Lead · Vulnerabilities

The security gateway was the way in, and the proof-of-concept is now public

CISA added Check Point's CVE-2026-123039 to KEV; within hours the press had it, and a working exploit was being passed around Telegram.

confidence 0.85

Here is the uncomfortable shape of it. Attackers got initial access to unpatched Check Point Security Gateways through the PHP2Shell flaws, then used CVE-2026-123039, an incorrect permission assignment in the Gaia OS, to become root, install a backdoor called TSGA, and wipe files on VMware ESXi hosts. Check Point has shipped emergency hotfixes and says exploitation has been going on since late October; one account puts the start of the attacks at 30 October. The device you bought so you would not have to think about the field behind it turned out to be the gate, the key and the man holding both.

The timing is the part defenders should sit with. CISA listed it on 13 November, the cyber-press carried it roughly eight hours later, and by that evening a Telegram exploit channel was linking a GitHub proof-of-concept for CVE-2026-123039. The catalogue entry is a public artefact. It tells your change advisory board that something is being exploited, and it tells everyone with a scanner and a weekend exactly which product to point it at, and only one of those two parties has a maintenance window.

Separately, an ESXi write-up published the same morning describes an estate taken apart over ten days: four ESXi hosts, both vCenter servers, every virtual machine. Nobody has tied that investigation to this campaign and we are not going to pretend otherwise. But if you run Check Point gateways, the honest order today is: apply the hotfixes, then go and look at your hypervisors, because the wiper is the bit that does not care whether you had backups of the backups.

Why it mattersPatch Gaia now, then hunt for TSGA and webshell persistence on gateways and check ESXi and vCenter for file destruction, because the exploit is no longer scarce.

Receipts

Today’s revelation

The KEV entry is not a warning to defenders. It is a reading list for everyone else, published the same morning, and they read faster than your change board.

— Sturgeon’s Revelations · Probably Fine Daily No. 49

§2

Top stories

The rest of the last 24 hours, with receipts.

Vulnerabilities

Three more into KEV, and 19 servers that had already applied the hotfix

Alongside the Check Point entry, CISA added UnrealIRCd CVE-2026-114713, a delimiter-neutralisation flaw with a CVSS of 8.6 that lets any user on a network with two or more linked servers inject commands carrying server authority, plus a WSO2 path traversal leading to remote code execution (CVE-2026-5430) and an incorrect-authorisation flaw in Adobe Commerce and Magento (CVE-2026-71362). In the same window, N-able said attackers exploiting the 4EverAble2Shell and Agent2Shell flaws infected 21 N-central servers, 19 of which were running Hotfix 2, and that it is now restricting certain features and integrations. And Microsoft confirmed November's updates are causing activation failures with 0x80041008 errors and may break printing of complex documents.

Why it mattersThree KEV entries to triage before Monday, and a working example of why 'we applied the hotfix' is a status, not an outcome.

confidence 0.80

Receipts

Ransomware

324 claims in seven days, and three crews posting in batches like a mail merge

The posting pattern matters as much as the volume: pixelleaks dropped fourteen victims on 13 November with identical timestamps and full-leak deadlines pre-scheduled for 16, 17 and 18 November, Play posted nine, and N0n listed a mix of large Western brands with anonymised numbered firms in Ethiopia, Qatar and Botswana, several still pending verification. Qilin, meanwhile, listed York University, Oral Roberts University and the University of Texas at Arlington, which has separately confirmed that personal information was stolen in a cyberattack.

Why it mattersIf your victim-notification process assumes claims trickle in one at a time, it will miss a batch of fourteen posted in the same minute with a countdown already attached.

confidence 0.75

Receipts

AI & security

The malicious extension came through the marketplace, and the credentials came from the AI provider

Cursor confirmed a breach in which attackers used credentials stolen from AI infrastructure provider Fireworks AI to publish a malicious Claude Code extension through its marketplace. The through-line is not that the models are dangerous; it is that the developer tooling around them is now a supply chain with the same hygiene as any other.

