Lead · Vulnerabilities

CISA lists two Ivanti Connect Secure flaws. The attackers were using three

Two Ivanti Connect Secure vulnerabilities went into the Known Exploited Vulnerabilities catalogue on Friday after exploitation in the wild; the reported chain that produces unauthenticated root access is three flaws long.

confidence 0.88

The report is plain enough. CISA added two Ivanti Connect Secure flaws to KEV on Friday following active exploitation in the wild, one of them CVE-2026-111357, and the attack being described chains three flaws together to reach unauthenticated root access. Two is the number the catalogue carries. Three is the number doing the work.

This is the gap nobody budgets for. Vulnerability management is organised around the single bug with the single score, because a single bug is a thing a spreadsheet can hold and a chain is not. An attacker does not hold a spreadsheet. An attacker holds three findings that each looked survivable in isolation, which is the security equivalent of three locks on a door that is actually a curtain, and the fact that we scored each lock individually is why the curtain never came up in the review.

So the honest reading of today is not that Ivanti had bad luck. It is that the box doing your remote access is the box that terminates everyone's session, holds everyone's credential material and faces the entire internet by design, and we keep being surprised by that arrangement as though it were weather rather than a decision. Patch it, then go and read what the thing was doing last week, because 'added to KEV on Friday' means the exploitation happened before Friday.

Why it mattersIf you run Ivanti Connect Secure, treat this as an incident-response question and not a patch-cycle question: KEV listing confirms exploitation that already happened, and the chain ends at unauthenticated root.

Receipts

1Security newsAttackers Chain Three Ivanti Connect Secure Flaws t…

Today’s revelation

Three medium findings chained end to end are not three findings. They are one root shell with a project plan, and it was always going to be filed under 'sophisticated'.

— Sturgeon’s Revelations · Probably Fine Daily No. 35

§2

Top stories

The rest of the last 24 hours, with receipts.

Ransomware

A one-day leak-site surge that is mostly one actor, and mostly one upload

Leak-site trackers logged 171 of the window's 335 items on 31 October, with TheGentlemen accounting for 50 items across ransomware.live, ransomlook and atlas against a median of zero on other days, followed by SafePay with 12, Qilin with 11 and WhiteArmor and Emperador with 10 each. The tempo feed puts the week at 260 claims from 41 of the 269 groups tracked, with Booba Project at 17 claims against 2.31 expected from its own prior rate, rhysida at 9 against 1.38, and SilentRansomGroup at 12. The important caveat is arithmetic: because three trackers mirror the same postings, 50 items is not 50 organisations.

Why it mattersTreat the count as publication volume, not victim volume; dedupe by victim before you brief anyone, and watch whether TheGentlemen's rate holds or collapses back to zero.

confidence 0.75

Receipts

Vulnerabilities

Eight bytes of text message, one integer going the wrong way, no phone

A researcher has published proof-of-concept code for CVE-2026-58882, the Android flaw being called 'SMS of Death': an eight-byte WAP Push message to data SMS port 2948 whose length field is parsed as -2147483648, producing a NegativeArraySizeException that crashes com.android.phone. It is zero-click, it drops calls including emergency calls, and around twenty messages puts the device into a reboot loop. The fix shipped in October 2026 for Android 14 to 17 but was not listed in the bulletin, and Android 12 and 13 are reported as exposed.

Why it mattersAny fleet policy that defers handsets on Android 12 or 13 now has a remote denial-of-service with public exploit code attached, and the patch that fixes it was never announced.

confidence 0.82

Receipts

AI & security

Chainalysis says it was breached using 'offensive agentic techniques'

The blockchain analytics firm disclosed that attackers used what it describes as 'offensive agentic techniques' to reach internal systems and tools, exposing customer names, email addresses, user IDs and organisational roles. In its own confirmation the company characterises the accessed data as non-sensitive, and says the intrusion did not reach its investigation content or its authentication systems. Both readings are in today's reporting, and both can be true at once.

