Lead · Vulnerabilities

Five remote holes in a router that has no one left to fix it

Five D-Link DIR-878 CVEs landed together with public exploit code and no patch, because the product is past support — and the commodity botnets are having a busy week.

confidence 0.90

The batch is CVE-2026-124560 through CVE-2026-124564, all against D-Link DIR-878 1.20B05, all in the HNAP handler, all remote. A heap-based buffer overflow in GetCAPTCHAsetting, rated critical with remote code execution risk. A stack-based overflow in SetVLANSettings in prog.cgi via the VID argument. Two more overflows in SetWanSettings, one via Primary/Secondary and one via ConfigDNS/Primary/ConfigDNS/Secondary. And a path traversal in GetListDirectory via ListDirectoryPath. The advisories note the exploits have been publicly disclosed and may be used, and that the vulnerabilities only affect products no longer supported by the maintainer. The public write-up's remediation advice is, in full: isolate or decommission unsupported routers.

End of life is a status in a spreadsheet. It is not a status in physics. The router does not know it has been discontinued; it is still answering HNAP requests with the same cheerful competence it had in its first week, the way a fridge whose warranty expired in 2019 keeps the milk cold and keeps drawing current and keeps being, technically, a fire. The only thing that has ended is the possibility of anybody fixing it. Which means the patch cycle for this device is not a patch cycle. It is a skip.

In the same window our feeds carried eleven new Mirai indicators, eighty-six new Mozi indicators, and a steady drip of Mirai sample hashes into ThreatFox. Nobody has shown us HNAP exploit traffic against these five CVEs yet, and we are not going to pretend otherwise. We are simply noting that unauthenticated remote code execution on an unsupported consumer router, with working exploits in public, has one well-established career path, and it does not involve a responsible disclosure timeline.

Why it mattersIf a DIR-878 is on your estate or on a home-worker's desk with a management path into anything, there is no patch coming; the only controls available today are network isolation and a bin.

Receipts

Today’s revelation

A device at end of life has not stopped working. It has stopped being anybody's responsibility except yours, and the exploit does not read release notes.

— Sturgeon’s Revelations · Probably Fine Daily No. 43

§2

Top stories

The rest of the last 24 hours, with receipts.

Vulnerabilities

The sshole bug has moved from paper to honeypot

SANS Internet Storm Center reports that its Cowrie honeypots are seeing an increase in attempts to exploit CVE-2026-123158, the 'sshole' vulnerability that emerged last week. The ISC notes its own data is limited here, because the honeypots only collect the first 255 characters of an SSH password and the attempts involve longer ones. That is a lovely detail: the instrument is being outgrown by the attack it is measuring.

Why it mattersExploitation attempts are now observed, not theorised, so treat internet-facing SSH as in scope today rather than at the next maintenance weekend.

confidence 0.80

Receipts

1Security newsScans for Sshole Vulnerability (CVE-2026-123158), (…

Ransomware

The dashboard says cooling, the counter says eighteen

Ninja Signal's tempo for today records 252 leak-site claims in seven days from 43 of the 273 groups tracked, with medusalocker surging on 18 claims against 1.46 expected from its own prior rate, BrainCipher on 12 against 1.74, and metaencryptor on 7, all at p below 0.001. The same window shows what that looks like at posting speed: N0n uploaded claims #138 to #147 in about six minutes, incransom posted three in about two, LockBit5 dropped four at once including Sun Clinical Laboratories, Yatra, Grupo Telles and Starmark, Deadlock worked through Kadick, Chonlatee, Trinity Custom Homes, Coopebis, NoseTea and Fidex, and akira claimed Calmont Wire & Cable. Meanwhile Atlas tagged medusalocker's sector runs as 'cooling'. Both things are in the same feed, on the same morning, about the same group.

Why it mattersBatch posting makes a leak site a publishing schedule, not an incident timeline; count claims per week against a group's own baseline before you brief anyone on 'activity levels'.

confidence 0.85

Receipts

AI & security

Your model key is now on the same shopping list as your cloud key

iTnews reports that the 'Don't ask again' option in Anthropic's Claude Code leaks developer secrets, with researchers counting 2,539 exposed credentials and the vendor looking into fixes. Separately, Wired reports that free Chinese AI models are getting scary good at hacking.