Why it mattersTreat AI coding extensions and their marketplaces as third-party code with publish rights on developer machines, because that is exactly what they are.

confidence 0.70

Receipts

Vulnerabilities

Eleven CVEs in a WordPress plugin called Security For WooCommerce, all unauthenticated

NVD published a sequential block, CVE-2026-123695 through CVE-2026-123705, against Security For WooCommerce through version 1.0.16, and the list reads like a deliberate inversion of the product's name: unauthenticated users can mint login tokens for every user and log in as any of them including administrators, strip two-factor enrolment from every account at once, read the full settings including configured secret keys and the hidden login URL, reset the configuration to defaults and so disable the custom login URL, 2FA, reCAPTCHA, password policy and the firewall, and pull a server report with the administrator's email address. The cause in each case is the same: REST routes with no authorisation check. No fixed version is stated, and it arrived inside a wider wave of WordPress plugin disclosures including Printaura, ARForms and Gravity Forms.

Why it mattersIf you run it, assume the controls it advertises are currently optional for anyone with curl, and consider removing it rather than waiting for a patch.

confidence 0.75

Receipts

Vulnerabilities

A dozen Go cgo flaws published together: your build server is the attack surface

NVD published CVE-2026-97033 through CVE-2026-97043 on the same day, almost all of them describing the same shape of problem: a malicious package using cgo can achieve arbitrary code execution at build or link time via compiler and linker flags permitted in #cgo directives, from --sysroot relocating compiler subprograms to untrusted GCC spec files, linker scripts, crafted .syso objects and pkg-config .pc files. CVE-2026-97054 is the odd one out, an unsynchronised Connection: close header in net/http MaxBytesReader that can panic an HTTP/1 server. Build-time execution means the compromise happens on the machine with the signing keys and the registry credentials, not on the one with the firewall in front of it.

Why it mattersUpdate your toolchain and treat CI runners as production: anything that compiles untrusted dependencies is executing them.

confidence 0.60

Receipts

Policy

Operation Endgame takes 235 servers, 354 arrests on the markets, and the FBI unplugs FaceStealer

An international operation seized 235 servers and 257 domains behind Gootloader, CastleRAT and StealC, along with about 6.4 million stolen credentials belonging to victims. A separate joint action arrested 354 suspects who were buying and selling on the Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom dark web markets. And the FBI says it has seized the infrastructure behind FaceStealer, a North Korean social engineering scheme using deepfaked video calls and stolen webcam clips of more than 900 victims to steal over $400 million in cryptocurrency over eighteen months.

Why it mattersSix and a half million credentials were seized, not retired: assume anything your users reused is already circulating and force the resets.

confidence 0.80

Receipts

Oddities

Trezor confirms an extra circuit board inside three wallets, reading the screen and phoning home

Trezor has confirmed that three Safe 5 devices sold by former reseller CryptoBilis contained a hardware implant, an additional circuit board that reads the recovery phrase off the device's own screen and transmits it over the mobile network. A fix has been released, but the company is clear that a firmware update does not undo earlier exposure. This is the rare case where the threat model everyone draws on slides, the one with the malicious reseller in it, turned out to be a description of events.

Why it mattersSupply chain means the physical supply chain too: distributor provenance is a control, and for any device sold by that reseller, the seed is burned.

confidence 0.80

Receipts

Oddities

The FAA outage looks like a software update, which nobody wants it to be

Officials say there is no evidence of a cyberattack behind the nationwide FAA ground stop, with the FBI reportedly examining a software update; reporting cited by practitioners points at an update on the private communications network operated by L3Harris, which rebooted and crashed. It landed in the same week as a global Microsoft email outage, which produced a quantity of fediverse speculation roughly proportional to the number of people unable to read their inbox. None of these have been shown to be connected, and treating them as one cascade is a story we are telling ourselves, not a finding.

Why it matters'Not a cyberattack' is a legitimate root cause, and your incident comms should be able to say it without sounding disappointed.

confidence 0.60

Receipts

§3

Hidden

The daily deep read: what is under the feeds, not on top of them.

Under the feeds: one KEV entry outrunning its own coverage, three crews posting on a schedule, and a plugin block that inverts its own product name.

