A Daily Field Report on Things That Are Probably Fine
No. 36·Monday 2 November 2026·Published 06:00 UK·Fine Meter 3/5: Not fine, but survivable
Lead · Vulnerabilities
CISA put two Ivanti flaws in the catalogue. The attack needs three
CISA added two Ivanti Connect Secure flaws to the Known Exploited Vulnerabilities catalogue on Friday after active exploitation, while the reported intrusion chains three of them to reach unauthenticated root.
confidence0.92
The Cybersecurity and Infrastructure Security Agency added two Ivanti Connect Secure vulnerabilities to its KEV catalogue on Friday, following exploitation in the wild. One of them is CVE-2026-111357. Attackers are reported to be chaining three flaws in the product to obtain unauthenticated root access on the appliance that your remote workforce uses to be, in the architectural sense, inside.
Two is a catalogue entry. Three is an outcome. The gap between those numbers is where our whole industry lives: the KEV list is a record of bugs observed being used, not a description of the thing being done with them, and a chain is not the sum of its links, it is the shortest path through them. You can patch two and feel the warm glow of a closed ticket while the path stays open, which is the sort of arithmetic a maturity model is specifically designed not to notice.
It was added on a Friday, because it is always Friday. Somewhere a team that had planned a quiet weekend is now reading release notes for an appliance that terminates every session in the building, and the honest version of their status update is not 'patched' but 'patched and now reading the logs backwards with a feeling'. The right question this morning is not whether you applied the update. It is whether root was already there when you did.
Why it mattersIf you run Ivanti Connect Secure, patching is the floor: assume pre-patch root and go hunting in authentication and session logs, because a device that terminates every remote session is also the best place to watch them from.
A vulnerability chain is not three bugs. It is one bug that took three release cycles to finish assembling, and the vendor shipped every part of it.
— Sturgeon’s Revelations · Probably Fine Daily No. 36
Every morning06:00 UK
Get it in your inbox. Every morning. Probably.
One email a day. The whole paper. Unsubscribe in one click.
§2
Top stories
The rest of the last 24 hours, with receipts.
Ransomware
Qilin posted ten victims on a Sunday and did not break a sweat
Between 00:39 and 17:33 on 1 November, Qilin claimed ten named organisations: professional services and retail firms in Germany, a consultancy in Austria, a Hungarian rail vehicle repair works (BKV Vasúti Járműjavító Kft), a Japanese manufacturer (Shibata Co., Ltd.), two US professional services firms, a freight and logistics holding company, and fzmb GmbH, a German medical technology and biotechnology research centre. The claims were mirrored onto a second tracker within hours, and the modelling layer duly lit up Qilin as escalating across Manufacturing, Transportation, Professional Services, Retail and Healthcare, with a quiet cooling note for Government and Education by midnight. Our deep read counts 45 Qilin items on 11-01 against a median of eight on other days, though part of that volume is the same event arriving four times through four sources.
Why it mattersTransport engineering, medtech research and mid-market professional services in the DACH region are being worked through in batches; if that is you, the question is lateral movement from a backup or management network, not whether you are big enough to be interesting.
The FBI has put a name to the largest crypto theft on record, and the name has five others
The FBI, with US partners, formally attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899; one report puts the figure at $6.43 billion, another at $6.3 billion, and both describe it as the largest cryptocurrency heist on record. The attribution moved through cyber-news first, reached the mainstream security feeds about 12.9 hours later, and only then appeared as a threat-actor node in the signal layer roughly 22 hours after the news, which tells you the actor database is downstream of journalism rather than beside it.
Why it mattersAttribution is not recovery and it is not a control; if you hold or broker digital assets, the operationally useful fact is that the group that set the record is the same one your threat model has been filing under six different labels.
The machines are now the intrusion and the paperwork
Chainalysis disclosed a breach it attributes to "offensive agentic techniques", exposing customer names, email addresses, user IDs and organisational roles; the open-source ARTEX AI hacking framework has spread to another China-linked group and is linked to both espionage and financially motivated campaigns; and researchers at Parameter showed that a malicious ChatGPT share link could run an attacker's code in the session of anyone who opened it and read their private conversations, reported through OpenAI's bug bounty programme. On the other side of the ledger, AI-generated vulnerability reports are now overwhelming some bug bounty programmes, making it harder for new researchers to find a foothold, and Anthropic has published a note investigating three incidents in its own cybersecurity evaluations.
