Lead · Vulnerabilities

KEV took delivery of the edge: a 10.0 in GitLab, a firewall that reloads on request, and two Ivanti links in somebody's chain

Six separate actively-exploited problems landed inside two days, and every one of them lives in something you cannot turn off for the weekend.

confidence 0.90

CISA added two flaws to the Known Exploited Vulnerabilities catalogue on Thursday: CVE-2026-97229, the GitLab remote code execution bug rated 10.0, which an attacker tried against the Alpine Linux project's own GitLab server a week after the fix shipped, and CVE-2026-76418, rated 8.6, a Cisco Secure Firewall ASA and FTD flaw that lets an unauthenticated attacker make the device reload. That is the second Cisco VPN zero-day since August. On the same day, KEV took two Ivanti Connect Secure entries, CVE-2026-118527 and CVE-2026-111357, the first of which can be chained with the second and with CVE-2026-104935, which is CISA's polite way of saying somebody has already built the chain and is using it.

Add the two that are being exploited without a KEV badge. Drupal told store owners that CVE-2026-118539, a missing-authorisation flaw in Commerce Core affecting versions 0.0.0 to 2.41 and 3.0.0 onward, is under attack and that they should go and audit their orders. And a WordPress Core remote code execution bug with no CVE identifier at all, affecting 4.7 through 7.1.3, drew nearly 63,000 attack attempts in twenty-four hours. A vulnerability with no number is ontologically inconvenient: your scanner cannot find it, your risk register cannot hold it, and the people scanning you do not require it to have one.

Underneath all of it, the PHP2Shell story keeps moving. CISA warned federal agencies to patch the Fragnesia Linux kernel privilege-escalation bug because attackers are chaining it with PHP2Shell in the wild; one firm counted roughly half a dozen exploitations and another found a well-targeted suspected Chinese campaign against US government-affiliated servers. Over 22.6 million exposed instances are potentially affected, the attacks root Palo Alto firewalls and fail against WordPress, and a week of testing found exploits have to be fitted to each target's exact PHP build — except on network appliances, where everyone runs the same build and one tuned exploit reaches the lot. Uniformity is a procurement virtue and an attacker's discount.

Why it mattersIf you run ASA or FTD, Connect Secure, GitLab, Drupal Commerce or WordPress, your weekend already has a slot booked in it; patch state, not patch policy, is what gets asked about on Monday.

Receipts

Today’s revelation

A zero-day in the box that terminates your VPN is not a vulnerability. It is a change of ownership, published as a release note.

— Sturgeon’s Revelations · Probably Fine Daily No. 34

§2

Top stories

The rest of the last 24 hours, with receipts.

Threat actors

The largest crypto theft on record went through a laptop

Binance says a security incident affected about $6.3 billion of assets and has linked the theft to a DevOps engineer's compromised laptop; earlier reporting put the figure at up to $5.8 billion, withdrawals were paused, and nearly $3 billion has been frozen on-chain so far with Tether and Circle assisting. Blockchain analysts say the theft bears the hallmarks of North Korea's TraderTraitor, which is an inference from one chain of reporting rather than a formal attribution. The control that failed was not cryptography, consensus or cold storage. It was one endpoint belonging to someone with the keys to the pipeline.

Why it mattersYour highest-value blast radius is not the production cluster, it is the handful of laptops that can reach it; enumerate those humans by name this week.

confidence 0.75

Receipts

Malware & IOCs

KeyDrift does not break your SD-WAN, it copies the keys and waits

Cisco Talos says a group tracked as UAT-11473 exploited CVE-2026-20127, an authentication bypass in Catalyst SD-WAN Controllers patched back in February, to plant a custom malware framework called KeyDrift inside the systems that control an organisation's SD-WAN. KeyDrift's job is to copy the keys that encrypt traffic between sites and store them for later. Talos linked the infrastructure to overlap with Volt Typhoon's 'Silent Train' network as detailed by Lumen, which is an overlap, not a confession.

