Lead · The day's shape

Your incident happened at a company you have never audited

France's blood service, a French bank, six airlines and a hosting provider all had a bad Wednesday, and in every case the intrusion was somewhere else.

confidence 0.88

France's national blood service confirmed that a cyberattack on Coolworld, the firm that maintains its cold storage, raised temperature and defrost settings at three of its facilities, threatening stored blood products; the Hackmanac alert says the freezers were reprogrammed to reach 110°C. That is not a data breach with an attached regret letter. That is software reaching through a maintenance contract and touching something physical, and it is the most consequential item in the last twenty-four hours by a distance.

It did not travel alone. Crédit Mutuel Arkéa confirmed attackers made transfers using the bank's own account after compromising an unnamed supplier, with reported losses of $133 million (€118 million). Japan Airlines, Cathay Pacific, Korean Air, Asiana, Singapore Airlines and Malaysia Airlines have all disclosed breaches over the past week traced back to Amadeus IT Group. OpsShield's update servers were accessed with compromised credentials and multiple cPGuard versions poisoned. The NIKKE PC launcher scripts were tampered with to ship credential and wallet stealers. DreamHost had attackers inside its File Manager platform for two months and lost customers' FTP/SFTP usernames and passwords.

We call this third-party risk, which is a category error, and the error is doing real work. The third party is not adjacent to your environment. It is in your environment, with a service account, a VPN, an update channel and, in at least one case this week, write access to a thermostat. Your control boundary stops where your contract stops. The adversary's does not, which is the whole of their business model and most of ours.

Why it mattersBuild the list of suppliers that can change state in your estate — updates, remote management, building systems — and alert on configuration changes made by their accounts, not just logins.

Receipts

Today’s revelation

Third-party risk management is the belief that a questionnaire returned in April governs a refrigeration controller in November.

— Sturgeon’s Revelations · Probably Fine Daily No. 39

§2

Top stories

The rest of the last 24 hours, with receipts.

Vulnerabilities

CISA says WordPress Core is being exploited during upgrades, and adds a two-year-old Apple bug while it is there

CISA added CVE-2026-119977 to the Known Exploited Vulnerabilities catalogue, a high-severity time-of-check-time-of-use flaw in WordPress Core rated CVSS 8.1 and exploited in the wild during software upgrades. The same KEV window added CVE-2024-27834, an improper authentication flaw in Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 that lets an attacker with arbitrary read and write bypass pointer authentication, carrying an EPSS of 0.00598. Meanwhile a Telegram channel spent the evening advertising that 'a tool exploiting three recent WordPress vulnerabilities will be released shortly', naming CVE-2026-63030 and CVE-2026-60137, alongside an older Struts CVE-2017-5638 tool with live target URLs attached.

Why it mattersPatch WordPress Core now and treat the upgrade path itself as attacker-reachable; the KEV Apple entry is the end of a chain, not the start, so hunt for the read/write primitive ahead of it.

confidence 0.92

Receipts

Threat actors

APT29 hijacked an analytics script, and the phone did the rest

Sekoia's TDR describes a large-scale watering hole campaign attributed to APT29, using three infection vectors: compromised legitimate sites, adversary-in-the-middle-style impersonation of high-profile domains, and a supply-chain compromise of the Ukrainian web analytics service Plerdy SEO Tracker. The injected script delivered n-day iOS and Android exploits in zero-click fashion to visitors, dropping DarkSword and AndroSnitch to take browser cookies, Wi-Fi passwords and device data. Four separate source types carried it inside five hours, which for once reflects a real event rather than a collector echo.

Why it mattersMobile is in scope: enforce OS patch levels on anything that reads work mail, and check whether your own sites load third-party analytics you have never inventoried.

confidence 0.82

Receipts

Vulnerabilities

A thousand Zyxel switches, two SonicWall flaws nobody will fix, and a very long patch queue

Zyxel has patched a zero-day in its GS1900 series switches that attackers used to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. SonicWall confirmed two flaws in end-of-life Global Management System 9.5.2 and earlier that will not be patched at all: CVE-2026-109593, an unauthenticated file read at CVSS 9.1, and CVE-2026-109594, an authenticated SQL injection, with migration to NSM offered as the remedy. Behind those: a Barracuda ESG authentication bypass chainable with a timezone-field command injection to root, an APT flaw in default Debian 12+ and Ubuntu 22.04+ setups (CVE-2026-109518) letting a man-in-the-middle swap an already-verified package and run code as root, a critical Rails ImageMagick file-write fixed in 8.1.4.1 and 8.0.5.2, two Xen flaws that let one guest read and write another's memory including dom0 with no mitigation available, a critical no-interaction Android RCE (CVE-2026-58868) fixed at patch level 2026-11-01, and Chrome 157 with 213 security fixes, seven critical.