Why it mattersTreat a shared AI conversation link as executable content and an AI vendor's API keys as production credentials, because today both of those assumptions are load-bearing somewhere in your estate.
Four tens before breakfast, and one vendor's advice is 'buy a different device'
Canonical's LXD and MicroCloud carry a CVSS 10.0 flaw letting an attacker authenticate as a trusted client without holding that client's private key, needing only network reach to the HTTPS API and the trusted client's public certificate. WAVLINK's WN536AX6-A has CVE-2026-120279, a CVSS 10 remote OS command injection via the openvpn_cli handler with a public exploit, and the Linksys E8450 has just taken its second CVSS 10.0 in the same CGI file sixteen months apart — CVE-2026-120283, an unauthenticated strcpy overflow in portal.cgi via hidden_timezone, with no patch named and VulDB's stated remediation being to replace the device. Underneath those, ClickHouse Server has an unauthenticated remote code execution issue (CVE-2026-116366), Teltonika RUTOS and TSWOS let unauthenticated callers invoke LUA functions directly and reach OS commands (CVE-2026-82104), and Dahua's Intelligent Connection Center has an unauthenticated RCE (CVE-2025-31704). No item ties any of them to a named actor yet.
Why it mattersThese are all pre-authentication paths into things that sit at the edge or under the orchestration layer; inventory first, because the Linksys answer is procurement, not patching.
KeyDrift sits on the controller and reads the keys before the tunnel gets them
KeyDrift is malware targeting compromised Cisco SD-WAN controllers via CVE-2026-20127, intercepting IPsec keys and taking control of network traffic; the only link to Volt Typhoon in today's feed is a hashtag on the post carrying it, which is not attribution. Separately, Kaspersky detailed NetamLoader, a .NET AppDomainManager injection chain against a custom Windows 10 build used exclusively by government entities in Asia, in which a malicious .config file is dropped beside legitimate Patch My PC components in SoftwareDistribution\Download, likely via a supply chain compromise, with no attribution offered. The indicator layer meanwhile logged 179 new Mirai indicators, 158 for SalatStealer, 140 for Mozi, 21 for RustyStealer and 17 for SilentNet, with no baseline in this window to say whether any of that is unusual.
Why it mattersIf your tunnels terminate on an SD-WAN controller, that controller is a key custodian and should be monitored like one; and a loader that lives next to a legitimate patch agent will pass every eyeball test you have.
Somebody else's JavaScript sold a trader's position
On 29 October, malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved the funds to the attackers; the code had replaced a page-speed script the site loaded from an outside company, DebugBear, and Polymarket says it is refunding about $2.7 million. In the same window, cloud hosting platform Northflank told customers to rotate all credentials and secrets after a breach led to unauthorised use of their AI API keys, and Alpine Linux rebuilt its GitLab server and reset all passwords after attempted exploitation of a critical GitLab vulnerability on 20–21 October.
Why it mattersEvery third-party script on an authenticated page runs with your users' privileges; inventory what your pages load from whom, and make key rotation a thing you have practised rather than a thing you will read about.
Forty-one groups, 240 claims, and the newcomers are the ones to watch
The seven-day ransomware tempo shows 240 leak-site claims posted by 41 of the 269 groups tracked, with three statistically significant surges: Booba Project at 17 claims against 2.29 expected from its own prior rate, thegentlemen at 50 against 24.97, and SilentRansomGroup at 11 (all p < 0.001). Whitearmor, meanwhile, claimed an AmplifAI instance belonging to GoDaddy and published the Okta SSO URL, the Okta app ID and the Office 365 federation details alongside it, and was flagged as escalating in Technology and the US about 9.9 hours later. Elsewhere on the boards, byod claimed full personal data for 1.03 million current and former Michigan State University students and Xyrsober claimed a 2026 copy of Peru's RENIEC identity registry with roughly 31 million records; both remain unverified claims at this point.
Why it mattersSixteen per cent of tracked groups did all of this week's posting, so a short watchlist beats a long one — and if an intrusion claim comes with your identity provider's app IDs attached, start at federation, not at the endpoint.