Why it mattersA patch applied in February does not rotate keys stolen in January; if you run Catalyst SD-WAN controllers, treat site-to-site key material as suspect and rotate it.

confidence 0.75

Receipts

AI & security

Eleven hours of trusted publisher was enough

A trojanized version 2.1.313 of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace for roughly eleven hours on 29 October, carrying a 66-line loader prepended to the legitimate code that installed a persistent SSH backdoor, exposing up to 5,000 developers; two serious issues hit Cursor the same day. The same week, 319 Chrome extensions with 13.4 million combined installs were caught hijacking searches through tracking servers for ad revenue, a researcher found 26,400 still-working cloud and AI credentials in public Gitee repositories across 7.25 million repos, and GitHub shipped an npm firewall in preview to block suspicious packages at install time. Developer trust is now a marketplace field, and marketplaces are a supply chain nobody signed off.

Why it mattersTreat IDE and browser extensions as installed software with change control, not as preferences; and assume an eleven-hour window is long enough to matter.

confidence 0.80

Receipts

AI & security

The model wrote the exploit, and the exploit works

Anthropic said on 27 October that its model wrote a working exploit for CVE-2026-98432, a Linux kernel TCP flaw the kernel's own CVE team rates 9.8, affecting Ubuntu, RHEL and others, and researchers there developed remote unauthenticated root execution against servers with MPTCP listeners; an unreleased Claude version has also found and chained vulnerabilities across Chrome, Safari, Android, Windows and Linux. Google says Gemini 4 Carbon scored 88.2% on SEC-bench Pro and is rolling out first to vetted defenders through its Fairwind Program. Meanwhile CrowdStrike reports Chinese state-sponsored actors using a Go-based AI-powered penetration testing framework, ARTEX, against more than 200 organisations at once. The asymmetry is not that attackers have AI. It is that exploit development stopped being the slow part.

Why it mattersPlan for patch windows measured against machine-speed exploit development, not against the week it used to take somebody to write the thing.

confidence 0.80

Receipts

Ransomware

Qilin posted sixty claims in a day, and the trackers all saw it twice

Our tempo count has 178 leak-site claims in seven days from 35 of 269 tracked groups, with Booba Project surging to 17 against 2.33 expected from its own prior rate, rhysida at 8 against 1.38 and SilentRansomGroup at 8. Qilin accounts for 60 items on 30 October against a median of five on other days, heavy on Mexico — Innoe Asesores, Grupo Ciosa, Farmacia I, Sistemas Visuales 360 — plus Palletline in the UK, Light Rail Manila and Honghwa International in Taiwan. Note that ransomlook trails ransomware.live by an hour or two on the same victims, so four sources is often one source wearing four coats. SilentRansomGroup claimed Susman Godfrey and leakeddata posted ArentFox Schiff, with redacted entries on both sites sharing initials.

Why it mattersA posting batch is not the same as an attack wave; count victims, not items, before you tell the board the sector is under siege.

confidence 0.80

Receipts

Threat actors

Three ways to lose crypto that have nothing to do with your wallet software

Polymarket suspended trading after attackers compromised a third-party performance-monitoring integration and served wallet-draining JavaScript from a DebugBear CDN URL, with roughly $2.5 million traced to a suspected attacker wallet. Trezor has credible reports of a Safe 5 bought from reseller CryptoBilis in Southeast Asia containing an extra circuit board that transmits the recovery phrase over a mobile network; Trezor has not yet examined the device and is warning everyone who bought from that reseller. And a fake trading app called Padre Terminal, previously on the Apple App Store, has been linked to about $23,000 taken from 27 Solana wallets.