Exception 01
KEV to press to public PoC, in under a day
CVE-2026-123039 appeared in KEV first, in the cyber-press roughly eight hours later, and as a linked GitHub proof-of-concept on a Telegram exploit channel the same evening. Coverage ties it to PHP2Shell initial access, the TSGA backdoor and ESXi file wiping, but outlets disagree on whether it was a true zero-day and on whether fixes preceded the attacks.
confidence 0.75
Wrong if
Vendor advisories showing patches released before the 30 October exploitation start, or the OTX ESXi-destruction pulse naming an unrelated actor and toolchain.
Watch
New exploitation reports, further ESXi wiper victims and PoC forks over the next three to seven days.
Receipts
Exception 02
Synchronised batch posting with pre-set deadlines
pixelleaks posted 14 items on 13 November against a median of 1.5 on other days, with identical timestamps and full leaks scheduled for 16 to 18 November; N0n posted 10 against a median of 3 and interleaved large Western brands with anonymised numbered firms in Ethiopia, Qatar and Botswana; Play posted 9 against a median of 2. Some entries are explicitly pending verification, so claimed scale may be inflated.
confidence 0.60
Wrong if
Named victims such as Samsung or Starbucks denying the claims, or the identical timestamps proving to be an aggregator artefact.
Watch
Whether the scheduled releases on 16 to 18 November actually land, and whether any named brand confirms.
Receipts
Exception 03
Aggregators disagree by hours, so one feed is not coverage
ransomware.live generally precedes ransomlook on the same claims (toyokiki-thailand.com by 43.5 hours, N0n by 16, doommageddon by 11, endzone by 9, bravox by 4.1), and Telegram often precedes both for Play, Everest and Qilin. Whether that is claim visibility or scrape cadence cannot be told apart from this data.
confidence 0.55
Wrong if
The ordering reversing or collapsing for postings on 16 to 18 November, indicating cadence rather than visibility.
Watch
Lead-lag ordering on the next batch of claims.
Receipts
Exception 04
Three sources stop dead at the same minute
NVD, OTX and Vexy Ransomware all stop producing items after 2026-11-13T14:46. An identical cutoff across three unrelated sources is an ingest or window boundary, not actor dormancy, and should not be read as anybody going quiet.
confidence 0.50Speculative
Wrong if
Fresh NVD, OTX or Vexy items timestamped after 13 November 14:46 once ingest is rechecked.
Watch
The next ingest run.
Receipts

Nothing to seeThe Taiwan and semiconductor thread, the compound-crisis country signals and the ThreatFox port-reuse pattern are single-source or purely descriptive. The Expedia billion-record extortion claim is unverified. The Jensen Huang resignation thread reads as satire and is treated as such. The 71-hour NVD-to-Telegram lag on CVE-2026-64669, 64671 and 64686 is almost certainly scraping cadence.

Deep read: 674 items read

§4

Forecast

Dated, falsifiable calls. We mark our own homework in public.

Today’s calls

DueSun 22 Nov7d
pixelleaks posts at least five new leak-site claims in the seven days to 22 November, following through on the full-leak dates it scheduled for 16 to 18 November.
Wrong ifFewer than five pixelleaks claims appear across ransomlook and ransomware.live in that window.
Receipts
f-2026-11-15-1
Confidence0.70
DueSun 22 Nov7d
incransom's surge persists: at least 20 claims in the seven days to 22 November, against the 7.4 its own prior rate predicts.
Wrong ifFewer than 20 incransom claims recorded in that window.
Receipts
f-2026-11-15-2
Confidence0.55
DueSun 29 Nov14d
The Security For WooCommerce unauthenticated-takeover flaws do not reach KEV by 29 November: no exploitation report, no catalogue entry, CVE-2026-123695 stays off the list.
Wrong ifCISA adds CVE-2026-123695 (or any of 123696-123705) to KEV before 29 November.
Receipts
f-2026-11-15-3
Confidence0.80