Why it mattersEdge appliances and package managers first: credential theft from a switch and root from an apt-get are both game-over paths that no EDR agent is watching.

confidence 0.90

Receipts

Ransomware

Four groups emptied their drafts folder on Tuesday, and the trackers called it a wave

Ninja Signal's tempo count puts 246 leak-site claims in the last seven days from 42 of the 272 groups tracked, with thegentlemen surging to 50 claims against 24.56 expected from its own prior rate, safepay at 18 against 4.98, and genesis at 9. Separately, a group calling itself BYOD claimed IHG Hotels & Resorts with an LDAP bind password of '123' and full CyberArk access, repeated by Darkfeed eight hours later as a 'BusinessServices' incident, and none of it is confirmed by anyone who would know.

Why it mattersCount victims, not postings: a batch upload mirrored by two collectors is one event, and your board paper should not report it as twenty-six.

confidence 0.78

Receipts

AI & security

948 Linux root exploits in thirty hours, and the scanners are now asking for your model keys

OpenAI detailed a pipeline using an upcoming cyber-focused model that identified and analysed 2,308 candidate Linux kernel findings, reproduced 1,724 vulnerabilities, developed 291 information-leak proof-of-concepts and validated and patched 948 local privilege escalations, at a reported $1.2 million in API costs — though a quoted passage circulating on Mastodon puts the campaign cost at roughly $32,936 against a hypothetical bounty valuation of $18.9M–$66.3M, so read the scope before you read the number. The defensive side of the same ledger is grimmer and better corroborated: WorkOS, Northflank and Trigger.dev disclosed hacks tied to harvested AI access tokens, a malicious Claude Code-branded extension (versions 2.1.313 and 2.1.312) shipped an SSH backdoor through the Cursor marketplace, Check Point found 'prompt adware' in a Codex jailbreak bundle that rewrites the agent's trusted instructions to advertise a third-party gateway, and the KeyHunter operation combined LLM API credential theft with academic fraud across 20 universities. On our own edge, one scanner asked for /.env.anthropic by name.

Why it mattersModel API keys are now credentials with a cost centre and a blast radius: rotate them, scope them, and put them in the secrets inventory alongside cloud keys.

confidence 0.72

Receipts

Threat actors

Binance's first incident report: three engineers, a rigged coding assignment, and months of patience

SecurityWeek reports Binance's first incident report traces the record theft of around $6 billion to a months-long campaign that compromised three engineers' computers, beginning with a rigged coding assignment and an abused AI tool. Channel chatter puts the figure at approximately $6.3 billion on 29 October and claims the previous record was Bybit at roughly $1.5 billion in February 2025, with a Chainalysis report dated 1 October cited for North Korea attribution — dates and totals that do not sit neatly together, so treat the exact number as the exchange's and the rest as unverified. North Korea has meanwhile launched missiles toward the sea while Pyongyang protests US claims about the Binance hack.

Why it mattersThe initial access was a job-shaped lure aimed at engineers with production reach; your developer onboarding and take-home-exercise culture is now an attack path.

confidence 0.62

Receipts

Policy

Several White House staffers are renting out their internet addresses, possibly without knowing it

Brian Krebs reports that several staffers at the White House are using computers or mobile devices running residential proxy services, which make their internet address available for others to rent, according to security experts. One of those proxy services is a Russian company whose founder's web hosting business was, in Krebs's words, ground zero for cyberattacks against election systems in Arizona. The story was picked up and recirculated on Telegram the same morning.

Why it mattersResidential proxy SDKs ride in on free VPNs, games and utilities; if your allow-list treats 'residential IP' as benign, it is now a managed service for someone else.

confidence 0.78

Receipts

Oddities

BrainCipher's extortion site now apologises for not knowing who it has robbed

Several BrainCipher listings on ransomware.live arrive with AI-generated victim descriptions that decline to describe the victim: for megastarfinancial.com, 'I don't have verified, reliable information about a company operating at megastarfinancial.com'; for ciscocems.com, a note that the domain superficially resembles Cisco and no affiliation can be confirmed. The corresponding ransomlook entries are not vague at all, citing 32,000 documents of borrower material at one listing and 243,500 files totalling over 170GB at another, with a cyberfear.com contact address. The extortion economy has reached the stage where the sales copy is outsourced to a model that has the decency to express uncertainty and the attacker does not.