Why it mattersModel API keys now need the same handling as cloud keys: inventory, rotation, egress limits and a detection for anyone fetching dotfiles from your web root.

confidence 0.75

Receipts

Vulnerabilities

WordPress plugins: nine ways to become an administrator before breakfast

The NVD batch includes Static Snapshot through 0.2.1, where unauthenticated attackers can inject shell metacharacters into operating-system commands, and WP Libre Form 1.5.0.1, where unauthenticated users can upload PHP files to a web-accessible location and execute them. Wurdey through 1.0.0 will log you in as administrator if you know the administrator's username and nothing else; WHIZZ through 1.1.8 lets anyone set an arbitrary password for any user; placester through 1.4.3 lets unauthenticated attackers overwrite an administrator's email and walk in through password reset; GS JWT Authentication through 1.0.0 and Mail Mage through 0.0.25 both take unauthenticated SQL injection. On Telegram, @NeuraSCTB spent the same window advertising dorking tools, webshell CVE tools and WordPress account-creation tools, then offered 400 random-domain WordPress account logs.

Why it mattersUnauthenticated admin takeover in a plugin is not a patch-Tuesday item; inventory what is actually installed, not what the procurement form says, and update today.

confidence 0.85

Receipts

Vulnerabilities

Ten Keycloak flaws, several of which are the identity layer declining to check identity

A single disclosure batch carries ten Keycloak CVEs, and the theme is uncomfortable. CVE-2026-19688: the Admin REST API fails to verify the intended audience of bearer tokens, so an attacker operating a client in a realm can capture an administrator's access token and reuse it. CVE-2026-97367: a malicious client owner can point their own tokens at another user's active session, up to full account takeover via the recovery details. CVE-2026-107124 fixes a session ID in the victim's browser through the OIDC logout endpoint before the security checks finish. CVE-2026-96460 lets a requester extend service-account access indefinitely by repeatedly exchanging tokens, and the rest cover SAML ProxyRestrictions being ignored, stateless tokens falling back to usernames, role injection via Dynamic Client Registration, claim-name abuse, Jackson-shaped roles escaping sanitisation, and manage-clients abuse of JWKS and client secrets.

Why it mattersThis is the component everything else trusts, so patch it on the identity team's schedule, not the application backlog's, and review admin token audiences afterwards.

confidence 0.90

Receipts

Policy

Iris Ohyama: 7.7 million people, and the file was in somebody else's cloud

Japanese manufacturer Iris Ohyama, operator of the Iris Plaza shopping platform, has disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorised access to a third-party cloud service it used. The breakdown is 5.8 million members and ex-members plus 1.9 million non-members; a suspicious file was found in the third-party service, and names, addresses, emails, dates of birth and encrypted passwords may be exposed, with no card data stored there. Ex-members is the word to sit with: people who left, counted anyway.

Why it mattersYour third-party cloud services hold your customers' data under your name, so the retention schedule for ex-customers is a security control and should be audited like one.

confidence 0.90

Receipts

Threat actors

ShinyHunters renames itself after the label researchers gave it

The @espeonsh Telegram channel was renamed to 'Scattered Lapsus Hunters UNC6783', posted a backup channel, linked a patched.to profile for shinyhunters, and then advertised fresh inventory: EU bank leads for FR, CH and BE with fullz included, and 'high-tier verified' crypto exchange databases. Four posts in one day. Nothing in the material verifies that the inventory is real, that the operators are who they say, or that adopting a tracking cluster name as a brand means anything beyond marketing.

Why it mattersTreat a channel name as a claim, not an attribution; if a vendor report cites the rename as evidence of a group identity, ask what else it rests on.

confidence 0.60

Receipts

Oddities

The language model that admitted it had nothing, in the middle of an extortion post

Eclipse claimed globalair.com.sg with a victim description reading, in full and marked '[AI generated]': 'N/A I don't have reliable, verified information about a specific company operating at globalair.com.sg. Rather than speculate about its business activities, industry classification, or operational details, which could produ—'. Elsewhere, @DarkfeedNews rated five separate alerts at 'AI Risk Level: 10/10', including two different e-commerce database leaks, Malaysian government employee records and an Ecuadorian bank. And Atlas generated fifty stories for thegentlemen in one day against a median of zero. Somewhere in the middle of all this there are real victims; everything around them is autocompletion.

Why it mattersHalf the ecosystem's 'intelligence', criminal and commercial alike, is now generated text with a confidence score attached; verify the victim, not the write-up.

confidence 0.80

Receipts

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

Most of today's 'cross-source confirmation' is one leak-site post wearing three hats, and one sandbox escape nobody has folded into a story yet.