Why it mattersYour third-party script tags, your resellers and your app stores are all production dependencies; inventory them the way you inventory servers.

confidence 0.80

Receipts

Policy

GCHQ cannot account for thousands of data storage devices, and the watchdog is disappointed

The Investigatory Powers Commissioner's Office, in its annual report for 2025 published Thursday, said it was 'very concerned' and 'disappointed with the time it has taken GCHQ to investigate' the matter, noting the agency has 'not yet established a sufficiently clear understanding of the scale, location and recoverability' of the devices, with losses estimated 'in the thousands' and the underlying issues raised several years ago. Elsewhere in enforcement news, the FBI seized the domain of bulletproof host Virtualine, which hosted hack-for-hire services and supported ransomware and infostealer operators, and a Syrian Electronic Army hacker known as Th3Pr0 was sentenced to 42 months for a conspiracy whose fake tweet triggered a $136 billion market drop.

Why it mattersAsset inventory is the control everyone marks as mature and nobody can evidence; if the signals agency cannot do it, your spreadsheet is also a photograph of a tide.

confidence 0.85

Receipts

Oddities

The fastest-growing ransomware brand this week is called Booba Project

Our own tempo analysis names Booba Project as the week's biggest surge, 17 leak-site claims in seven days against 2.33 expected from its own prior rate, p below 0.001, and the only commentary we have found on it is a Mastodon post asking, in effect, whether that is really the name. It is. Somewhere a threat intelligence team is deciding whether to put that word in a board slide, and somewhere else an insurer is reading it in a claim form.

Why it mattersGroup naming is marketing, not taxonomy; track the tradecraft and the infrastructure, because the brand will be renamed before your detection content ships.

confidence 0.85

Receipts

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

Under the feeds: one Qilin posting batch wearing four source badges, an Atlas 'fusion' layer that cites no CVE, and an NVD feed that stops dead on 29 October.

Exception 01
The Qilin burst is real but it is one feed, mirrored
Qilin shows 60 items on 30 October against a median of 5 on other days across four sources, but ransomlook trails ransomware.live by roughly an hour to two on the same victims (akira 1.3h, pear 1.3h, dragonforce 1.8h, rhysida 2.1h) and the Atlas story precedes the ransomware.live item by 19.3 hours. That is one underlying observation plus derivatives, most likely a posting batch or a scrape catch-up, with a Mexican concentration. The two trackers also disagree on sector labels for the same victims.
confidence 0.70
Wrong if
Qilin's own leak-site timestamps show the claims spread evenly across prior days, or the Mexican victims turn out to belong to a known earlier campaign.
Watch
Whether Qilin volume stays elevated on 31 October and 1 November or drops back to about five a day.
Receipts
Exception 02
'KEV × ransomware fusion' tags are not supported by any item
Everest carries 12 to 13 items on 30 October, mostly from the signal layer, which trails Atlas by 72.5 hours, and the near-identical story sets across four sectors look like a method artifact. No item in the window ties a specific KEV CVE to any named ransomware group, and sector labels mismatch, with whitearmor's shipyard victim filed under Retail. Treat the fusion output as a heuristic, not a finding.
confidence 0.65
Wrong if
A victim statement or incident report names a specific KEV CVE used by everest, qilin or another fusion-tagged group.
Watch
Any named CVE appearing in a leak-site post or advisory; treat the confidence figures on these tags as unvalidated.
Receipts
1. 1RansomLookwhitearmor leaked KTU Shipyard — Company: PT Karya…
Exception 03
NVD goes silent after a bulk WordPress plugin batch
All 100 NVD items in the window fall before 2026-10-29T17:21, with roughly 75 WordPress plugin CVEs stamped in bulk on 28 October at 06:16 and 07:16. The silence is more likely an ingestion cutoff or a 100-item feed cap than a pause in publishing, but the batch does bury genuinely high-impact items, including unauthenticated WooCommerce payment-notification forgery and file-upload paths to code execution.
confidence 0.50Speculative
Wrong if
NVD items dated 30 to 31 October exist in the raw feed and were simply missed by the collector.
Watch
Whether NVD items resume on the next run; if they do, the cutoff was ours, not theirs.
Receipts
Exception 04
SilentRansomGroup and leakeddata share timing and initials
SilentRansomGroup (8 items) and leakeddata (4 items) both burst on 30 October with redacted entries sharing initials, both touching law firms, with ransomware.live preceding the signal layer by 5.8 hours. That is consistent with shared infrastructure, affiliate overlap or one site mirroring the other, and it is equally consistent with coincidence. The victims are unnamed and the evidence is thin.
confidence 0.40Speculative
Wrong if
The redacted entries resolve to different, unrelated victims, or leakeddata is shown to be an aggregator scraping the other site.
Watch
Whether the names are unredacted, and whether more law-firm victims appear next week.

