Lead · Exploited now

Both of your remote-management platforms had a Thursday, and the patch was not an alibi

N-able's N-central was exploited within hours of a public proof of concept — nineteen of the twenty-one compromised servers were on the latest security update — while a worm-like toolkit called SCKit rode cloud ScreenConnect into 288 hosts across 48 organisations.

confidence 0.86

Start with the number, because it is the whole story: researchers report at least 21 compromised N-central servers, of which 19 were running the company's latest security update, with attackers dropping cryptocurrency miners for their trouble. The exploit is called 4EverAble2Shell and it went into live use hours after the proof of concept landed. N-able took the platform offline after the disclosure of 33 flaws, shipped a hotfix, patched the unauthenticated ones, and then had to respond again to a fresh public write-up claiming root RCE and Windows SYSTEM on 2026.4.1 HF2, which the company says depends on a non-default configuration.

In the same window, and probably entirely unrelated, operators turned cloud-hosted ScreenConnect panels into a delivery mechanism: a toolkit called SCKit deployed attacker-controlled clients across 288 hosts in 48 organisations, built to spread from a customer's device up the support session to the technician's machine and onward into other managed networks. ConnectWise says the access came through abuse of an independent third-party extension that bypassed authentication; Blackpoint's researchers say the entry point was a critical flaw that was already patched, not a new one. Two vendors, two root causes, one set of downstream customers.

The uncomfortable part is not the bugs. It is the shape: we have spent fifteen years consolidating administrative reach into a handful of consoles because it is efficient, and efficiency is a property that transfers cleanly to whoever logs in next. An endpoint management platform is a master key cut for the person who services the lifts, and this week two of them were in other hands. Patched is not the same as clean.

Why it mattersIf you run or buy an RMM, today's job is hunting on the servers you already patched — miners, rogue ScreenConnect clients, new technician sessions — not confirming the version number.

Receipts

Today’s revelation

Patching is not an eviction. It is a letter posted to a tenant who already has a key, a sofa, and a cryptominer.

— Sturgeon’s Revelations · Probably Fine Daily No. 47

§2

Top stories

The rest of the last 24 hours, with receipts.

Vulnerabilities

SignDrop: a Windows security feature, repurposed as a route to SYSTEM, with no CVE and no patch

Public exploit code released this week, credited to researcher Abdelhamid Naceri, abuses the Common Log File System driver's log-authentication feature — added last year to make attacks harder — to give a local user SYSTEM privileges. There is no CVE, no fix, and Microsoft has not yet confirmed the flaw. It arrived on the same day Microsoft confirmed the November 2026 security updates are failing to install on Windows 11 systems carrying the October preview update, and while updates since October Patch Tuesday are causing SQL Server performance and stability problems. No causal link between the three; the exposure window is cumulative anyway.

Why it mattersLocal privilege escalation is how a phished session becomes a domain problem, and right now some of your fleet cannot take the monthly updates at all.

confidence 0.80

Receipts

Ransomware

The Gentlemen emptied the drafts folder; the tempo data says N0n is the one actually accelerating

On Wednesday The Gentlemen posted around twenty-five victims to its leak site in roughly eight minutes — a Japanese IT firm, a North Macedonian education agency, a Peruvian district municipality, a Canadian city, pharmacy and engineering companies across four continents — which is a publishing decision rather than twenty-five Wednesdays of work. The duller, harder number comes from the tempo count: 360 leak-site claims in seven days from 47 of the 277 groups tracked, with N0n at 90 claims against 28.56 expected from its own prior rate and incransom at 54 against 7.32, both at p < 0.001. INC's own additions included a claim against raymondjames.com, and Darkfeed claims an attack on a Finnish energy company, unverified. Luna Moth, separately, is back at law firms that refused to pay the first time, now after Microsoft access tokens.

Why it mattersBurst counts measure a group's publishing calendar; the surge statistics tell you who is genuinely working more, and this week that is N0n and INC.

confidence 0.75

Receipts

Threat actors

4,837 stolen GitHub accounts, 61,764 repositories probed, and your CI quietly handing over its secrets

The wfx-loot campaign used 4,837 compromised GitHub accounts to probe 61,764 repositories, open pull requests and push a secrets-stealing payload that ran inside more than 1,800 of them, harvesting cloud credentials from CI. It lands in a week where Apify rotated internal secrets and revoked third-party OAuth connections after unauthorised access, and Japan's Cyber Security Cloud disclosed unauthorised access to its GitHub development environment traced to one exposed employee credential, confirmed on 5 November. The three are not linked; the target is identical.