Exception 01
Atlas and ransomlook are downstream of ransomware.live, not independent of it
For N0n, BYOD, incransom, akira and Deadlock, ransomware.live posted first, ransomlook followed by 1 to 9 hours and signal:atlas by 6 to 8.5 hours. The multi-source counts for these actors reflect one underlying event propagating through aggregators, which means an Atlas escalation flag is not corroboration of the original claim.
confidence 0.80
Wrong if
Atlas items for these actors carrying event timestamps earlier than the ransomware.live posts, or citing a distinct source.
Watch
Per-actor lag over the next 24 to 48 hours; treat Atlas as a derived layer.
Receipts
1. 1ransomware.liveincransom claimed www.bogard.com.mx (Other · MX) — .
Exception 02
Deadlock's aggregator tags do not match where the victims are
Nigerian Kadick is tagged US, Thai NOSE TEA is tagged US Retail and Colombian Coopebis is tagged Costa Rica, Agriculture. Any country or sector statistic built from these tags is wrong before it reaches your slide, and so are the country-run escalations derived from them.
confidence 0.70
Wrong if
The victims' registered domains and addresses match the tagged countries.
Watch
Whether the tags are corrected on later refreshes.
Receipts
Exception 03
Fifty thegentlemen stories in one hour is probably a processing batch
Atlas produced 50 items for thegentlemen on 2026-11-08 against a median of zero other days, inside a 12:00 hour cluster of 61 items against a mean of 9.91 per hour. This looks like generated-story fan-out across sector and country permutations rather than 50 distinct events.
confidence 0.55Speculative
Wrong if
Fifty distinct victim or leak-site events exist for thegentlemen on that date.
Watch
Whether the pattern recurs at the next Atlas run.
Exception 04
A host kernel bug that undercuts the sandbox you bought to contain the last one
iTnews reports researchers turning the PwnEscape Linux flaw into a Firecracker breakout, demonstrating a host kernel bug that undercuts defence-in-depth sandboxing. If microVM isolation is load-bearing in your multi-tenant or CI design, that assumption is the thing to re-examine this week.
confidence 0.65
Wrong if
The demonstrated breakout turns out to require conditions not present in standard Firecracker deployments.
Watch
Vendor and distribution advisories naming the kernel fix.
Receipts
1. 1infosec.exchange🔹 iTnews - SecurityResearchers turn PwnEscape Linux…
Exception 05
The NVD feed's silence after 07 November is almost certainly our plumbing
NVD items stop after 2026-11-07T19:36 despite exactly 100 earlier items, and ThreatFox also stops at exactly 100. Round numbers of that sort are ingest caps, not a pause in CVE publishing, and nobody should brief it as a quiet week.
confidence 0.60Speculative
Wrong if
A fresh full pull shows no NVD publication timestamps after 2026-11-07.
Watch
The next ingest cycle.
Receipts

Nothing to seeNo link was found between the Keycloak, undici, Foxit and JetBrains CVE clusters and any threat actor; they are routine vendor disclosure batches. Atlas's compound-crisis flags for Taiwan, Indonesia, Panama, Colombia, Japan, Russia and the Philippines carry no named actors and no events, and are low-signal. The Telegram claim about a Safari 'DarkSword' exploit arrived attached to a crypto casino advert and we are not carrying it. The #monsterdon film-night cluster on Mastodon is not an intrusion set.

Deep read: 432 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueMon 23 Nov14d
No CISA KEV entry will exist for any of CVE-2026-124560 through CVE-2026-124564 (D-Link DIR-878) by end of day 23 November 2026, despite public exploit code, because the device is out of support.
Wrong ifA KEV entry appears for any of the five DIR-878 CVEs before that date.
Receipts
f-2026-11-09-1
Confidence0.80
DueMon 16 Nov7d
medusalocker will post at least five further leak-site claims visible on ransomware.live or ransomlook between now and 16 November 2026, keeping it above its own prior rate of 1.46 per week.
Wrong ifFewer than five new medusalocker claims appear on those feeds in the window.
Receipts
1. 1Ransomware tempo · Ninja Signal graphNinja Signal ransomware tempo for 2026-11-09. In th…
f-2026-11-09-2
Confidence0.60
DueThu 19 Nov10d
At least one of N0n's claims #138 to #147 will move from pending exposure to a named victim on ransomware.live or ransomlook by 19 November 2026.
Wrong ifAll ten claims remain unnamed or are removed without a named victim.
f-2026-11-09-3
Confidence0.50