Why it mattersLeak-site metadata is now partly machine-written, so sector and country labels in your tracking spreadsheet are an LLM's guess rather than ground truth.

confidence 0.80

Receipts

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

Under the feeds: one real campaign, several batch uploads wearing the costume of a crime wave, and a marketplace of unverifiable claims.

Exception 01
Tuesday's ransomware 'surge' is largely batch publication mirrored twice
Safepay (26 items), Soul (25, every one tied to the single domain codice-ledger.io), BrainCipher (19) and N0n (12) all peak on 4 November against a median of 0–1 on other days, and ransomware.live typically leads ransomlook by about an hour on the same victim domains. These are posting volumes, not independent incidents.
confidence 0.70
Wrong if
The Soul entries resolve to distinct victims with different domains and sectors, or victims confirm the intrusions individually.
Watch
Whether any Soul or Safepay victim confirms a breach, or is confirmed by news, in the next 3–7 days.
Receipts
Exception 02
The APT29 mobile campaign and the new Apple KEV entry are not linked by any source
APT29 appears across RSS, cyber-news, OTX and Telegram within five hours, and CISA added Apple CVE-2024-27834 in the same window. The temptation to join them is strong and unsupported: no item connects the KEV entry to Sekoia's exploit set.
confidence 0.60Speculative
Wrong if
Sekoia's indicator or exploit list includes CVE-2024-27834, or CISA cites this campaign.
Watch
Sekoia follow-ups and further iOS or Android KEV additions over the next week.
Receipts
Exception 03
The AI exploit-generation cost figures do not reconcile
The same pipeline is reported at $1.2 million in API costs and, in a quoted passage, at roughly $32,936 for the campaign with a $18.9M–$66.3M hypothetical bounty valuation. The scopes probably differ; no source says so. The AI-as-target thread — stolen model tokens, poisoned extensions, prompt adware — is far better corroborated than the AI-as-weapon arithmetic.
confidence 0.50Speculative
Wrong if
A primary write-up clarifies that the two figures cover different scopes and both stand.
Watch
The original researcher write-up and any kernel-maintainer response.
Receipts
Exception 04
A Telegram seller is borrowing Mandiant's naming scheme
A channel advertising a 2.285 PB Ukrainian dataset, a recycled 800-million-record Facebook set and Slack/Jira pivots into Google and Motorola is trading under 'UNC6783', a label shaped like a professional tracking cluster. Brand-borrowing is cheaper than compromise.
confidence 0.55Speculative
Wrong if
Named victims confirm the data, or a vendor publicly uses UNC6783 for this activity.
Watch
Victim statements and independent verification of sample data.
Receipts

Nothing to seeNo evidence of a coordinated campaign across the ransomware groups; the cross-source overlap is the same postings mirrored twice. The 04:00 cluster on 5 November is an ordinary morning posting wave. The BreachForums 'final chapter' messages, the hacktivist claims about the UN and Indian politics, the Vanuatu seismic signal and the AS35805 Shodan note are single-source noise and nothing has been built on them. NVD's silence after 00:31 on 4 November is almost certainly batch ingestion, not an outage.

Deep read: 572 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueSat 14 Nov9 days
At least one further airline, travel or hospitality company publicly discloses a breach traced to Amadeus IT Group.
Wrong ifNo new Amadeus-linked disclosure appears in these feeds by 14 November.
Receipts
1. 1Security newsMore Asian airlines announce data breaches after at…
f-2026-11-05-1
Confidence0.60
DueThu 12 Nov7 days
No corroborated, publicly available exploit tool for the three WordPress CVEs teased by @Ransomwareg (including CVE-2026-63030 and CVE-2026-60137) is confirmed by a reputable source.
Wrong ifA named vendor or researcher confirms a working public tool for those CVEs before 12 November.
Receipts
f-2026-11-05-2
Confidence0.50
DueThu 12 Nov7 days
IHG Hotels & Resorts does not publicly confirm the BYOD intrusion claim.
Wrong ifIHG issues a statement or regulatory filing acknowledging the incident by 12 November.
Receipts
1. 1Telegram🚨 Major breach in UK BusinessServices sector A lead…
f-2026-11-05-3
Confidence0.65