Why it mattersRotate CI tokens and cloud keys reachable from build runners, and treat a pull request from a known account as untrusted code, because this week it was.

confidence 0.80

Receipts

AI & security

AI is now on both sides of the invoice: hijacked model access, AI-written lateral movement, and 186 fake AI domains

Google Threat Intelligence Group describes LLMjacking — attackers hijacking enterprise large language model access and monetising someone else's compute — while a separate case study shows an attacker whose hand-typed commands failed against a US retailer returning the next day with AI-generated scripts and achieving lateral movement in minutes. Meanwhile 186 lookalike AI-tool domains, codenamed TypoPrompt, are serving ClickFix lures and browser-hijacking extensions; exploit attempts are landing against GPUStack's trivial authentication bypass, CVE-2026-102895, in all versions before 2.2.0; Notion customer chat transcripts were exposed through the Fireworks AI breach, affecting fewer than 1% of workspaces; and United Airlines has decided to block customers from using AI agents on their accounts, citing credential sharing and unintended purchases. Our own edge saw a scanner asking for /.env.anthropic.

Why it mattersModel API keys are now credentials with a billing address: inventory them, scope them, alert on them like cloud keys.

confidence 0.78

Receipts

Vulnerabilities

Critical in mod_http2, twelve in NetScaler, two in Quay, one in Windchill, and over 180 in your browsers

Apache patched CVE-2026-119618, a race condition in mod_http2 that an unauthenticated attacker can use for remote code execution on servers with HTTP/2 enabled — found, in a sentence that will age interestingly, by Anthropic and Google. Citrix fixed 12 flaws across NetScaler ADC, Gateway and Console, including an authentication bypass rated 9.4 and a separate denial-of-service rated 9.5; Red Hat Quay carries two criticals at 9.8 and 9.9 that let an attacker read and overwrite private container images across every repository, needing no account at all while anonymous access — the default — is on. Add PTC Windchill and FlexPLM, CVE-2026-126325 at CVSS v4 9.2; a MongoDB pre-auth crash, CVE-2026-118383, that only bites when a lagging secondary is promoted on failover; and over 180 fixes between Chrome 157 and Firefox 160.

Why it mattersInternet-facing HTTP/2, NetScaler and any Quay registry with anonymous access are this weekend's work; the rest can wait for the change window you will not get.

confidence 0.85

Receipts

Malware & IOCs

GSocket: the persistence that outlives your patch

Multiple threat actors are planting GSocket, a legitimate open-source remote access tool, on compromised Linux servers specifically so that access survives the patching of whatever hole got them in. Same day, there is an active campaign abusing T-SQL on internet-facing Microsoft SQL Server instances to deliver payloads, a Rust-based Linux cryptomining orchestrator called SANSAR that deliberately hides its GPU usage, and a browser-resident command-and-control framework called Falcon running entirely in JavaScript. The pattern across all four is the same: legitimate mechanisms, no obvious binary, nothing for the patch report to celebrate.

Why it mattersAfter you remediate an exploited Linux host, hunt for outbound relay tooling and unexplained processes, or you have fixed the door on an occupied house.

confidence 0.80

Receipts

Policy

Europol seizes hundreds of servers from Gootloader, CastleRAT and StealC — StealC for the second time this year

Europol and partners from nine countries seized hundreds of servers and domains behind the Gootloader, CastleRAT and StealC operations, with German investigators saying the rebuilt StealC network traced to the Virtualine bulletproof hosting provider that the FBI seized in October, assisted by police in Frankfurt and the Dutch National High Tech Crime Unit. Separately, the DoJ and FBI announced the seizure of $1.2 billion in cryptocurrency stolen from Binance and a takedown of 'FaceStealer' tooling, with the FBI attributing a further $400 million theft to North Korea-linked social engineering. Two takedowns of the same stealer in one year is the business model being described out loud.

Why it mattersExpect infrastructure churn in stealer C2 over the next fortnight; refresh blocklists rather than trusting last month's.

confidence 0.85

Receipts

Oddities

The internet ends on Tuesday, the FBI leak ships with example AWS keys, and a Telegram channel advises you to stop using Telegram

Ukrainian military-adjacent channels and regional Russian media spent Thursday debunking a rumour that hackers will zero the world's bank accounts on 17 November and remove the internet for three months, traced to an anonymous account in Brazil with 2,000 followers; Kazakhstan's emergencies ministry has officially confirmed that nobody asked anyone to stockpile anything. Elsewhere, a channel posted purported FBI firearms-licensing records whose AWS credentials read AKIAEXAMPLE123456 and wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY, which is the documentation example, verbatim. And a Telegram channel published a breaking warning to avoid Telegram until a desktop and Android RCE is patched, directly above an advert for a non-KYC crypto casino.