Why it mattersIf your vendors' breach notices are starting to describe the attacker's tooling rather than your data, ask them which internal tools were reachable and what the agent's requests looked like in their logs.

confidence 0.80

Receipts

AI & security

Northflank breach ends with somebody else spending your model budget

Cloud hosting platform Northflank has told customers to rotate every credential and secret held on the platform after a breach led to unauthorised use of their AI API keys. That is the whole shape of it: the secret store was the target, and the payoff was inference someone else paid for.

Why it mattersRotate platform-held secrets now, and put spend alerting and per-key rate limits on model API keys, because a stolen model key has no login event to alert on, only a bill.

confidence 0.85

Receipts

AI & security

A shared ChatGPT link that reads the room it is opened in

Researchers at Parameter showed that a malicious ChatGPT share link could run an attacker's code inside the logged-in session of whoever opened it, allowing the attacker to read that person's private conversations. The flaw was reported through OpenAI's bug bounty programme in October. The delivery mechanism is a link somebody sends you because they found something interesting.

Why it mattersAssistant transcripts are now a credential store and a confidential-document store wearing a chat interface; shared links into them deserve the same suspicion as any other link that executes in your session.

confidence 0.78

Receipts

1Security newsA Shared ChatGPT Link Could Run Attacker Code in Yo…

Vulnerabilities

Red Hat's identity batch: the checks that forget which account they are checking

A cluster of CVEs published within about an hour on 29 October runs through the Java middleware and identity stack. CVE-2026-114488 is the worst of them: the Wildfly CSIv2 interceptor accepts ITTPrincipalName identity assertions without verifying transport-level authentication, so a pre-auth attacker reaching port 3528 can impersonate any principal on every IIOP-exposed @Remote EJB; CVE-2026-15564 allows deserialisation on the same listener before authentication happens. Alongside them, JBoss EAP skips RBAC on a platform-mbean read-resource operation (CVE-2026-19610), and four Keycloak flaws cover claim filtering skipped in the JWT grant flow, vault references that disclose secrets, Pushed Authorization Requests reusable for multiple tokens, and a HOTP validation that updates its counter without locking so a one-time password is not reliably one-time. The same day's WordPress batch contains the same species: CVE-2026-111739 fails to bind the account whose two-factor code is verified to the account being authenticated, and CVE-2026-113616 mails a password-reset code to whatever address the request asked for.

Why it mattersFind out whether anything you run exposes IIOP on 3528 to anything other than itself, and read the Keycloak items as a prompt to check PAR replay and OTP counter behaviour rather than as a version bump.

confidence 0.72

Receipts

Vulnerabilities

Your build is an interpreter, and it has been reading documents from strangers

Three advisories from the same batch describe the same uncomfortable property. In `open` 7.2.0 before 11.0.0, a URL containing a $(...) subexpression is passed unescaped to powershell -EncodedCommand on Windows and WSL, and the named example is an OAuth authorization_endpoint value supplied by a malicious MCP server (CVE-2026-119025). In oapi-codegen before 2.8.1, an attacker-controlled OpenAPI document can inject Go code through a servers[].x-go-name value or a non-literal enum entry, closing the const block and defining a func init() that executes when the victim builds and imports the generated package (CVE-2026-119027, CVE-2026-119028). Node Version Manager 0.31.2 through 0.40.5 completes the set: nvm_ls embeds a version string in a sed address and escapes the dot but not the backslash (CVE-2026-118905).

Why it mattersTreat OpenAPI documents, MCP server metadata and version strings as untrusted input to code generation, and run generators and package installs where arbitrary execution is contained rather than on the machine holding your keys.

confidence 0.70

Receipts

Oddities

A trust store that trusts a certificate authority whose private keys are published

Checkmk before 2.5.0p18, 2.4.0p39 and 2.3.0p52, plus end-of-life 2.2.0, ships CA bundles from certifi and webpki-roots that include a root trusting eMudhra (emSign) intermediate certificates whose private keys are public (CVE-2026-117611). Filed the same day, two QNAP advisories report hard-coded cryptographic keys in HBS 3 Hybrid Backup Sync, fixed in 26.4.0.521 and later (CVE-2025-62839, CVE-2025-62841). Elsewhere in the batch, Qpid Proton's trusted-CA APIs turned out to add to the system trust anchors rather than replace them, with the documented workaround being to point SSL_CERT_FILE at /dev/null (CVE-2026-105031).