Scorecard

1 wrong · 2 open

open
None of the CGM CLININET CVEs published on 23 October is added to CISA KEV by 9 November 2026.
Called Mon 26 Oct · due Mon 9 Nov
No KEV-addition items appear in today's feed, so a negative call can't be settled either way.
wrong
At least one of Everstake's scheduled releases (the 494 Gb entry dated 4 November or the 370.73 Gb entry dated 6 November) appears as published on ransomlook or ransomware.live.
Called Fri 30 Oct · due Sat 7 Nov
Due 7 Nov and past. No item shows an Everstake entry published on ransomlook or ransomware.live.
open
Booba Project's rolling seven-day leak-site claim count falls below 17 in the tempo report for 2026-11-09, having already been scored as cooling across its sectors.
Called Mon 2 Nov · due Mon 9 Nov
The 2026-11-09 tempo item is truncated and the visible part doesn't mention Booba Project.
Receipts
1. 1Ransomware tempo · Ninja Signal graphNinja Signal ransomware tempo for 2026-11-09. In th…

Glossary of terms you will be expected to nod at

End of life (hardware) (n.): A commercial status, not a physical one. The device continues to route packets, accept HNAP requests and answer to the whole internet exactly as before; the only thing that has ended is the possibility of anyone fixing it. See also: still plugged in behind the filing cabinet.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge, overnight: the Adversary DNA sensor profiled 84 hostile sources — 50 bot crawlers, 33 scanners and one targeted operator — sending 7,504 requests between them, of which 49 went past reconnaissance into exploitation attempts. Eleven groups of addresses shared a behavioural fingerprint, including one cluster of ten IPs all asking for the same dotfiles; 5,079 addresses touched the edge from 79 countries, 1,596 of them for the first time. The top hostility score was 7.7 out of 10, belonging to 82.102.18.222, which sent 20 requests at WordPress wlwmanifest and xmlrpc paths and reached credential access. One scanner asked for /.env.anthropic alongside /.aws/credentials, which is the shopping list quietly updating itself. Another fired 20 requests in about 1.4 seconds, and one address tried CVE-2024-4577 at /index.php three times, because old exploits never retire, they just get cheaper. Raw logs never left the server; only these findings did.

84hostile sources profiled

7,504requests from them

49reached exploitation

11shared-DNA clusters

7.7/10top hostility

5,079addresses at our edge

1,596first seen today

79countries

The WTF list

WTF #1
Looking for your AI keys
34.38.19.77, a scanner (hostility 5.4/10), sent 122 requests to one of our sites, probing for /.env, /.aws/.env, /.env.anthropic, /.aws/credentials.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownSun 8 Nov, 22:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```
WTF #2
The most determined visitor
82.102.18.222, a targeted operator (hostility 7.7/10), sent 20 requests to one of our sites, probing for /login/wp-includes/wlwmanifest.xml, /login/xmlrpc.php, /login/blog/wp-includes/wlwmanifest.xml, /login/web/wp-includes/wlwmanifest.xml.
Why it’s weirdHighest hostility on the board; its kill chain reached credential-access.
attribution: unknownSun 8 Nov, 22:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation → credential-access · DNA 82a939927b85
```
WTF #3
Trying CVE-2024-4577 on us
1 address sent 3 requests shaped like CVE-2024-4577 exploitation (/index.php), including 101.1.16.25.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: webshell
```
WTF #4
Same DNA, different addresses
34.62.82.207, a scanner (hostility 5.1/10), sent 132 requests to one of our sites, probing for /.aws/.env, /.docker/laravel/app/.env, /.env, /.docker/.env.
Why it’s weird10 IPs share one behavioural fingerprint (DNA 18e39c4b41fb): one tool or one operator rotating addresses: 2400:6180:10:200::f6a7:9000, 34.156.35.188, 2a03:b0c0:1:e0:0:1:f004:9001, 35.195.41.101, 170.64.170.136 and more.
attribution: unknownSun 8 Nov, 22:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```
WTF #5
The strangest shopping list
52.179.208.167, a scanner (hostility 6.7/10), sent 99 requests to one of our sites, probing for /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /dehnl.php, /motu.php.
Why it’s weirdAsked for files almost nobody else asks for: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /dehnl.php, /motu.php, /tpg-contato.php.
attribution: unknownSun 8 Nov, 22:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation · DNA dfef4501b216
```
WTF #6
In a hurry
85.204.70.88, a scanner (hostility 6.3/10), sent 20 requests to one of our sites, probing for //wp-includes/wlwmanifest.xml, //xmlrpc.php, //blog/wp-includes/wlwmanifest.xml, //web/wp-includes/wlwmanifest.xml.
Why it’s weirdFired 20 requests in about 1.4 seconds.
attribution: unknownSun 8 Nov, 22:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA dfef4501b216
```

§6

Tempo

Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.