Scorecard

1 right

right
CISA adds at least one further vulnerability to the KEV catalogue by 11 November 2026.
Called Wed 4 Nov · due Wed 11 Nov
CISA KEV added CVE-2024-27834 (Apple Multiple Products) on 2026-11-04, and CVE-2026-119977 (WordPress Core) was also confirmed added on 2026-11-04.
Receipts
1. 1CISA KEVCVE-2024-27834 Apple Multiple Products: Apple Multi…
2. 2Security newsCISA Confirms Hackers Exploiting WordPress Core Fla…

Glossary of terms you will be expected to nod at

End-of-life (n.): the date on which a vendor stops writing patches for a device that will nonetheless remain in your rack for several more years, load-bearing, unmentioned, and reachable from the internet.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge, meanwhile, had an ordinary day, which is the frightening part. The Adversary DNA sensor profiled 95 hostile sources — 49 scanners, 36 bot crawlers, 6 targeted operators, 2 brute forcers — sending 7,645 requests between them, of which 41 went past reconnaissance into actual exploitation attempts, across 12 groups of addresses sharing a behavioural fingerprint. We saw 5,182 addresses in total from 93 countries, 1,536 of them for the first time, top hostility 8.5 out of 10. Six addresses sent 34 requests shaped like CVE-2017-9841 at our PHPUnit paths, a named exploit still being sprayed at the internet regardless of what the patch notes say about the year. One scanner at 34.62.82.207 fired 123 requests in about half a second looking for .env files. Another, 207.175.165.55, sent 121 requests working through /.aws/credentials and then asked, specifically, for /.env.anthropic — the shopping list has been updated, and model keys are now on it next to cloud keys. Raw logs never left the server; only these findings did.