Why it mattersCheck whether your monitoring and backup products ship their own trust store, because a certificate check against a published private key is a check that always passes.

confidence 0.76

Receipts

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

Most of yesterday's apparent corroboration is one tracker being copied by two others, and the only genuine technical cluster is a single vendor's advisory release.

Exception 01
The 50 is a publishing artefact, not a victim count
TheGentlemen accounts for 50 items on 31 October against a median of zero on other days, spread across atlas, ransomware.live and signal:atlas. Because the signal items derive from the same postings, the number of distinct organisations is very likely far below 50, and the 11:00 UTC hour holding 54 items against a mean of 9.57 per hour points to one bulk publication or re-index rather than a day of intrusions.
confidence 0.55Speculative
Wrong if
Deduplicating by victim name leaves only a handful of unique organisations, or the post timestamps turn out to be spread over earlier days.
Watch
Unique-victim count after dedupe, and whether posting continues through 1 and 2 November or drops back to zero.
Receipts
1. 1ransomware.livethegentlemen claimed Bi Link (Not Found · US) — bi-…
2. 2Security newsSyrian Hacker Gets Prison Time in US After Over a D…
Exception 02
Ransomware.live leads the other trackers by 1.4 to 10.1 hours
For Emperador, SafePay, Qilin, WhiteArmor, SilentRansomGroup, genesis, n0n, Rhysida, Vexy and AuditTeam, ransomware.live appears first and ransomlook or signal:atlas follow between 1.4 and 10.1 hours later; only NightSpire reverses it, by 1.1 hours. This is ingestion latency, so a claim appearing in three trackers is one source, not three.
confidence 0.70
Wrong if
A larger sample shows ransomlook or atlas first-seen times genuinely preceding ransomware.live for the same victim.
Watch
Whether the lag ordering holds across the next several days; treat the payload cross-source hit as a probable name collision with the word in CVE text.
Receipts
Exception 03
One vendor release explains the whole Java and identity cluster
Two pre-auth Wildfly IIOP flaws on the same listener, a JBoss EAP RBAC bypass, four Keycloak issues inside roughly an hour and a 389-ds-base NULL dereference share wording and timing, consistent with a single advisory release rather than independent discovery. It is single-source to NVD, so exploitation status is unknown.
confidence 0.60
Wrong if
The publication timestamps spread across several days, or the entries come from different CNAs.
Watch
Patch availability and any proof-of-concept or exploitation reporting for the Wildfly IIOP pair this week.
Receipts
Exception 04
The NVD feed stopping is probably our plumbing, not the world's
All 100 NVD items in the window fall on 29 October and the feed goes quiet after 00:43 on 31 October. A batch-ingest boundary is a better explanation than a sudden halt in CVE publication, and anyone reading the gap as calm is reading their own collector.
confidence 0.50Speculative
Wrong if
A re-poll produces NVD entries dated 31 October and 1 November.
Watch
The next collection run.
Receipts

Nothing to seeNo coordinated campaign across unrelated feeds beyond aggregator echo. Nothing in today's items connects the Ivanti exploitation to any of the leak-site activity, and the KEV-by-ransomware fusion scores in the atlas signals are model output rather than evidence of a named exploited CVE in any of these intrusions. Several cross-source hits, including holcim, chainalysis and northflank, are the same story carried by two feeds. Victim-side detail, dwell times and initial-access vectors were not visible anywhere in the window.