Why it mattersHalf the Telegram layer of your intel feed is marketing, and it bursts just as convincingly as the real thing.

confidence 0.70

Receipts

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

Under the feeds: one real day of news, two independent RMM campaigns colliding, and a leak-site burst that is mostly a publishing schedule.

Exception 01
RMM platforms hit from two directions at once, probably independently
N-central exploitation after a public PoC — including servers on the latest update, with miners deployed — and the SCKit worm abusing cloud ScreenConnect surfaced in the same window across cyber-news, RSS, OTX and Telegram, with OTX roughly three hours ahead of the news cycle. Vendors give conflicting root causes: ConnectWise points at a third-party extension authentication bypass, Blackpoint at an already-patched flaw, N-able at a non-default configuration. The shared exposure is downstream MSP customers; co-occurrence is the signal, not a demonstrated link.
confidence 0.70
Wrong if
Forensics showing SCKit access came from unrelated credential theft rather than ScreenConnect, or N-central exploitation confined to the non-default path with no patched hosts compromised.
Watch
CVE assignment and a consolidated N-able advisory in the next 24-72 hours; further SCKit victim counts beyond 48 organisations.
Receipts
Exception 02
The Gentlemen burst is batch publication, amplified by the aggregator
The 82-item spike on 12 November against a median of zero on other days reflects about 25 leak-site posts in roughly eight minutes, then duplicated downstream signals around eight hours behind ransomware.live. Volume overstates activity, and the country and sector tagging in those records is inconsistent enough that correlations drawn from it should be discarded. The real information is a large, diverse, partly governmental victim set published at once.
confidence 0.75
Wrong if
Raw leak-site timestamps showing the victims spread over many hours, or victims shown to have been published earlier elsewhere.
Watch
Whether the group repeats a batch drop, and whether named victims confirm.
Receipts
Exception 03
The Telegram layer is bursting on spam, not intelligence
Several of yesterday's five-item bursts come from channels selling access, soliciting 'investors', or recycling a debunked apocalypse rumour, including a purported FBI dataset containing AWS placeholder credentials. Burst statistics computed over these channels measure marketing cadence, not adversary activity.
confidence 0.65
Wrong if
Independent confirmation of the FBI data, or reputable feeds picking up any of these claims.
Watch
Whether any of these channels' claims appear in vendor or law-enforcement reporting this week.
Receipts

Nothing to seeThe NVD 'silence' after 00:21 on 12 November is ingest timing, not a real pause, and the hundred NVD items in the window are all stamped 10 November. The Zoho, Hitachi, Siemens and WordPress CVE batches are vendor-coordinated release timing, not coordinated attacker behaviour. The Atlas 'compound crisis' country signals — Japan, Indonesia, the Philippines, Taiwan, Panama and others — are low-confidence aggregates with no named actor behind them. With one real day of data, nobody can honestly claim a trend.

Deep read: 548 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueFri 20 Nov7d
N-able publishes a consolidated advisory or a CVE identifier covering the 4EverAble2Shell / post-hotfix N-central issues by 20 November 2026.
Wrong ifNo N-able advisory or CVE naming these issues appears in the feeds by end of 20 November.
Receipts
f-2026-11-13-1
Confidence0.65
DueMon 23 Nov10d
Public reporting on the ScreenConnect/SCKit campaign raises the victim count above 48 organisations by 23 November 2026.
Wrong ifAll subsequent reporting through 23 November still cites 48 organisations or fewer.
Receipts
f-2026-11-13-2
Confidence0.50
DueFri 27 Nov14d
Microsoft confirms the SignDrop CLFS issue or assigns it a CVE by 27 November 2026.
Wrong ifNo Microsoft confirmation, advisory or CVE for the SignDrop CLFS technique in the feeds by 27 November.
Receipts
f-2026-11-13-3
Confidence0.40