The charging station whose password is printed on the charging station
Delta UFC500 charging stations derive the default Service account password from character positions of the device serial number, so an unauthenticated attacker with adjacent network access can reconstruct it or simply exhaust the keyspace (CVE-2026-22105). The shipped WebUI template database also retains cleartext factory defaults for all five account types, identical across devices and unchanged on the tested unit (CVE-2026-22109); the web server checks no authentication on POST or PUT, allowing an unauthenticated reboot and, by brute-forcing the configid, the setting of the service password and then any other setting (CVE-2026-22110); and HTTP basic auth enforces no retry limit or backoff, which the advisory notes makes the keyspace exhaustible (CVE-2026-22114). Separately, and we mention it only because the feed did, a Mastodon user announced they had vibe-coded a Rust implementation of sshd and asked whether they should deploy it to production today.
Why it mattersTreat EV charging infrastructure as an unauthenticated management network with a car attached, and keep it off anything that matters.
The daily deep read: what is under the feeds, not on top of them.
Underneath the feeds, most of today's volume is publication timing and model output wearing the costume of attacker activity.
Exception 01
Qilin's burst is real but inflated by mirroring
Qilin items jump to 45 on 1 November against a median of eight on other days, and it is the only entity appearing in four separate sources. Ten distinct victim claims in DE, AT, HU, JP and US were posted within about seventeen hours and mirrored on a second tracker roughly 11.8 hours behind the first, with modelled escalation stories layered on top. The operational tempo is high; the item count overstates it.
confidence0.70
Wrong if
The burst turns out to be mostly modelled signal items with few distinct leak-site postings on 11-01.
Watch
Qilin victim postings over the next 48 to 72 hours, especially healthcare, transport and Germany.
TraderTraitor appeared in cyber-news first, in the wider feeds 12.9 hours later and as a threat-actor node 22 hours after that. The Syrian Electronic Army node lagged its news item by 42 hours, and FrostyNeighbor arrived in the same batch. These nodes look like extraction from reporting, not independent corroboration, and should not be counted as a second source.
confidence0.65
Wrong if
Sourcing shows the actor nodes were created before, and independently of, the news items.
Watch
Whether on-chain or vendor analysis corroborates or revises the figure and the laundering path.
Incomplete fixes are today's most reliable pattern
Several of today's CVEs are regressions or partial fixes: Gravity Forms passing values to WordPress' unrestricted maybe_unserialize() rather than its own hardened version, Enable Media Replace reintroducing object injection, CakePHP's CRLF stripping described as an incomplete fix for CVE-2026-77634, and an incomplete backport of the CVE-2026-46099 fix leaving a local_bh imbalance in RHEL 9 kernels. Bypass hunting on recent patches is the cheapest offensive research available.
confidence0.55
Wrong if
The cases prove coincidental, or earlier windows show the same vendors regressing at the same rate.
Watch
Follow-on CVEs against the same four products in the next fortnight.
The Ivanti and Cisco exploitation has no actor attached yet
The KEV additions, the pre-auth RCEs in Teltonika, ClickHouse and Dahua, and the modelled KEV-by-ransomware fusion stories coincide in time, but no item links Ivanti exploitation to a named group, and the Cisco SD-WAN link to Volt Typhoon rests on a single hashtag. Anyone briefing a board on 'who' today is filling in a blank.
confidence0.40Speculative
Wrong if
A vendor or CISA advisory ties Ivanti or Cisco SD-WAN exploitation to a named actor or ransomware affiliate.
Watch
Vendor and CISA advisories naming an actor on either chain.
Nothing to seeNo timing clusters at all. The NVD feed supplied 100 items and then went silent after 11-01 00:18, and the daily clusters around Gravity Forms, ProFTPD, Elixir and Dell OpenManage are batch publication at 06:16 and 12:16 rather than coordinated anything. The large thegentlemen escalation burst was generated in a single run at 11:50 on 10-31 with no victim claims behind it in this window, which is model output, not field activity. The indicator counts have no baseline here, so 179 Mirai indicators is a number, not an anomaly. And the Mastodon post asking 'what if rogue ai stole 6 billion dollar' is almost certainly a person reading the Binance headline at four in the morning.
Deep read: 284 items read
§4
Forecast
Dated, falsifiable calls. We mark our own homework in public.
Today’s calls
DueCallConfidence
DueMon 9 Nov7d
Qilin posts at least five further named victims to its leak site, mirrored on at least one tracker, by 2026-11-09.
Wrong ifFewer than five new distinct Qilin victim claims appear across ransomware.live and ransomlook between 2026-11-02 and 2026-11-09.
Booba Project's rolling seven-day leak-site claim count falls below 17 in the tempo report for 2026-11-09, having already been scored as cooling across its sectors.