Deep read: 336 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueSun 8 Nov7d
CISA adds a third Ivanti Connect Secure CVE from the reported chain to the KEV catalogue by 8 November 2026.
Wrong ifNo additional Ivanti Connect Secure entry appears in KEV by end of 8 November 2026.
Receipts
1. 1Security newsAttackers Chain Three Ivanti Connect Secure Flaws t…
f-2026-11-01-1
Confidence0.45
DueWed 11 Nov10d
CVE-2026-58882, the Android 'SMS of Death', does not appear in the CISA KEV catalogue by 11 November 2026, despite public proof-of-concept code.
Wrong ifCVE-2026-58882 is listed in KEV on or before 11 November 2026.
Receipts
f-2026-11-01-2
Confidence0.75
DueSun 8 Nov7d
TheGentlemen posts fewer than ten new leak-site claims on ransomware.live between 2 and 8 November 2026, confirming the 31 October figure as a single burst rather than a new operating rate.
Wrong ifTen or more new TheGentlemen claims appear on ransomware.live in that window.
Receipts
1. 1ransomware.livethegentlemen claimed Bi Link (Not Found · US) — bi-…
2. 2Ransomware tempo · Ninja Signal graphNinja Signal ransomware tempo for 2026-11-01. In th…
f-2026-11-01-3
Confidence0.60

Scorecard

1 open

open
At least three of N0n's five placeholder listings (Company #99 to #103) are replaced by named victims on ransomware.live or ransomlook.
Called Thu 22 Oct · due Sun 1 Nov
Only one named N0n victim appears (Digital Triumph, 31 Oct), and nothing ties it to the Company #99-#103 placeholders. The due date is today and three named victims are not shown.

Glossary of terms you will be expected to nod at

Offensive agentic techniques (n.): the same intrusion as last year, except the part that used to get bored at two in the morning now does not. Appears in breach notifications because it reads as weather rather than as a decision anybody made about logging.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge, for calibration rather than drama: in the last 24 hours the Adversary DNA sensor profiled 49 hostile sources out of 4,889 addresses seen from 86 countries, 1,499 of them for the first time today, and those 49 sent 4,074 requests between them. Sixteen went past reconnaissance into exploitation attempts and seven groups of addresses shared a behavioural fingerprint, including nine IPs running the same fingerprint through /.git/config, /.env, /.env.local and /.env.production. The top hostility score, 7.7 out of 10, belongs to a pair of operators grinding through /login/xmlrpc.php and four flavours of wlwmanifest.xml, which is a 2015 attack delivered with real conviction. One scanner asked for /.aws/config, /.env-sample and then /.env.anthropic, which is the Northflank story arriving at our door in list form; another fired 123 requests in about 1.3 seconds; and one address tried CVE-2018-10561 against /gponform/diag_form, because somewhere a router from eight years ago is still answering. Raw logs never left the server. Only the findings did.

