
wrong
Majinahanashi's pending Jons Civil Engineering Company Ltd. (JCEL) post moves from PENDING to published by the end of 29 October 2026, in line with its stated 28 October schedule.
Called Mon 26 Oct · due Thu 29 Oct
The call is past its 29 Oct due date, and no item shows a Majinahanashi JCEL post. The only Majinahanashi item is an Atlas Manufacturing story.
right
CISA adds at least one further vulnerability to the Known Exploited Vulnerabilities catalog.
Called Thu 29 Oct · due Thu 5 Nov
CISA KEV added CVE-2026-97229 (GitLab) and CVE-2026-76418 (Cisco ASA/FTD) on 29 Oct.
Receipts
1. 1CISA KEVCVE-2026-97229 GitLab Community Edition and Enterpr…
2. 2CISA KEVCVE-2026-76418 Cisco Secure Firewall ASA Software a…

Glossary of terms you will be expected to nod at

Scheduled (n.): A status on a leak site, as in '494 Gb, Status: Scheduled, 4 November'. It means the data now has an owner, a size, a category and a publication date, which is three more artefacts of project management than your incident response plan currently has.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge profiled 97 hostile sources in 24 hours, 55 bot crawlers, 34 scanners, five targeted operators and three brute forcers, between them sending 9,724 requests, of which 56 went past reconnaissance into actual exploitation attempts. Nine groups of addresses shared a behavioural fingerprint, including one cluster of 30 IPs all moving like a single tool or a single operator rotating addresses. The hostility prize went to 143.244.57.121 at 7.7 out of 10, which spent 20 requests asking for wlwmanifest.xml and xmlrpc.php under a /login path, and reached credential access doing it. Elsewhere 93.123.109.165 fired 353 requests at our admin paths in about 12.5 seconds, 20.211.122.120 went shopping for /aa.php and /wp-act.php, and two addresses were still spraying CVE-2017-9841 at us, a named exploit from 2017, because the internet does not read patch notes. We saw 12,534 addresses in total from 125 countries, 8,636 of them for the first time today. Raw logs never left the server.