Wrong ifThe 2026-11-09 tempo report shows Booba Project at 17 or more claims over the preceding seven days.
No public vendor or CISA advisory ties the Ivanti Connect Secure exploitation chain to a specific named threat actor or ransomware group by 2026-11-12.
Wrong ifCISA, Ivanti or a major vendor names an actor behind the CVE-2026-111357 chain on or before 2026-11-12.
At least three of N0n's five placeholder listings (Company #99 to #103) are replaced by named victims on ransomware.live or ransomlook.
Called Thu 22 Oct · due Sun 1 Nov
The 1 November due date has passed. No item shows N0n placeholders (Company #99 to #103) replaced by named victims.
open
At least one of N0n's anonymised 'Company #104' to '#109' entries is replaced by a named victim on ransomware.live or ransomlook.
Called Fri 23 Oct · due Mon 2 Nov
2 November is the due date and has not ended. No item mentions N0n or Company #104 to #109.
partly
Qilin leak-site postings fall back to fewer than 15 claims on any single day across ransomware.live and ransomlook between 1 and 4 November, confirming the 60-item day was a batch rather than a campaign.
Called Sat 31 Oct · due Wed 4 Nov
Roughly 10 Qilin claims were posted on ransomware.live on 1 November, below 15. The window runs to 4 November, so a later day could still reach 15 or more.
No government body or law enforcement agency formally attributes the Binance theft to North Korea in these feeds by 14 November; the TraderTraitor link stays an analyst inference.
Called Sat 31 Oct · due Sat 14 Nov
On 1 November the FBI officially attributed the Binance theft to North Korea's TraderTraitor, before the 14 November deadline.
the same intrusion as last year, carried out by something that does not get tired, does not get bored and does not need a day rate; formerly known as a script, before the script acquired initiative and a disclosure statement.
§5
From our edge
Live attacks on our own servers in the last 24 hours. Yes, really ours.
Our own edge had an ordinary night, which is the unsettling part. In 24 hours the local sensor profiled 62 hostile sources — 42 scanners, 13 bot crawlers, four targeted operators, two brute forcers — sending 10,371 requests between them; 13 of those went past reconnaissance into actual exploitation attempts, and five groups of addresses shared a behavioural fingerprint, including one tool or operator rotating across 13 IPs under DNA dfef4501b216. Of 5,712 addresses seen at the edge across 110 countries, 2,566 were new today. The busiest visitor, 44.249.143.106, sent 334 requests at 52 a minute across two of our sites asking for /.git/config and four flavours of .env, and the sensor's most confident campaign match of the day put it at 62% a secrets-enumeration scanner. Another fired 122 requests in about 1.2 seconds, all of them for AWS and Docker credential files, which is not a person and has never been a person. One address sent six requests shaped like CVE-2024-4577 at an /index.php that does not exist, because the exploit is still cheaper to spray than to retire. Raw logs never left the server; only these findings did. None of it was aimed at us, and all of it would have worked on somebody.
62hostile sources profiled
10,371requests from them
13reached exploitation
5shared-DNA clusters
8.3/10top hostility
5,712addresses at our edge
2,566first seen today
110countries
The WTF list
WTF #1
The most determined visitor
132.196.59.85, a scanner (hostility 6.7/10), sent 130 requests to one of our sites, probing for /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /3PJcpMFsD8B_261013034223.php, /pw.php.
Why it’s weirdHighest hostility on the board; its kill chain reached weaponization.
attribution: unknownMon 2 Nov, 02:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA dfef4501b216
WTF #2
Same DNA, different addresses
34.176.200.106, a scanner (hostility 6.3/10), sent 277 requests at 271 a minute to one of our sites, probing for /.git/config, /.env, /.env.local, /.env.production.
Why it’s weird13 IPs share one behavioural fingerprint (DNA dfef4501b216): one tool or one operator rotating addresses: 216.73.161.156, 2001:41d0:601:2000::166e, 34.6.113.19, 92.222.24.199, 45.92.229.15 and more.
attribution: unknownMon 2 Nov, 02:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA dfef4501b216
WTF #3
Trying CVE-2024-4577 on us
1 address sent 6 requests shaped like CVE-2024-4577 exploitation (/index.php), including 109.238.86.65.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
probe family: webshell
WTF #4
The strangest shopping list
20.211.122.120, a scanner (hostility 6.4/10), sent 46 requests to one of our sites, probing for /wk/index.php, /inputs.php, /ioxi-o.php, /function/function.php.