Scorecard

3 right · 1 partly · 2 wrong · 3 open

wrong
No public vendor or CISA advisory ties the Ivanti Connect Secure exploitation chain to a specific named threat actor or ransomware group by 2026-11-12.
Called Mon 2 Nov · due Thu 12 Nov
Due date 2026-11-12 passed; no item in today's feed ties the Ivanti CVE-2026-111357 chain to a named actor or ransomware group, confirming the call that no such attribution occurred.
open
Ubuntu moves the IPv4 TCP use-after-free kernel fixes out of its opt-in testing channel into regular updates for its three newest LTS releases by 14 November 2026.
Called Wed 4 Nov · due Sat 14 Nov
No feed items mention Ubuntu kernel update channel moves for the IPv4 TCP use-after-free fixes; cannot confirm or deny.
open
IHG Hotels & Resorts does not publicly confirm the BYOD intrusion claim.
Called Thu 5 Nov · due Thu 12 Nov
Due date 2026-11-12 passed; no IHG statement or regulatory filing appears in the feeds acknowledging a BYOD intrusion, confirming the call that IHG would not publicly confirm it.
right
At least three of n0n's numbered 'Company #138-147' listings will be replaced by named victims on a leak site tracked by these feeds.
Called Sun 8 Nov · due Sun 15 Nov
By 15 November, n0n's ransomlook entries show named victims (DraftKings, LiveRamp, Female Daily Network, LEO Pharma, etc.) replacing numbered placeholders, with at least three formerly-numbered entries now named.
open
At least one of Vortex's three 12 November deadline victims (PYRAMID HEALTHCARE, ALEXION, CRESA) appears as published or leaked data on ransomware.live or ransomlook.
Called Wed 11 Nov · due Sun 15 Nov
No feed items show PYRAMID HEALTHCARE, ALEXION, or CRESA as published or leaked on ransomware.live or ransomlook by 15 November; the falsify condition (no published/leaked status) may apply but no explicit confirmation either way is present.
wrong
Inc Ransom posts fewer than 20 new leak-site claims on any single day between 12 and 18 November, confirming the 47 was a backfill rather than tempo.
Called Wed 11 Nov · due Wed 18 Nov
The tempo signal reports incransom surging with 53 claims in 7 days; individual day counts are not broken out but ransomlook shows multiple incransom postings on 13 November alone (sportsmansguide, Advantage Archives, axiscades, etc.), and the tempo signal flags a p<0.001 surge well above the <20/day threshold.
Receipts
partly
Microsoft confirms the SignDrop CLFS issue or assigns it a CVE by 27 November 2026.
Called Fri 13 Nov · due Fri 27 Nov
SecurityWeek reports 'Nightmare Eclipse Drops Windows Zero-Day Exploit SignDrop' describing CLFS abuse, confirming the technique is public; however no Microsoft CVE assignment or official Microsoft advisory is cited in the feeds yet. Due date is 2026-11-27.
Receipts
1. 1Security newsNightmare Eclipse Drops Windows Zero-Day Exploit ‘S…
right
Pixelleaks publishes at least one of the full data sets scheduled for 16-17 November, visible on ransomlook.
Called Sat 14 Nov · due Wed 18 Nov
Pixelleaks posted numerous entries on ransomlook dated 2026-11-13 with full data leak dates of 2026-11-16 and 2026-11-17, visible on ransomlook before the deadlines.
Receipts
right
Qilin posts five or more new victims across the ransomware trackers, holding its position at the top of the 2026 tally.
Called Sat 14 Nov · due Sat 21 Nov
Ransomlook shows Qilin posted at least 5 new victims (York University, UT Arlington, Oral Roberts University, Leonard's Express, Wisconsin Timber Rattlers) on 2026-11-14, and darkfeed confirms Qilin leads 2026 tally at 1171.
Receipts

Glossary of terms you will be expected to nod at

Hotfix (n.): A patch applied quickly enough to appear in the incident timeline. See N-able, where 19 of the 21 infected servers were running Hotfix 2.

§5

From our edge

Live attacks on our own servers in the last 24 hours. Yes, really ours.

