Lead · Vulnerabilities

Microsoft patched a four-figure number this month and nobody can agree which four figures

The count is not the story; the one Outlook bug that attackers were already using is the story, and it went into KEV on Tuesday.

confidence 0.90

BleepingComputer says 1,235 flaws. SecurityWeek says 1,094. The SANS Internet Storm Center says 1,260, of which 68 are critical and 167 are Chromium issues reaching you through Edge. CyberScoop counted 1,093, Krebs on Security said almost 1,100 with 63 critical. These are reports of the same Tuesday. We are not arguing about risk, we are arguing about arithmetic, and the arithmetic will be settled by nobody because by the time it is settled there will be another Tuesday.

The part that is not in dispute: CVE-2026-124194, a missing-user-interaction flaw in Outlook that lets an unauthorised attacker spoof over a network, CVSS 6.5, which Microsoft says it is aware of being actively exploited and which CISA added to the Known Exploited Vulnerabilities catalogue on 10 November. Dark Reading's read of the rest flags critical Exchange, SharePoint, Windows Search and LDAP bugs underneath it. Adobe shipped 110 fixes across nine products the same day, with Adobe Connect alone carrying 24 CVEs, 18 critical and six at CVSS 10.0. SAP's November day brought four maximum-severity flaws in NetWeaver and Web Dispatcher, inside 35 fixes and 42 advisories depending on who is counting.

You do not install a number. You install KB5132061 or KB5131087 on Windows 11, KB5131096 on Windows 10 extended security, and you do the Outlook one first because it is the only item on the list with a confirmed user. Everything else is a queue. One of them has a customer.

Why it mattersOne of this month's thousand-odd is already being exploited and arrives by email; sequence the rollout around that, not around the total.

Receipts

Today’s revelation

The size of a patch release measures how good the vendor has become at finding bugs. It measures nothing at all about Thursday.

— Sturgeon’s Revelations · Probably Fine Daily No. 45

§2

Top stories

The rest of the last 24 hours, with receipts.

Vulnerabilities

Six into KEV, and two of them are the thing that reads your email before you do

Barracuda has separately warned that attackers have begun exploiting two recently patched ESG flaws to run commands with root privileges. The day before, CISA flagged a SonicWall SonicOS MFA bypass amid reports of possible exploitation, and Google shipped emergency updates for the eighth Chrome zero-day of the year.

Why it mattersFour of the six sit on the perimeter appliances nobody reboots in daylight; the due dates are the only part of this your auditor will read.

confidence 0.90

Receipts

Vulnerabilities

Three flaws being exploited right now that do not have a KEV badge to make it official

Vates warns that a critical Xen Orchestra authentication bypass, tracked as VSA-2026-062 with no CVE yet, is being exploited in the wild: REST cookie parsing turns authenticationToken=j:%7B%7D into an empty object, REST authentication accepts it, and you get admin and root-level takeover of XCP-ng hosts. The 'SSHole' OpenSSH authentication bypass, CVE-2026-123158, is being used to run commands, steal credentials and persist, with the first wave attributed to botnets and crypto miners. And Huntress documented an October intrusion chaining two AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, to drop webshells hidden in PNG images, a miner and a sandbox-evading Python implant, with a credential query seen against a related Veeam server.

Why it mattersExploitation is happening at the hypervisor-management and backup layers, which is where your recovery plan lives.

confidence 0.85

Receipts

Vulnerabilities

N-able pulls hosted N-central offline and tells on-prem customers to switch theirs off

After a researcher publicly disclosed more than 30 alleged zero-days in N-central, including issues described as allowing full system takeover, N-able took its hosted environments offline and urged on-premises customers to shut their servers down. The same weekend, the LNbits project told every operator of its Bitcoin Lightning wallet software to shut down their servers while fixes are prepared, citing a wave of attacks. Two sources carry the N-able story and the '30-plus' figure is the researcher's claim, not a vendor count, so hold it loosely while you act on it tightly.