97hostile sources profiled

9,724requests from them

56reached exploitation

9shared-DNA clusters

8.5/10top hostility

12,534addresses at our edge

8,636first seen today

125countries

The WTF list

WTF #1
The most determined visitor
143.244.57.121, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
attribution: unknownThu 29 Oct, 22:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation → credential-access · DNA 82a939927b85
```
WTF #2
Same DNA, different addresses
185.191.171.15, a bot crawler (hostility 0.6/10), sent 170 requests to 3 of our sites, probing for /threat-check/HP%20Multiple%20Products%20Remote%20Code%20Execution%20V, /threat-check/Multiple%20SugarCRM%20Products%20Remote%20Code%20Executi, /threat-check/Microsoft%20Windows%20Runtime%20Remote%20Code%20Executio, /threat-check/D-Link%20Multiple%20Routers%20Remote%20Code%20Execution%.
Why it’s weird30 IPs share one behavioural fingerprint (DNA 2581d8d3e47e): one tool or one operator rotating addresses: 85.208.96.202, 185.191.171.18, 85.208.96.212, 185.191.171.10, 85.208.96.197 and more.
attribution: unknownThu 29 Oct, 22:00 UTC
Detail
```
kill chain: reconnaissance → exploitation · DNA 2581d8d3e47e
```
WTF #3
Trying CVE-2017-9841 on us
2 addresses sent 8 requests shaped like CVE-2017-9841 exploitation (/vendor/phpunit/phpunit/…), including 185.177.72.13, 161.248.179.19.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: phpunit-rce
```
WTF #4
The strangest shopping list
20.211.122.120, a scanner (hostility 6.4/10), sent 47 requests to one of our sites, probing for /aa.php, /upload.php, /wp-act.php, /wp-content/index.php.
Why it’s weirdAsked for files almost nobody else asks for: /aa.php, /upload.php, /wp-act.php, /wp-content/index.php, /wp-content/uploads/wpr-addons/forms/b1ack.php.
attribution: unknownThu 29 Oct, 22:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA dfef4501b216
```
WTF #5
In a hurry
93.123.109.165, a brute forcer (hostility 4.5/10), sent 353 requests to 3 of our sites, probing for /admin/login, /admin/login/livewire/update, /admin, /admin/dashboard.
Why it’s weirdFired 353 requests in about 12.5 seconds.
attribution: unknownThu 29 Oct, 22:00 UTC
Detail
```
kill chain: reconnaissance → credential-access · DNA a8561adb3b5b
```

§6

Tempo

Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.

179claims, 7 days

36of 267 groups active

qilin32 this week

Booba Project17 this week · surging

N0n14 this week

SurgingBooba Project — 17 claims in 7 days against 2.4 expected from its own prior rate (p < 0.001)
Surgingrhysida — 6 claims in 7 days against 1.4 expected from its own prior rate (p = 0.003)
Surgingeverest — 8 claims in 7 days against 2.7 expected from its own prior rate (p = 0.007)
SurgingFalcon — 3 claims in 7 days against 0.4 expected from its own prior rate (p = 0.007)
Surgingemperador — 10 claims in 7 days against 4.6 expected from its own prior rate (p = 0.020)
Surgingpayload — 5 claims in 7 days against 1.6 expected from its own prior rate (p = 0.022)

Gone quiet: lynx (62 days), AiLock (65 days), abyss (65 days), blackwater (67 days).

Sector pressure, 30 days

UpTransportation — 2.3× its own prior share (71 claims, 31 expected)
UpEducation — 2.1× its own prior share (54 claims, 25 expected)
UpEnergy & Utilities — 1.4× its own prior share (34 claims, 24 expected)
UpHealthcare — 1.4× its own prior share (108 claims, 79 expected)

22% of claims carry no sector label.

Brand churn

Of the 229 leak-site brands first seen since 2021-09-30, 76% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 68% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 212 old enough to judge posted on one day and never again; 39% made at least half their claims in their first week. New brands this month: 9 — newest: Whitearmor (2026-10-23, 16 claims), Mimori (2026-10-20, 2 claims), THE SEVEN DEADLY SINS (2026-10-16, 8 claims).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Targeting

Over the last 180 days, among brands with at least 20 labelled claims: safepay put 34% of its claims on Germany (6.7× every other brand's share); N0n put 34% of its claims on Transportation (7.5× every other brand's share); Storm put 78% of its claims on the United States (2.1× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.

Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.

Posting clock

Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 64% of its claims on Mondays, half of them in 19:00–19:59 UTC; akira posted only 1 of 196 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 38% quieter per weekend day than per weekday.

all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.

Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →

§7

Ride-alongs

Free, live tools. No sign-up, no sales call.

§8

Colophon

How this edition was made, plainly.

Edition 33 was made by machine and checked by code. Every item published by 13 public threat feeds in the 24 hours to 05:05 UK (382 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.75. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

382items read

24hour window

$0.75cost of this edition

05:05 UTCgenerated

Sources this morning

NVD100ok
Signal Atlas74ok
Security news60ok
ransomware.live37ok
infosec.exchange37ok
RansomLook28ok
RSS13ok
AlienVault OTX13ok
atlas8ok
signal:ioc-family7ok
signal:kev2ok
CISA KEV2ok
Ransomware tempo · Ninja Signal graph1ok

Get it in your inbox. Every morning. Probably.

GitLab hits CVSS 10.0 and somebody tried it on Alpine Linux's own server

KeyDrift steals the keys that encrypt your site-to-site traffic, and nobody agrees who is driving

Extortion is now a publishing calendar, and 29 October was press day

PHP2Shell: the mass exploitation did not arrive, and that is the finding

The model wrote the exploit, and the benchmark has a percentage to two decimal places

Someone installed real Claude Code and real Codex on enterprise machines and turned the sandbox off

Binance is investigating up to $5.8 billion, and the small jobs are still the instructive ones

An email address, a ransomware group called Booba Project, and a phone call you should not answer

The Qilin spike may be a batch, not fifty incidents

Your leak-site 'corroboration' is four mirrors of one source

NVD went quiet after 28 October and nobody noticed

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

The most determined visitor

Same DNA, different addresses

Trying CVE-2017-9841 on us

The strangest shopping list

In a hurry

Get it in your inbox. Every morning. Probably.

Sources this morning