Nothing to seeThere is no evidence connecting Binance to Polymarket, and nothing in the window ties any KEV CVE to a named ransomware group. The Japanese exposures reported this week show no connecting evidence between them. Cross-source counts are inflated throughout by rss and cyber-news carrying identical copy and by ransomlook mirroring ransomware.live.

Deep read: 490 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueWed 4 Nov4 days
Qilin leak-site postings fall back to fewer than 15 claims on any single day across ransomware.live and ransomlook between 1 and 4 November, confirming the 60-item day was a batch rather than a campaign.
Wrong ifAny single day in that window shows 15 or more distinct Qilin victim claims.
Receipts
f-2026-10-31-1
Confidence0.70
DueSat 7 Nov7 days
CVE-2026-118539, the Drupal Commerce Core authorisation bypass already reported as exploited, is added to the CISA KEV catalogue by 7 November.
Wrong ifThe CVE is absent from KEV on 7 November.
Receipts
f-2026-10-31-2
Confidence0.50
DueSat 14 Nov14 days
No government body or law enforcement agency formally attributes the Binance theft to North Korea in these feeds by 14 November; the TraderTraitor link stays an analyst inference.
Wrong ifA named government agency publicly attributes the theft to DPRK actors before that date.
Receipts
f-2026-10-31-3
Confidence0.65

Scorecard

4 right · 1 partly

right
Public reporting of in-the-wild exploitation or a public proof of concept for the two Drupal critical RCEs appears by 1 November.
Called Mon 19 Oct · due Sun 1 Nov
Drupal Commerce Core flaw (CVE-2026-118539) confirmed exploited in the wild by Drupal and SecurityWeek; VulDB also flagged elevated Drupal targeting activity.
Receipts
right
The Gentlemen post at least five new named victims to their leak site in a single day.
Called Thu 29 Oct · due Sun 8 Nov
On 30 October, The Gentlemen posted at least three named victims visible in ransomlook (Ined, CommTank, NOVADATA) — total visible on that day from ransomlook entries is at least 3, but checking all entries: Ined, CommTank, NOVADATA = 3, which is fewer than 5. However the due date is 8 November and the call remains open for future days.
partly
A public vendor or CERT report names a third distinct operator using PHP2Shell, beyond the suspected China-nexus actor and the Japanese real-estate extortion staging server.
Called Thu 29 Oct · due Mon 9 Nov
CISA warned of the Fragnesia Linux flaw being chained with PHP2Shell attacks, and one report named Palo Alto firewalls as a PHP2Shell target — these are additional operator/target contexts beyond the two originally known, but no vendor/CERT report explicitly names a third distinct PHP2Shell operator group; due date is 9 November.
Receipts
right
Qilin leak-site items fall back below ten per day across the trackers, confirming the 29 October figure was a batch rather than a sustained operational surge.
Called Fri 30 Oct · due Mon 2 Nov
On 30 October Qilin posted at least 9 named victims (Innoe Asesores, iFink, Grupo Ciosa, Farmacia I, Light Rail Manila, Palletline, Societe Ivoirienne, Sistemas Visuales 360, Richland Resources, Honghwa International — 10 total), exceeding ten on a single day, falsifying the call.
Receipts
right
Public exploitation detail or a working proof of concept for GitLab CVE-2026-97229 is reported in these feeds, beyond the Alpine Linux attempt.
Called Fri 30 Oct · due Mon 9 Nov
CISA added CVE-2026-97229 to KEV citing active exploitation, and SecurityWeek confirmed exploitation beyond just the Alpine Linux attempt.
Receipts