Scorecard

2 right · 2 open

open
No public vendor or CISA advisory ties the Ivanti Connect Secure exploitation chain to a specific named threat actor or ransomware group by 2026-11-12.
Called Mon 2 Nov · due Thu 12 Nov
Due date 2026-11-12 passed; no item in today's feed ties the Ivanti CVE-2026-111357 chain to a named actor or ransomware group.
open
IHG Hotels & Resorts does not publicly confirm the BYOD intrusion claim.
Called Thu 5 Nov · due Thu 12 Nov
Due date 2026-11-12 passed with no IHG statement or regulatory filing acknowledging the BYOD intrusion claim in any feed item.
right
At least one ransomware or extortion leak-site claim published between now and 19 November will name an MSP or its downstream customers in connection with ScreenConnect or N-central access.
Called Thu 12 Nov · due Thu 19 Nov
SCKit malware campaign explicitly targeted MSPs via ScreenConnect, with leak-site and news items naming MSP victims and the ScreenConnect platform.
Receipts
right
N0n will post at least 20 further leak-site claims to ransomware.live between now and 19 November, continuing the surge flagged in today's tempo read.
Called Thu 12 Nov · due Thu 19 Nov
Tempo report confirms N0n posted 90 claims in the last 7 days, far exceeding the 20-claim threshold for the window ending 2026-11-19.
Receipts
1. 1Ransomware tempo · Ninja Signal graphNinja Signal ransomware tempo for 2026-11-13. In th…

Glossary of terms you will be expected to nod at

Non-default configuration (n.): The configuration in which the vulnerability exists, and which — by a coincidence no vendor has yet been able to explain — is the configuration your estate has been running since the last migration.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge, meanwhile, had an ordinary day, which is the frightening part: the local sensor profiled 64 hostile sources — 35 bot crawlers, 27 scanners, 2 targeted operators — sending 3,200 requests between them, of which 29 went past reconnaissance into actual exploitation attempts, across 5,965 addresses from 101 countries, 1,782 of them seen for the first time today. One scanner at 34.53.218.24 (hostility 5.4/10, 123 requests) worked through /.env, /.aws/.env and /.docker/.env and then asked for /.env.anthropic, which tells you where model keys now sit on the shopping list. Another, 34.77.241.117, fired 296 requests at two of our sites in about 2.2 seconds, five addresses shared a single behavioural fingerprint (DNA ce6ecdfacbe3, led by 35.195.85.59 at 150 requests), and 206.189.217.192 sent three requests shaped like CVE-2017-9841 against /vendor/phpunit/, a nine-year-old bug that nobody has told the internet to stop trying. Raw logs never left the server. Only the findings did.

64hostile sources profiled

3,200requests from them

29reached exploitation

12shared-DNA clusters

7.3/10top hostility

5,965addresses at our edge

1,782first seen today

101countries

The WTF list

WTF #1
Looking for your AI keys
34.53.218.24, a scanner (hostility 5.4/10), sent 123 requests to one of our sites, probing for /.docker/laravel/app/.env, /.env, /.aws/.env, /.docker/.env.
Why it’s weirdWent straight for AI credentials: /.env.anthropic. Model API keys are now on the scanners' shopping list next to cloud keys.
attribution: unknownThu 12 Nov, 18:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 18e39c4b41fb
```
WTF #2
The most determined visitor
23.99.228.58, a scanner (hostility 6.7/10), sent 84 requests to one of our sites, probing for /wp-admin/css/colors/blue/qww.php, /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /radio.php.
Why it’s weirdHighest hostility on the board; its kill chain reached weaponization.
attribution: unknownThu 12 Nov, 18:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA dfef4501b216
```
WTF #3
Trying CVE-2017-9841 on us
1 address sent 3 requests shaped like CVE-2017-9841 exploitation (/vendor/phpunit/phpunit/…), including 206.189.217.192.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: phpunit-rce
```
WTF #4
Same DNA, different addresses
35.195.85.59, a scanner (hostility 4.7/10), sent 150 requests to one of our sites, probing for /.env, /.env.production.backup, /project/.env, /workspace/.env.
Why it’s weird5 IPs share one behavioural fingerprint (DNA ce6ecdfacbe3): one tool or one operator rotating addresses: 35.195.85.59, 34.62.82.207, 34.53.147.106, 45.148.10.21, 34.62.9.55.
attribution: unknownThu 12 Nov, 19:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA ce6ecdfacbe3
```
WTF #5
The strangest shopping list
20.217.29.214, a scanner (hostility 6.7/10), sent 28 requests to one of our sites, probing for /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /jn.php, /awp.php.
Why it’s weirdAsked for files almost nobody else asks for: /wp-content/plugins/hellopress/wp_filemanager.php, /this_is_a_new_hello_world.php, /jn.php, /awp.php, /er.php.
attribution: unknownThu 12 Nov, 18:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA dfef4501b216
```
WTF #6
In a hurry
34.77.241.117, a scanner (hostility 4.8/10), sent 296 requests to 2 of our sites, probing for /.env, /storage/.env, /opt/.env, /html/.env.
Why it’s weirdFired 296 requests in about 2.2 seconds.
attribution: unknownThu 12 Nov, 18:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA f54b5889aafb
```

§6

Tempo

Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.