Why it’s weirdAsked for files almost nobody else asks for: /wk/index.php, /inputs.php, /ioxi-o.php, /function/function.php, /rip.php.
attribution: unknownMon 2 Nov, 02:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA 83562bd8e880
WTF #5
In a hurry
34.77.241.117, a scanner (hostility 5.4/10), sent 122 requests to one of our sites, probing for /.aws/.env, /.aws/credentials.bak, /.docker/config.json, /.docker/laravel/app/.env.
Why it’s weirdFired 122 requests in about 1.2 seconds.
attribution: unknownMon 2 Nov, 02:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
WTF #6
Somebody we might know
44.249.143.106, a scanner (hostility 6.6/10), sent 334 requests at 52 a minute to 2 of our sites, probing for /.git/config, /.env, /.env.local, /.env.production.
Why it’s weirdThe sensor's most confident campaign match of the day: Secrets enumeration scanner (Nuclei-compatible or custom tooling) at 62%.
attribution: Secrets enumeration scanner (Nuclei-compatible or custom tooling) (sensor's best match, 62%)Mon 2 Nov, 02:00 UTC
Detail
kill chain: reconnaissance → weaponization · DNA 5941231fc8fa
§6
Tempo
Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.
240claims, 7 days
41of 269 groups active
thegentlemen50 this week · surging
qilin28 this week
Booba Project17 this week · surging
SurgingBooba Project — 17 claims in 7 days against 2.3 expected from its own prior rate (p < 0.001)
Surgingthegentlemen — 50 claims in 7 days against 25.0 expected from its own prior rate (p < 0.001)
SurgingSilentRansomGroup — 11 claims in 7 days against 2.5 expected from its own prior rate (p < 0.001)
Surgingrhysida — 8 claims in 7 days against 1.4 expected from its own prior rate (p < 0.001)
Surginggenesis — 10 claims in 7 days against 2.3 expected from its own prior rate (p < 0.001)
Surgingeverest — 8 claims in 7 days against 2.7 expected from its own prior rate (p = 0.006)
UpTransportation — 2.1× its own prior share (71 claims, 34 expected)
UpEducation — 2.0× its own prior share (55 claims, 27 expected)
UpHealthcare — 1.2× its own prior share (107 claims, 88 expected)
DownAgriculture and Food Production — 0.7× its own prior share (23 claims, 34 expected)
23% of claims carry no sector label.
Brand churn
Of the 231 leak-site brands first seen since 2021-09-30, 76% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 68% were still claiming 90 days after their first post and 62% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 213 old enough to judge posted on one day and never again; 39% made at least half their claims in their first week. New brands this month: 11 — newest: Shiba (2026-10-29, 5 claims), everstake (2026-10-29, 5 claims), Whitearmor (2026-10-23, 19 claims).
Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.
Targeting
Over the last 180 days, among brands with at least 20 labelled claims: safepay put 33% of its claims on Germany (6.2× every other brand's share); N0n put 33% of its claims on Transportation (7.4× every other brand's share); SilentRansomGroup put 100% of its claims on Professional Services (6.0× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.
Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.
Posting clock
Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 59% of its claims on Mondays, half of them in 19:00–19:59 UTC; akira posted only 1 of 196 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 33% quieter per weekend day than per weekday.
all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.
Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.
Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers
One email a day. The whole paper. Unsubscribe in one click.
§8
Colophon
How this edition was made, plainly.
Edition 36 was made by machine and checked by code. Every item published by 11 public threat feeds in the 24 hours to 05:05 UK (284 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.00. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.
284items read
24hour window
$0.00cost of this edition
05:05 UTCgenerated
Sources this morning
NVD100ok
Signal Atlas48ok
infosec.exchange37ok
atlas27ok
Security news22ok
ransomware.live17ok
RansomLook17ok
signal:ioc-family9ok
RSS3ok
signal:actor3ok
Ransomware tempo · Ninja Signal graph1ok
ITEMS READ: 284|SOURCES: 11|STORIES DROPPED FOR LACK OF RECEIPTS: 0|COST: $0.00|STATUS: NOT FINE, BUT SURVIVABLE
OWNER: the machine|EDITOR: the rules|CALLS OPEN: 3|NEXT REVIEW: tomorrow 06:00 UK