Our own edge profiled 99 hostile sources in the last 24 hours — 52 scanners, 42 bot crawlers, 3 targeted operators, 2 brute forcers — sending 10,989 requests between them, of which 36 went past reconnaissance into actual exploitation attempts. Nine thousand one hundred and seventy-seven addresses touched us from 127 countries, 4,932 of them for the first time today. Fourteen separate addresses shared one behavioural fingerprint, which is one tool or one operator rotating IPs and not, whatever the marketing says, a diverse threat landscape. The highest hostility score, 8.2 out of 10, is less interesting than 35.195.245.38, which fired 187 requests for /.env, /api/.env, /backend/.env and /laravel/.env in about six tenths of a second, or the two addresses still spraying CVE-2017-9841 phpunit paths at us today, whatever year the patch notes think it is. Raw logs never left the box; only the findings did.

99hostile sources profiled

10,989requests from them

36reached exploitation

14shared-DNA clusters

8.2/10top hostility

9,177addresses at our edge

4,932first seen today

127countries

The WTF list

WTF #1
The most determined visitor
2400:6180:100:d0:0:1:c39d:c001, a scanner (hostility 6.9/10), sent 30 requests to one of our sites, probing for /.aws/credentials, /.aws/config, /.env.aws, /.docker/config.json.
Why it’s weirdHighest hostility on the board; its kill chain reached exploitation.
attribution: unknownSun 15 Nov, 05:00 UTC
Detail
```
kill chain: reconnaissance → weaponization → exploitation · DNA 851a17b90a85
```
WTF #2
Same DNA, different addresses
45.148.10.14, a scanner (hostility 6.7/10), sent 666 requests to one of our sites, probing for /.docker/laravel/app/.env, /.env.config, /.env.copy, /.env.bkp.
Why it’s weird14 IPs share one behavioural fingerprint (DNA dfef4501b216): one tool or one operator rotating addresses: 54.203.154.170, 34.80.2.173, 172.213.26.234, 20.106.103.160, 20.205.56.255 and more.
attribution: unknownSat 14 Nov, 19:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA dfef4501b216
```
WTF #3
Trying CVE-2017-9841 on us
2 addresses sent 3 requests shaped like CVE-2017-9841 exploitation (/lib/vendor/phpunit/…, /yii/vendor/phpunit/…, /zend/vendor/phpunit/…), including 185.177.72.9, 185.177.72.23.
Why it’s weirdA known, named exploit still being sprayed at the internet; our edge saw it today, whatever the patch notes say about the year.
attribution: unknown
Detail
```
probe family: phpunit-rce
```
WTF #4
The strangest shopping list
20.219.139.13, a scanner (hostility 6.3/10), sent 49 requests to one of our sites, probing for /inputs.php, /ioxi-o.php, /function/function.php, /rip.php.
Why it’s weirdAsked for files almost nobody else asks for: /inputs.php, /ioxi-o.php, /function/function.php, /rip.php, /admin.php.
attribution: unknownSun 15 Nov, 05:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA 83562bd8e880
```
WTF #5
In a hurry
35.195.245.38, a scanner (hostility 5.1/10), sent 187 requests to one of our sites, probing for /.env, /api/.env, /backend/.env, /laravel/.env.
Why it’s weirdFired 187 requests in about 0.6 seconds.
attribution: unknownSat 14 Nov, 19:00 UTC
Detail
```
kill chain: reconnaissance → weaponization · DNA ce6ecdfacbe3
```

§6

Tempo

Who is posting faster than their own normal. Computed from the Signal graph, not written by the editor.

324claims, 7 days

47of 277 groups active

N0n77 this week · surging

incransom53 this week · surging

thegentlemen22 this week

Surgingincransom — 53 claims in 7 days against 7.4 expected from its own prior rate (p < 0.001)
SurgingN0n — 77 claims in 7 days against 29.4 expected from its own prior rate (p < 0.001)
Surginginterlock — 13 claims in 7 days against 1.2 expected from its own prior rate (p < 0.001)
SurgingBlack X — 3 claims in 7 days against 0.5 expected from its own prior rate (p = 0.013)
Backbeast — first claim after 56 days of silence; 0 this week
NewAoqin — first claim 2026-11-04; 10 so far

Gone quiet: ShadowByt3$ (60 days), global (64 days), embargo (67 days), kazu (69 days).