360claims, 7 days

47of 277 groups active

N0n90 this week · surging

incransom54 this week · surging

thegentlemen22 this week

SurgingN0n — 90 claims in 7 days against 28.6 expected from its own prior rate (p < 0.001)
Surgingincransom — 54 claims in 7 days against 7.3 expected from its own prior rate (p < 0.001)
Surginginterlock — 12 claims in 7 days against 1.2 expected from its own prior rate (p < 0.001)
Surgingmetaencryptor — 10 claims in 7 days against 1.1 expected from its own prior rate (p < 0.001)
SurgingBlack X — 3 claims in 7 days against 0.5 expected from its own prior rate (p = 0.013)
SurgingBYOD — 6 claims in 7 days against 2.5 expected from its own prior rate (p = 0.045)

Gone quiet: global (62 days), embargo (65 days), kazu (67 days), DYSPHOR1A (68 days).

Sector pressure, 30 days

UpEducation — 1.5× its own prior share (54 claims, 37 expected)
DownAgriculture and Food Production — 0.5× its own prior share (21 claims, 40 expected)
DownProfessional Services — 0.8× its own prior share (134 claims, 161 expected)

29% of claims carry no sector label.

Brand churn

Of the 239 leak-site brands first seen since 2021-09-30, 75% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 67% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 214 old enough to judge posted on one day and never again; 37% made at least half their claims in their first week. New brands this month: 8 — newest: Curious Worm (2026-11-11, 10 claims), osiris (2026-11-11, 8 claims), Climax Inc (2026-11-10, 17 claims).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Targeting

Over the last 180 days, among brands with at least 20 labelled claims: safepay put 33% of its claims on Germany (6.3× every other brand's share); N0n put 28% of its claims on Transportation (6.2× every other brand's share); SilentRansomGroup put 100% of its claims on Professional Services (6.2× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.

Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.

Posting clock

Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 59% of its claims on Mondays, half of them in 18:00–19:59 UTC; akira posted only 2 of 196 claims at weekends and half its claims in 12:00–13:59 UTC; half of thegentlemen's claims appeared in 06:00–09:59 UTC. Leak sites overall are 36% quieter per weekend day than per weekday.

all brands by hour of day, 00–23 UTC; half of all claims land in 09:00–17:59 UTC.

Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →

§7

Ride-alongs

Free, live tools. No sign-up, no sales call.

§8

Colophon

How this edition was made, plainly.

Edition 47 was made by machine and checked by code. Every item published by 12 public threat feeds in the 24 hours to 05:05 UK (548 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $1.02. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

548items read

24hour window

$1.02cost of this edition

05:05 UTCgenerated

Sources this morning

Signal Atlas118ok
NVD100ok
ThreatFox100ok
Telegram64ok
Security news48ok
infosec.exchange38ok
ransomware.live35ok
atlas18ok
RSS12ok
AlienVault OTX11ok
signal:ioc-family3ok
Ransomware tempo · Ninja Signal graph1ok

Get it in your inbox. Every morning. Probably.

SignDrop: a Windows security feature, repurposed as a route to SYSTEM, with no CVE and no patch

The Gentlemen emptied the drafts folder; the tempo data says N0n is the one actually accelerating

4,837 stolen GitHub accounts, 61,764 repositories probed, and your CI quietly handing over its secrets

AI is now on both sides of the invoice: hijacked model access, AI-written lateral movement, and 186 fake AI domains

Critical in mod_http2, twelve in NetScaler, two in Quay, one in Windchill, and over 180 in your browsers

GSocket: the persistence that outlives your patch

Europol seizes hundreds of servers from Gootloader, CastleRAT and StealC — StealC for the second time this year

The internet ends on Tuesday, the FBI leak ships with example AWS keys, and a Telegram channel advises you to stop using Telegram

RMM platforms hit from two directions at once, probably independently

The Gentlemen burst is batch publication, amplified by the aggregator

The Telegram layer is bursting on spam, not intelligence

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

Looking for your AI keys

The most determined visitor

Trying CVE-2017-9841 on us

Same DNA, different addresses

The strangest shopping list

In a hurry

Get it in your inbox. Every morning. Probably.

Sources this morning