Why it mattersN-central is MSP tooling: one compromised instance is a key ring, not a key, and shutting it down is cheaper than explaining it later.

confidence 0.70

Receipts

Ransomware

Forty-seven Inc Ransom posts in a day is a scraper waking up, not a gang working harder

On 10 November the leak-site trackers lit up: Inc Ransom 47 items against a median of one on other days, Interlock 20 against a median of nil, Vortex 17, N0n 17, Booba Project 13, with Inc posting roughly sixty victim pages inside a single minute. Ninja Signal's tempo count for the week is 306 claims from 49 of 275 tracked groups, with N0n at 97 claims against 27.56 expected from its own prior rate and Interlock at 11 against 1.25; Hackmanac's weekly tally records 448 attacks across 64 countries, INC Ransom most active with 34, the USA most affected at 21.9 per cent and 98 attacks. The victim lists are real and include school districts, clinics and several managed IT providers whose client lists are named in the postings, so triage them individually. Meanwhile NBC News reports some top US firms are turning away emergency incident response work as AI-aided attacks surge, with Sophos saying other DFIR firms have asked it for overflow support, and one responder's assessment of the initial entry in all this was that it is definitely not sophisticated.

Why it mattersTreat posting volume as an ingest timestamp and the victim names as work; if you have no IR retainer, this is the week the market ran out of spare responders.

confidence 0.75

Receipts

Threat actors

Qubole's own AWS credentials were the way in to more than a dozen customers

Between 14 and 26 October an attacker used IAM credentials belonging to Qubole's AWS account 805246085872 to assume the integration roles customers had granted the platform, then stole stored secrets, keys, environment variables, credentials and data, according to Wiz. SecurityWeek puts the count at more than a dozen organisations hit. No exploit, no malware, no hooded anybody: a role that was supposed to be assumed, assumed.

Why it mattersGo and list every cross-account role in your estate with an external principal, check the external ID and the condition keys, and look for AssumeRole calls you cannot name.

confidence 0.85

Receipts

AI & security

Stolen model keys are now a line item: $740,000 of someone else's inference

Railway says attackers exploited flaws in its infrastructure, stole customer authentication secrets and ran up roughly $740,000 in fraudulent AI usage, potentially exposing credentials for up to 100,000 workspaces, with OpenRouter declining refunds. Fireworks AI confirmed a wider breach affecting account and billing information, secrets, datasets, incomplete models and Notion AI chats for a limited set of accounts after a third-party cloud provider was compromised. NEAR AI had an SGLang remote code execution flaw exploited on an inference server, with data taken from 18 AI agents and about 100 user accounts and confidential-mode requests potentially visible to the attacker. And Claude Code settings files have been quietly committing thousands of secrets to public GitHub repositories, which is the same story told by a different tool.

Why it mattersModel API keys are now bearer tokens with a billing relationship; rotate them, scope them, alert on spend, and stop storing them next to your agent's config.

confidence 0.85

Receipts

Threat actors

France names an IRGC unit for the October refrigeration attacks

France has attributed the October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations, causing food losses and at least 15 fires, to Iranian state-backed hackers, identifying the perpetrators as part of Shahid Kaveh, an IRGC cyber unit previously linked to attacks on industrial controllers at US water utilities. Paris prosecutors have opened a case against a commander and two deputies; Tehran denies it. US agencies have separately warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally, exploiting vulnerabilities or weaknesses in unpatched systems, with service disruption, fire hazards and inventory loss as the stated risks.

Why it mattersInternet-exposed refrigeration and cold-chain controllers are now a named target set with a named adversary; find yours before the insurer does.

confidence 0.80

Receipts

Oddities

Two car brands, one admin:admin, every door

Two security researchers found that the login systems behind two car brands' mobile apps could be taken over completely, giving access to any customer's account and, for owners with a connected car, the ability to unlock the doors and start the engine. The way in was a server with the default password admin:admin. Both apps signed customers in through the same system.

Why it mattersIf your product can move a tonne of metal, the authentication service behind it deserves more than the factory default.

confidence 0.80

Receipts

1Security newsDefault 'admin:admin' Server Password Helps Researc…

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

Most of today's apparent corroboration is syndication, and most of today's ransomware surge is a scraper catching up.