Glossary of terms you will be expected to nod at

Trusted publisher (n.): A field in a marketplace recording that somebody, once, proved who they were — before this build, in a process no human has looked at since, and which held for approximately eleven hours.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge profiled 46 hostile sources in the last 24 hours — 27 bot crawlers, 18 scanners and one targeted operator — sending 4,567 requests between them, of which 24 went past reconnaissance into exploitation attempts, and seven groups of addresses shared a behavioural fingerprint. The shopping list has been updated for the era: 35.241.202.92 worked through /.aws/credentials and /.docker/laravel/app/.env and then asked, specifically, for /.env.anthropic, which is model API keys filed next to cloud keys in the same list. The busiest was 34.50.111.14 at 274 requests and a sustained 156 a minute, hunting /.git/config and .env files; the most hostile at 7.7 out of 10 was 82.102.18.222, twenty patient requests that reached credential-access; eight addresses shared DNA dfef4501b216, one tool or one operator rotating IPs. Two addresses tried CVE-2017-9841 at us, a named exploit from a year that is now old enough to have opinions. Across the edge, 9,931 addresses from 125 countries, 6,620 of them seen for the first time today. Raw logs never left the server.

46hostile sources profiled

4,567requests from them

24reached exploitation

7shared-DNA clusters

7.7/10top hostility

9,931addresses at our edge

6,620first seen today

125countries

The WTF list

WTF #1
Looking for your AI keys
35.241.202.92, a scanner (hostility 5.4/10), sent 122 requests to one of our sites, probing for /.aws/.env, /.aws/credentials.bak, /.docker/laravel/app/.env, /.aws/credentials.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownFri 30 Oct, 20:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```
WTF #2
The most determined visitor
82.102.18.222, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
attribution: unknownFri 30 Oct, 20:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation → credential-access · DNA 82a939927b85
```
WTF #3
Trying CVE-2017-9841 on us
2 addresses sent 6 requests shaped like CVE-2017-9841 exploitation (/vendor/phpunit/phpunit/…), including 45.148.10.64, 193.47.62.168.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: phpunit-rce
```
WTF #4
Same DNA, different addresses
20.217.186.29, a scanner (hostility 6.7/10), sent 143 requests to one of our sites, probing for /wp-file.php, /222.php, /wp-admin/css/colors/modern/, /wp-admin/css/admin.php.
Why it’s weird8 IPs share one behavioural fingerprint (DNA dfef4501b216): one tool or one operator rotating addresses: 20.217.186.29, 104.234.53.174, 104.234.53.151, 35.238.129.244, 20.53.249.197 and more.
attribution: unknownFri 30 Oct, 20:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation · DNA dfef4501b216
```
WTF #5
The strangest shopping list
20.194.27.148, a scanner (hostility 6.4/10), sent 46 requests to one of our sites, probing for /wk/index.php, /inputs.php, /ioxi-o.php, /function/function.php.
Why it’s weirdAsked for files almost nobody else asks for: /wk/index.php, /inputs.php, /ioxi-o.php, /function/function.php, /rip.php.
attribution: unknownFri 30 Oct, 20:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 83562bd8e880
```
WTF #6
In a hurry
34.50.111.14, a scanner (hostility 6.2/10), sent 274 requests at 156 a minute to one of our sites, probing for /.git/config, /.env, /.env.local, /.env.production.
Why it’s weirdThe fastest sustained source of the day at 156 requests a minute.
attribution: unknownFri 30 Oct, 20:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 83562bd8e880
```

§6

Tempo

Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.

178claims, 7 days

35of 269 groups active

qilin37 this week · surging

Booba Project17 this week · surging

Whitearmor13 this week · new

SurgingBooba Project — 17 claims in 7 days against 2.3 expected from its own prior rate (p < 0.001)