252claims, 7 days

43of 273 groups active

N0n44 this week · surging

thegentlemen25 this week

medusalocker18 this week · surging

Surgingmedusalocker — 18 claims in 7 days against 1.5 expected from its own prior rate (p < 0.001)
SurgingBrainCipher — 12 claims in 7 days against 1.7 expected from its own prior rate (p < 0.001)
Surgingmetaencryptor — 7 claims in 7 days against 1.1 expected from its own prior rate (p < 0.001)
SurgingN0n — 44 claims in 7 days against 26.5 expected from its own prior rate (p = 0.001)
SurgingSilentRansomGroup — 9 claims in 7 days against 3.0 expected from its own prior rate (p = 0.003)
Surgingakira — 14 claims in 7 days against 7.3 expected from its own prior rate (p = 0.018)

Gone quiet: embargo (61 days), kazu (63 days), DYSPHOR1A (64 days), gunra (66 days).

Sector pressure, 30 days

UpTransportation — 2.0× its own prior share (72 claims, 37 expected)
UpEducation — 1.3× its own prior share (43 claims, 33 expected)
DownAgriculture and Food Production — 0.6× its own prior share (20 claims, 37 expected)

26% of claims carry no sector label.

Brand churn

Of the 235 leak-site brands first seen since 2021-09-30, 75% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 67% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 214 old enough to judge posted on one day and never again; 38% made at least half their claims in their first week. New brands this month: 4 — newest: Destello (2026-11-05, 1 claim), Aoqin (2026-11-04, 5 claims), OBSOFT (2026-11-03, 7 claims).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Targeting

Over the last 180 days, among brands with at least 20 labelled claims: safepay put 33% of its claims on Germany (6.2× every other brand's share); N0n put 29% of its claims on Transportation (6.5× every other brand's share); SilentRansomGroup put 100% of its claims on Professional Services (6.2× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.

Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.

Posting clock

Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 59% of its claims on Mondays, half of them in 18:00–19:59 UTC; akira posted only 2 of 197 claims at weekends and half its claims in 12:00–13:59 UTC; half of thegentlemen's claims appeared in 06:00–09:59 UTC. Leak sites overall are 32% quieter per weekend day than per weekday.

all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.

Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →

§7

Ride-alongs

Free, live tools. No sign-up, no sales call.

§8

Colophon

How this edition was made, plainly.

Edition 43 was made by machine and checked by code. Every item published by 13 public threat feeds in the 24 hours to 05:05 UK (432 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $0.76. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

432items read

24hour window

$0.76cost of this edition

05:05 UTCgenerated

Sources this morning

NVD100ok
ThreatFox100ok
Signal Atlas82ok
Telegram42ok
infosec.exchange36ok
ransomware.live24ok
RansomLook19ok
atlas18ok
Security news4ok
signal:ioc-family4ok
RSS1ok
signal:actor1ok
Ransomware tempo · Ninja Signal graph1ok

Get it in your inbox. Every morning. Probably.

The sshole bug has moved from paper to honeypot

The dashboard says cooling, the counter says eighteen

Your model key is now on the same shopping list as your cloud key

WordPress plugins: nine ways to become an administrator before breakfast

Ten Keycloak flaws, several of which are the identity layer declining to check identity

Iris Ohyama: 7.7 million people, and the file was in somebody else's cloud

ShinyHunters renames itself after the label researchers gave it

The language model that admitted it had nothing, in the middle of an extortion post

Atlas and ransomlook are downstream of ransomware.live, not independent of it

Deadlock's aggregator tags do not match where the victims are

Fifty thegentlemen stories in one hour is probably a processing batch

A host kernel bug that undercuts the sandbox you bought to contain the last one

The NVD feed's silence after 07 November is almost certainly our plumbing

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

Looking for your AI keys

The most determined visitor

Trying CVE-2024-4577 on us

Same DNA, different addresses

The strangest shopping list

In a hurry

Get it in your inbox. Every morning. Probably.

Sources this morning