Exception 01
The leak-site bursts are batch uploads, not a tempo change
Inc Ransom posted 47 items on 2026-11-10 against a median of one on other days, Interlock 20 against nil, Vortex 17, N0n 17 and Booba Project 13, with Inc posting about sixty victims within a minute, Interlock about ten in eight minutes and three Vortex entries inside a minute sharing one 2026-11-12 deadline. That fits scraper backfill, site migration or scripted upload far better than a sudden change in intrusion rate. The victims still warrant individual triage.
confidence 0.70Speculative
Wrong if
Victim disclosures or incident reports dating these intrusions to the past week, or the same actors sustaining the elevated rate for several more days.
Watch
Whether Inc Ransom, Interlock and Vortex hold the rate for 72 hours, and whether the 12 November Vortex deadline produces published data.
Receipts
Exception 02
ransomware.live is the early source, everything downstream is an echo
For Vortex, Interlock, Play, N0n, SilentRansomGroup, Booba Project, Dark Project, Climax and Aoqin, ransomware.live posted first and ransomlook, Atlas or Telegram followed by between 1.6 and 17.6 hours. The 'multi-source' counts for these actors are the same claim travelling, not independent confirmation.
confidence 0.75
Wrong if
Over a longer window, ransomlook or Atlas lead in a comparable share of cases.
Watch
Lag on newly named actors over the next week.
Receipts
1. 1RansomLookaoqin leaks leaked Irwin Automotive Group
2. 2ransomware.liveBooba Project claimed Acclaim Health (Healthcare ·…
Exception 03
Patch Tuesday counts conflict and the KEV link is inferred, not stated
CVE-2026-124194 is the only entity appearing across CISA KEV, cyber-news, Mastodon and the KEV signal, and is probably the exploited Outlook zero-day from Patch Tuesday, but no source joins the two explicitly. The published totals disagree: 1,094, 1,235, 1,260 and about 1,093 to 1,100, and SAP's critical counts differ too. Use vendor release notes, not headlines, for your change record.
confidence 0.60
Wrong if
Microsoft's advisory shows CVE-2026-124194 is a different flaw from the exploited Outlook zero-day.
Watch
Microsoft's own advisory text and the KEV due dates.
Receipts
Exception 04
The vulnerability feeds stop at 00:43 and that is almost certainly our plumbing
NVD, CISA KEV and the KEV signal all stop after 2026-11-10T00:43, with all 100 NVD items in the early period and six items each in the KEV sources. That looks like a single batch ingest rather than three sources going quiet, but it does mean exploited-CVE coverage for 10 and 11 November in this window is incomplete.
confidence 0.60Speculative
Wrong if
NVD or KEV items with later timestamps appear in the next window.
Watch
Whether the vulnerability sources resume at the next ingest.
Receipts
1. 1NVDCVE-2026-103303: The Turisbook Booking System WordP…
2. 2CISA KEVCVE-2026-124194 Microsoft Office: Microsoft Office…

Nothing to seeNo timing clusters were established beyond the leak-site bursts. Nothing links the Iran, Russia, China and DPRK items to each other or to the ransomware activity. The Japan cluster (Nitori, JCCI, Toyota) and the Binance breach claim are thin and may be coincidence or impersonation. The bulk CVE waves against OpenEMR, Craft CMS and SunEditor are batch-publishing artefacts with no exploitation evidence, and the ThreatFox volume is routine.

Deep read: 700 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueSun 15 Nov96h
At least one of Vortex's three 12 November deadline victims (PYRAMID HEALTHCARE, ALEXION, CRESA) appears as published or leaked data on ransomware.live or ransomlook.
Wrong ifNo published or leaked status for any of the three on either tracker by 15 November.
Receipts
f-2026-11-11-1
Confidence0.55
DueWed 18 Nov7d
Inc Ransom posts fewer than 20 new leak-site claims on any single day between 12 and 18 November, confirming the 47 was a backfill rather than tempo.
Wrong ifAny single day in that window with 20 or more new Inc Ransom claims across ransomlook or ransomware.live.
Receipts
f-2026-11-11-2
Confidence0.70
DueSat 21 Nov10d
CISA adds the SSHole OpenSSH flaw, CVE-2026-123158, to the KEV catalogue.
Wrong ifCVE-2026-123158 is absent from KEV on 21 November.
Receipts
f-2026-11-11-3
Confidence0.35