49hostile sources profiled

4,074requests from them

16reached exploitation

7shared-DNA clusters

7.7/10top hostility

4,889addresses at our edge

1,499first seen today

86countries

The WTF list

WTF #1
Looking for your AI keys
45.148.10.21, a scanner (hostility 4.3/10), sent 243 requests at 1 a minute to 2 of our sites, probing for /.aws/config, /.aws/.env, /.env-sample, /.docker/laravel/app/.env.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownSat 31 Oct, 14:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 6df93820bbb8
```
WTF #2
The most determined visitor
85.204.70.90, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
attribution: unknownSat 31 Oct, 14:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation → credential-access · DNA 82a939927b85
```
WTF #3
Trying CVE-2018-10561 on us
1 address sent 1 requests shaped like CVE-2018-10561 exploitation (/gponform/diag_form), including 103.194.93.124.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: gpon-router
```
WTF #4
Same DNA, different addresses
34.6.113.19, a scanner (hostility 6.4/10), sent 274 requests to one of our sites, probing for /.git/config, /.env, /.env.local, /.env.production.
Why it’s weird9 IPs share one behavioural fingerprint (DNA dfef4501b216): one tool or one operator rotating addresses: 104.234.53.150, 173.239.213.15, 45.92.229.33, 2001:41d0:304:300::3f2a, 185.194.178.16 and more.
attribution: unknownSun 1 Nov, 05:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA dfef4501b216
```
WTF #5
The strangest shopping list
85.204.70.94, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdAsked for files almost nobody else asks for: /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml, /login/wordpress/wp-incl.
attribution: unknownSat 31 Oct, 14:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation → credential-access · DNA 82a939927b85
```
WTF #6
In a hurry
195.178.110.242, a scanner (hostility 5.4/10), sent 123 requests to one of our sites, probing for /.env, /.docker/.env, /.env-sample, /.docker/config.json.
Why it’s weirdFired 123 requests in about 1.3 seconds.
attribution: unknownSat 31 Oct, 14:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```

§6

Tempo

Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.

260claims, 7 days

41of 269 groups active

thegentlemen50 this week · surging

qilin35 this week · surging

Booba Project17 this week · surging

SurgingBooba Project — 17 claims in 7 days against 2.3 expected from its own prior rate (p < 0.001)
Surgingrhysida — 9 claims in 7 days against 1.4 expected from its own prior rate (p < 0.001)
SurgingSilentRansomGroup — 12 claims in 7 days against 2.6 expected from its own prior rate (p < 0.001)
Surgingthegentlemen — 50 claims in 7 days against 26.6 expected from its own prior rate (p < 0.001)
Surginggenesis — 10 claims in 7 days against 2.3 expected from its own prior rate (p < 0.001)
Surgingpayload — 8 claims in 7 days against 1.6 expected from its own prior rate (p < 0.001)

Gone quiet: lynx (64 days), AiLock (67 days), abyss (67 days), blackwater (69 days).

Sector pressure, 30 days

UpTransportation — 2.1× its own prior share (72 claims, 34 expected)
UpEducation — 2.1× its own prior share (57 claims, 27 expected)
UpHealthcare — 1.2× its own prior share (109 claims, 87 expected)
DownAgriculture and Food Production — 0.7× its own prior share (23 claims, 34 expected)

23% of claims carry no sector label.

Brand churn

Of the 231 leak-site brands first seen since 2021-09-30, 76% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 68% were still claiming 90 days after their first post and 62% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 212 old enough to judge posted on one day and never again; 39% made at least half their claims in their first week. New brands this month: 11 — newest: everstake (2026-10-29, 5 claims), Shiba (2026-10-29, 4 claims), Whitearmor (2026-10-23, 18 claims).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Targeting

Over the last 180 days, among brands with at least 20 labelled claims: safepay put 33% of its claims on Germany (6.3× every other brand's share); N0n put 33% of its claims on Transportation (7.4× every other brand's share); SilentRansomGroup put 100% of its claims on Professional Services (6.0× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.

Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.

Posting clock

Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 59% of its claims on Mondays, half of them in 19:00–19:59 UTC; akira posted only 1 of 199 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 34% quieter per weekend day than per weekday.

all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.

Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →

§7

Ride-alongs

Free, live tools. No sign-up, no sales call.

§8

Colophon

How this edition was made, plainly.

Edition 35 was made by machine and checked by code. Every item published by 10 public threat feeds in the 24 hours to 05:05 UK (336 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.00. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

336items read

24hour window

$0.00cost of this edition

05:05 UTCgenerated

Sources this morning

NVD100ok
Signal Atlas87ok
ransomware.live47ok
infosec.exchange36ok
atlas23ok
RansomLook20ok
Security news13ok
RSS5ok
signal:ioc-family4ok
Ransomware tempo · Ninja Signal graph1ok

Get it in your inbox. Every morning. Probably.

A one-day leak-site surge that is mostly one actor, and mostly one upload

Eight bytes of text message, one integer going the wrong way, no phone

Chainalysis says it was breached using 'offensive agentic techniques'

Northflank breach ends with somebody else spending your model budget

A shared ChatGPT link that reads the room it is opened in

Red Hat's identity batch: the checks that forget which account they are checking

Your build is an interpreter, and it has been reading documents from strangers

A trust store that trusts a certificate authority whose private keys are published

The 50 is a publishing artefact, not a victim count

Ransomware.live leads the other trackers by 1.4 to 10.1 hours

One vendor release explains the whole Java and identity cluster

The NVD feed stopping is probably our plumbing, not the world's

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

Looking for your AI keys

The most determined visitor

Trying CVE-2018-10561 on us

Same DNA, different addresses

The strangest shopping list

In a hurry

Get it in your inbox. Every morning. Probably.

Sources this morning