95hostile sources profiled

7,645requests from them

41reached exploitation

12shared-DNA clusters

8.5/10top hostility

5,182addresses at our edge

1,536first seen today

93countries

The WTF list

WTF #1
Looking for your AI keys
207.175.165.55, a scanner (hostility 5.4/10), sent 121 requests to one of our sites, probing for /.aws/credentials, /.aws/credentials.bak, /.env-example, /.env.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownWed 4 Nov, 21:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```
WTF #2
The most determined visitor
103.47.145.23, a scanner (hostility 7.4/10), sent 22 requests to one of our sites, probing for /wordpress/wp-login.php, /site/wp-login.php, /admin/wp-login.php, /web/wp-login.php.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
attribution: unknownWed 4 Nov, 21:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → credential-access · DNA e91dc116af74
```
WTF #3
Trying CVE-2017-9841 on us
6 addresses sent 34 requests shaped like CVE-2017-9841 exploitation (/vendor/phpunit/phpunit/…), including 185.177.72.23, 185.177.72.70, 185.177.72.100.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: phpunit-rce
```
WTF #4
Same DNA, different addresses
114.119.154.203, a bot crawler (hostility 0.2/10), sent 66 requests to one of our sites, probing for /threat-check/Adobe%20Reader%20and%20Acrobat%20Arbitrary%20Code%20Exec.
Why it’s weird11 IPs share one behavioural fingerprint (DNA 672df8667b3d): one tool or one operator rotating addresses: 213.32.68.80, 85.208.96.194, 180.92.135.45, 57.129.81.224, 152.39.230.157 and more.
attribution: unknownWed 4 Nov, 21:00 UTC
Detail
```
kill chain: reconnaissance → exploitation · DNA 672df8667b3d
```
WTF #5
The strangest shopping list
213.202.253.4, a scanner (hostility 6.8/10), sent 29 requests to one of our sites, probing for /wp-content/txets.php, /filefuns.php, /wp-content/postnews.php, /postnews.php.
Why it’s weirdAsked for files almost nobody else asks for: /wp-content/txets.php, /filefuns.php, /wp-content/postnews.php, /postnews.php, /userfuns.php.
attribution: unknownWed 4 Nov, 21:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 6f8669ba7e26
```
WTF #6
In a hurry
34.62.82.207, a scanner (hostility 5.4/10), sent 123 requests to one of our sites, probing for /.env, /.env-example, /.docker/laravel/app/.env, /.aws/.env.
Why it’s weirdFired 123 requests in about 0.5 seconds.
attribution: unknownWed 4 Nov, 22:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```

§6

Tempo

Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.

246claims, 7 days

42of 272 groups active

thegentlemen50 this week · surging

qilin25 this week

N0n22 this week

Surgingthegentlemen — 50 claims in 7 days against 24.6 expected from its own prior rate (p < 0.001)
Surgingsafepay — 18 claims in 7 days against 5.0 expected from its own prior rate (p < 0.001)
Surginggenesis — 9 claims in 7 days against 2.1 expected from its own prior rate (p < 0.001)
SurgingBrainCipher — 8 claims in 7 days against 1.8 expected from its own prior rate (p < 0.001)
Surgingrhysida — 6 claims in 7 days against 1.6 expected from its own prior rate (p = 0.006)
SurgingSilentRansomGroup — 8 claims in 7 days against 2.8 expected from its own prior rate (p = 0.007)

Gone quiet: DYSPHOR1A (60 days), gunra (62 days), lynx (68 days), AiLock (71 days).

Sector pressure, 30 days

UpTransportation — 1.9× its own prior share (68 claims, 35 expected)
UpEducation — 1.9× its own prior share (53 claims, 28 expected)
UpEnergy & Utilities — 1.4× its own prior share (37 claims, 27 expected)
UpHealthcare — 1.2× its own prior share (107 claims, 89 expected)
DownAgriculture and Food Production — 0.6× its own prior share (20 claims, 35 expected)

25% of claims carry no sector label.

Brand churn

Of the 234 leak-site brands first seen since 2021-09-30, 76% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 68% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 214 old enough to judge posted on one day and never again; 38% made at least half their claims in their first week. New brands this month: 3 — newest: Aoqin (2026-11-04, 4 claims), OBSOFT (2026-11-03, 6 claims), PixelLeaks (2026-11-03, 1 claim).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Targeting

Over the last 180 days, among brands with at least 20 labelled claims: safepay put 33% of its claims on Germany (6.4× every other brand's share); N0n put 33% of its claims on Transportation (7.4× every other brand's share); genesis put 95% of its claims on the United States (2.6× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.

Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.

Posting clock

Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 60% of its claims on Mondays, half of them in 18:00–19:59 UTC; akira posted only 1 of 195 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 33% quieter per weekend day than per weekday.

all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.

Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →

§7

Ride-alongs

Free, live tools. No sign-up, no sales call.

§8

Colophon

How this edition was made, plainly.

Edition 39 was made by machine and checked by code. Every item published by 15 public threat feeds in the 24 hours to 05:05 UK (572 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $1.09. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

572items read

24hour window

$1.09cost of this edition

05:05 UTCgenerated

Sources this morning

NVD100ok
ThreatFox100ok
RansomLook73ok
Signal Atlas60ok
Telegram57ok
Security news52ok
ransomware.live47ok
infosec.exchange40ok
RSS11ok
atlas10ok
AlienVault OTX10ok
signal:ioc-family9ok
signal:kev1ok
CISA KEV1ok
Ransomware tempo · Ninja Signal graph1ok

Get it in your inbox. Every morning. Probably.

CISA says WordPress Core is being exploited during upgrades, and adds a two-year-old Apple bug while it is there

APT29 hijacked an analytics script, and the phone did the rest

A thousand Zyxel switches, two SonicWall flaws nobody will fix, and a very long patch queue

Four groups emptied their drafts folder on Tuesday, and the trackers called it a wave

948 Linux root exploits in thirty hours, and the scanners are now asking for your model keys

Binance's first incident report: three engineers, a rigged coding assignment, and months of patience

Several White House staffers are renting out their internet addresses, possibly without knowing it

BrainCipher's extortion site now apologises for not knowing who it has robbed

Tuesday's ransomware 'surge' is largely batch publication mirrored twice

The APT29 mobile campaign and the new Apple KEV entry are not linked by any source

The AI exploit-generation cost figures do not reconcile

A Telegram seller is borrowing Mandiant's naming scheme

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

Looking for your AI keys

The most determined visitor

Trying CVE-2017-9841 on us

Same DNA, different addresses

The strangest shopping list

In a hurry

Get it in your inbox. Every morning. Probably.

Sources this morning