Scorecard

1 partly · 2 wrong

wrong
Booba Project's rolling seven-day leak-site claim count falls below 17 in the tempo report for 2026-11-09, having already been scored as cooling across its sectors.
Called Mon 2 Nov · due Mon 9 Nov
The 2026-11-11 tempo report shows N0n surging at 97 claims in 7 days; Booba Project posted 6 new claims on 2026-11-10, well above 17 threshold. The tempo report covers 306 claims total and Booba Project atlas signals show escalating activity, not cooling below 17.
Receipts
wrong
No corroborated, publicly available exploit tool for the three WordPress CVEs teased by @Ransomwareg (including CVE-2026-63030 and CVE-2026-60137) is confirmed by a reputable source.
Called Thu 5 Nov · due Thu 12 Nov
A Telegram post from @NeuraSCTB advertises an auto-exploit tool listing CVE-2026-63030 and CVE-2026-60137 (the teased WordPress CVEs) as working exploits for sale, constituting a publicly advertised working tool, though not from a named reputable vendor. However the falsifier requires a named vendor or researcher confirmation — the feed shows only a Telegram seller post, not reputable source confirmation. Keeping as open would be more precise, but due date is 2026-11-12 and no reputable source confirmed it.
Receipts
1. 1TelegramWTS AUTO EXPLOIT TOOL FITUR : - AUTO UP SHELL - TRY…
partly
N-able either restores hosted N-central or publishes an advisory naming at least one of the 30-plus disclosed flaws by 20 November 2026.
Called Tue 10 Nov · due Fri 20 Nov
N-able took hosted N-central offline (confirmed in feed), satisfying the 'restores hosted N-central' part partially — actually it went offline not restored. No advisory naming the 30+ flaws yet. The action taken is taking offline, not restoring or publishing named-flaw advisory. Due 2026-11-20.
Receipts

Glossary of terms you will be expected to nod at

Trusted integration (n.): A cross-account role you approved once, in a hurry, for a data platform, now held by a company whose incident report you will read as news, in the past tense, about yourself.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge sensor profiled 114 hostile sources in 24 hours — 70 bot crawlers, 39 scanners, three brute forcers and two targeted operators — which between them sent 7,087 requests, of which 61 went past reconnaissance into exploitation attempts, across 9,697 addresses from 100 countries, 2,934 of them seen here for the first time today. Seventeen groups shared a behavioural fingerprint, including twelve addresses running as DNA 18e39c4b41fb; one of them, 34.53.218.24, asked for /.aws/credentials, /.aws/config, /.env and, notably, /.env.anthropic, which is model API keys appearing on the shopping list alongside cloud keys. The hurry is real: 195.178.110.242 fired 161 requests in about 0.7 seconds asking for /src/.env, /laravel/.env, /.env.bak and /.env.staging, and 195.178.110.211 managed 513 requests at 315 a minute. Top hostility on the board was 7.0 out of 10 for an IPv6 scanner whose chain reached exploitation, and two addresses still sprayed /hnap1 in the shape of CVE-2015-2051, which tells you what the internet thinks of your patch notes. Raw logs never left the server; only these findings did.

114hostile sources profiled

7,087requests from them

61reached exploitation

17shared-DNA clusters

8.2/10top hostility

9,697addresses at our edge

2,934first seen today

100countries

The WTF list

WTF #1
Looking for your AI keys
34.53.218.24, a scanner (hostility 5.4/10), sent 122 requests to one of our sites, probing for /.aws/credentials, /.env.anthropic, /.aws/config, /.env.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownTue 10 Nov, 06:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```
WTF #2
The most determined visitor
2a02:c207:2298:6410::1, a scanner (hostility 7.0/10), sent 21 requests at 18 a minute to one of our sites, probing for /.env.backup, /.aws/credentials, /.docker/config.json, /.env.
Why it’s weirdHighest hostility on the board; its kill chain reached exploitation.
attribution: unknownTue 10 Nov, 06:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation · DNA 3268dda94501
```
WTF #3
Trying CVE-2015-2051 on us
2 addresses sent 2 requests shaped like CVE-2015-2051 exploitation (/hnap1), including 113.138.242.19, 171.14.129.134.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: dlink-hnap
```
WTF #4
Same DNA, different addresses
195.178.110.211, a scanner (hostility 5.9/10), sent 513 requests at 315 a minute to one of our sites, probing for /.env, /vendor/.env, /lib/.env, /lab/.env.
Why it’s weird12 IPs share one behavioural fingerprint (DNA 18e39c4b41fb): one tool or one operator rotating addresses: 195.178.110.211, 2400:6180:100:d0:0:1:c071:6001, 2400:6180:100:d0:0:1:c072:1001, 34.53.218.24, 207.175.165.55 and more.
attribution: unknownTue 10 Nov, 06:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```
WTF #5
The strangest shopping list
20.92.243.53, a scanner (hostility 6.7/10), sent 156 requests at 156 a minute to one of our sites, probing for /spip.php, /about.php, /1.php, /atomlib.php.
Why it’s weirdAsked for files almost nobody else asks for: /spip.php, /about.php, /1.php, /atomlib.php, /wp-trackback.php.
attribution: unknownWed 11 Nov, 02:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA dfef4501b216
```
WTF #6
In a hurry
195.178.110.242, a scanner (hostility 5.1/10), sent 161 requests to one of our sites, probing for /src/.env, /laravel/.env, /.env.bak, /.env.staging.
Why it’s weirdFired 161 requests in about 0.7 seconds.
attribution: unknownWed 11 Nov, 02:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA ce6ecdfacbe3
```

§6

Tempo

Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.