Surgingrhysida — 8 claims in 7 days against 1.4 expected from its own prior rate (p < 0.001)
SurgingSilentRansomGroup — 8 claims in 7 days against 2.6 expected from its own prior rate (p = 0.006)
SurgingFalcon — 3 claims in 7 days against 0.4 expected from its own prior rate (p = 0.007)
Surgingeverest — 8 claims in 7 days against 2.7 expected from its own prior rate (p = 0.007)
Surgingaurora — 6 claims in 7 days against 1.8 expected from its own prior rate (p = 0.010)

Gone quiet: lynx (63 days), AiLock (66 days), abyss (66 days), blackwater (68 days).

Sector pressure, 30 days

UpTransportation — 2.4× its own prior share (74 claims, 31 expected)
UpEducation — 2.1× its own prior share (54 claims, 26 expected)
UpEnergy & Utilities — 1.5× its own prior share (37 claims, 24 expected)
UpHealthcare — 1.3× its own prior share (103 claims, 81 expected)

22% of claims carry no sector label.

Brand churn

Of the 231 leak-site brands first seen since 2021-09-30, 76% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 68% were still claiming 90 days after their first post and 62% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 212 old enough to judge posted on one day and never again; 39% made at least half their claims in their first week. New brands this month: 11 — newest: Shiba (2026-10-29, 4 claims), everstake (2026-10-29, 4 claims), Whitearmor (2026-10-23, 16 claims).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Targeting

Over the last 180 days, among brands with at least 20 labelled claims: safepay put 34% of its claims on Germany (6.7× every other brand's share); N0n put 34% of its claims on Transportation (7.4× every other brand's share); Storm put 78% of its claims on the United States (2.1× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.

Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.

Posting clock

Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 64% of its claims on Mondays, half of them in 19:00–19:59 UTC; akira posted only 1 of 199 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 39% quieter per weekend day than per weekday.

all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.

Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →

§7

Ride-alongs

Free, live tools. No sign-up, no sales call.

§8

Colophon

How this edition was made, plainly.

Edition 34 was made by machine and checked by code. Every item published by 13 public threat feeds in the 24 hours to 05:05 UK (490 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $1.07. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

490items read

24hour window

$1.07cost of this edition

05:05 UTCgenerated

Sources this morning

NVD100ok
Security news99ok
Signal Atlas86ok
infosec.exchange68ok
RansomLook44ok
ransomware.live26ok
atlas24ok
RSS21ok
signal:ioc-family12ok
AlienVault OTX5ok
signal:kev2ok
CISA KEV2ok
Ransomware tempo · Ninja Signal graph1ok

Get it in your inbox. Every morning. Probably.

The largest crypto theft on record went through a laptop

KeyDrift does not break your SD-WAN, it copies the keys and waits

Eleven hours of trusted publisher was enough

The model wrote the exploit, and the exploit works

Qilin posted sixty claims in a day, and the trackers all saw it twice

Three ways to lose crypto that have nothing to do with your wallet software

GCHQ cannot account for thousands of data storage devices, and the watchdog is disappointed

The fastest-growing ransomware brand this week is called Booba Project

The Qilin burst is real but it is one feed, mirrored

'KEV × ransomware fusion' tags are not supported by any item

NVD goes silent after a bulk WordPress plugin batch

SilentRansomGroup and leakeddata share timing and initials

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

Looking for your AI keys

The most determined visitor

Trying CVE-2017-9841 on us

Same DNA, different addresses

The strangest shopping list

In a hurry

Get it in your inbox. Every morning. Probably.

Sources this morning