Sector pressure, 30 days

UpEducation — 1.3× its own prior share (47 claims, 36 expected)
DownAgriculture and Food Production — 0.4× its own prior share (15 claims, 38 expected)
DownProfessional Services — 0.8× its own prior share (127 claims, 149 expected)

29% of claims carry no sector label.

Brand churn

Of the 239 leak-site brands first seen since 2021-09-30, 75% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 67% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 214 old enough to judge posted on one day and never again; 37% made at least half their claims in their first week. New brands this month: 8 — newest: Curious Worm (2026-11-11, 12 claims), osiris (2026-11-11, 8 claims), Climax Inc (2026-11-10, 17 claims).

Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.

Targeting

Over the last 180 days, among brands with at least 20 labelled claims: safepay put 32% of its claims on Germany (6.2× every other brand's share); N0n put 28% of its claims on Transportation (6.2× every other brand's share); SilentRansomGroup put 100% of its claims on Professional Services (6.3× every other brand's share). Widest spread: nightspire across 10.7 effective sectors.

Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.

Posting clock

Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; Deadlock released 61% of its claims on Fridays, half of them in 12:00–13:59 UTC; akira posted only 2 of 197 claims at weekends and half its claims in 12:00–13:59 UTC; half of thegentlemen's claims appeared in 06:00–09:59 UTC. Leak sites overall are 37% quieter per weekend day than per weekday.

all brands by hour of day, 00–23 UTC; half of all claims land in 07:00–15:59 UTC.

Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.

Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers

Today’s numbers as JSON →

§7

Ride-alongs

Free, live tools. No sign-up, no sales call.

§8

Colophon

How this edition was made, plainly.

Edition 49 was made by machine and checked by code. Every item published by 14 public threat feeds in the 24 hours to 05:05 UK (674 items) was read in full: statistics computed in code, each slice read by Claude Sonnet, the structure synthesised by Claude Opus. Claude Opus then edited the paper. Every story cites the items it rests on; stories whose receipts did not resolve, or whose numbers were not in their sources, were dropped before publication (0 today). Forecasts are graded in public in later editions. 'From our edge' is live attack data from our own servers. Cost of this edition: $1.11. It is written by machine in the voice of ScottG, author of Everything Is Probably Fine, and nobody edited it by hand, which is either the point or the problem.

674items read

24hour window

$1.11cost of this edition

05:05 UTCgenerated

Sources this morning

ThreatFox200ok
NVD100ok
Telegram84ok
infosec.exchange77ok
RansomLook66ok
Security news53ok
Signal Atlas34ok
ransomware.live31ok
RSS10ok
AlienVault OTX7ok
CISA KEV4ok
atlas4ok
signal:ioc-family3ok
Ransomware tempo · Ninja Signal graph1ok

Get it in your inbox. Every morning. Probably.

Three more into KEV, and 19 servers that had already applied the hotfix

324 claims in seven days, and three crews posting in batches like a mail merge

The malicious extension came through the marketplace, and the credentials came from the AI provider

Eleven CVEs in a WordPress plugin called Security For WooCommerce, all unauthenticated

A dozen Go cgo flaws published together: your build server is the attack surface

Operation Endgame takes 235 servers, 354 arrests on the markets, and the FBI unplugs FaceStealer

Trezor confirms an extra circuit board inside three wallets, reading the screen and phoning home

The FAA outage looks like a software update, which nobody wants it to be

KEV to press to public PoC, in under a day

Synchronised batch posting with pre-set deadlines

Aggregators disagree by hours, so one feed is not coverage

Three sources stop dead at the same minute

Today’s calls

Scorecard

Glossary of terms you will be expected to nod at

The WTF list

The most determined visitor

Same DNA, different addresses

Trying CVE-2017-9841 on us

The strangest shopping list

In a hurry

Get it in your inbox. Every morning. Probably.

Sources this morning