306claims, 7 days

49of 275 groups active

N0n97 this week · surging

thegentlemen25 this week

Climax Inc17 this week · new

SurgingN0n — 97 claims in 7 days against 27.6 expected from its own prior rate (p < 0.001)
Surginginterlock — 11 claims in 7 days against 1.2 expected from its own prior rate (p < 0.001)
Surgingmetaencryptor — 9 claims in 7 days against 1.1 expected from its own prior rate (p < 0.001)
SurgingSilentRansomGroup — 10 claims in 7 days against 3.1 expected from its own prior rate (p = 0.001)
SurgingBlack X — 3 claims in 7 days against 0.5 expected from its own prior rate (p = 0.014)
SurgingBYOD — 7 claims in 7 days against 2.5 expected from its own prior rate (p = 0.014)

Gone quiet: global (60 days), embargo (63 days), kazu (65 days), DYSPHOR1A (66 days).

Sector pressure, 30 days

UpEducation — 1.3× its own prior share (47 claims, 35 expected)
DownAgriculture and Food Production — 0.6× its own prior share (21 claims, 38 expected)
DownManufacturing — 0.9× its own prior share (150 claims, 174 expected)

30% of claims carry no sector label.

Brand churn

Of the 237 leak-site brands first seen since 2021-09-30, 75% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 67% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 214 old enough to judge posted on one day and never again; 37% made at least half their claims in their first week. New brands this month: 6 — newest: Climax Inc (2026-11-10, 17 claims), Vortex (2026-11-10, 14 claims), Destello (2026-11-05, 1 claim).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Targeting

Over the last 180 days, among brands with at least 20 labelled claims: safepay put 33% of its claims on Germany (6.4× every other brand's share); N0n put 29% of its claims on Transportation (6.4× every other brand's share); SilentRansomGroup put 100% of its claims on Professional Services (6.2× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.

Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.

Posting clock

Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 59% of its claims on Mondays, half of them in 18:00–19:59 UTC; akira posted only 2 of 194 claims at weekends and half its claims in 12:00–13:59 UTC; half of thegentlemen's claims appeared in 06:00–09:59 UTC. Leak sites overall are 34% quieter per weekend day than per weekday.

all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–20:59 UTC.

Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →

§7

Ride-alongs

Free, live tools. No sign-up, no sales call.

§8

Colophon

How this edition was made, plainly.

Edition 45 was made by machine and checked by code. Every item published by 15 public threat feeds in the 24 hours to 05:05 UK (700 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $1.30. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

700items read

24hour window

$1.30cost of this edition

05:05 UTCgenerated

Sources this morning

Security news104ok
NVD100ok
ThreatFox100ok
RansomLook88ok
Signal Atlas87ok
Telegram63ok
infosec.exchange46ok
ransomware.live43ok
RSS26ok
atlas16ok
AlienVault OTX7ok
signal:ioc-family7ok
signal:kev6ok
CISA KEV6ok
Ransomware tempo · Ninja Signal graph1ok

Get it in your inbox. Every morning. Probably.

Six into KEV, and two of them are the thing that reads your email before you do

Three flaws being exploited right now that do not have a KEV badge to make it official

N-able pulls hosted N-central offline and tells on-prem customers to switch theirs off

Forty-seven Inc Ransom posts in a day is a scraper waking up, not a gang working harder

Qubole's own AWS credentials were the way in to more than a dozen customers

Stolen model keys are now a line item: $740,000 of someone else's inference

France names an IRGC unit for the October refrigeration attacks

Two car brands, one admin:admin, every door

The leak-site bursts are batch uploads, not a tempo change

ransomware.live is the early source, everything downstream is an echo

Patch Tuesday counts conflict and the KEV link is inferred, not stated

The vulnerability feeds stop at 00:43 and that is almost certainly our plumbing

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

Looking for your AI keys

The most determined visitor

Trying CVE-2015-2051 on us

Same DNA, different addresses

The strangest shopping list

In a hurry

Get it in your inbox. Every morning. Probably.

Sources this morning