本日のCVEのいくつかは、リグレッションまたは部分的な修正である。Gravity Formsは、強化された独自版ではなく、WordPressの制約のないmaybe_unserialize()に値を渡している。Enable Media Replaceはオブジェクトインジェクションを再び持ち込んだ。CakePHPのCRLF除去は、CVE-2026-77634の不完全な修正と説明されている。CVE-2026-46099の修正の不完全なバックポートは、RHEL 9カーネルにlocal_bhの不均衡を残した。最近のパッチに対するバイパス探索は、入手できる攻撃側の調査として最も安上がりである。
Nothing to seeタイミングのクラスタは一切ない。NVDフィードは100件を供給した後、11-01 00:18以降は沈黙した。Gravity Forms、ProFTPD、Elixir、Dell OpenManageをめぐる日次のクラスタは、連携した動きではなく、06:16と12:16の一括公開である。thegentlemenの大規模な激化の急増は、10-31の11:50に1回の実行で生成されたもので、この期間に被害者の主張の裏付けはなく、現場の活動ではなくモデルの出力である。インジケータ数にはここでは基準値がないため、179件のMiraiインジケータは数字であって異常ではない。また、「what if rogue ai stole 6 billion dollar」と問うMastodonの投稿は、午前4時にBinanceの見出しを読んだ人間のものである可能性がきわめて高い。
At least three of N0n's five placeholder listings (Company #99 to #103) are replaced by named victims on ransomware.live or ransomlook.
Called Thu 22 Oct · due Sun 1 Nov
The 1 November due date has passed. No item shows N0n placeholders (Company #99 to #103) replaced by named victims.
open
At least one of N0n's anonymised 'Company #104' to '#109' entries is replaced by a named victim on ransomware.live or ransomlook.
Called Fri 23 Oct · due Mon 2 Nov
2 November is the due date and has not ended. No item mentions N0n or Company #104 to #109.
partly
Qilin leak-site postings fall back to fewer than 15 claims on any single day across ransomware.live and ransomlook between 1 and 4 November, confirming the 60-item day was a batch rather than a campaign.
Called Sat 31 Oct · due Wed 4 Nov
Roughly 10 Qilin claims were posted on ransomware.live on 1 November, below 15. The window runs to 4 November, so a later day could still reach 15 or more.
No government body or law enforcement agency formally attributes the Binance theft to North Korea in these feeds by 14 November; the TraderTraitor link stays an analyst inference.
Called Sat 31 Oct · due Sat 14 Nov
On 1 November the FBI officially attributed the Binance theft to North Korea's TraderTraitor, before the 14 November deadline.
UpTransportation — 2.1× its own prior share (71 claims, 34 expected)
UpEducation — 2.0× its own prior share (55 claims, 27 expected)
UpHealthcare — 1.2× its own prior share (107 claims, 88 expected)
DownAgriculture and Food Production — 0.7× its own prior share (23 claims, 34 expected)
23% of claims carry no sector label.
Brand churn
Of the 231 leak-site brands first seen since 2021-09-30, 76% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 68% were still claiming 90 days after their first post and 62% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 213 old enough to judge posted on one day and never again; 39% made at least half their claims in their first week. New brands this month: 11 — newest: Shiba (2026-10-29, 5 claims), everstake (2026-10-29, 5 claims), Whitearmor (2026-10-23, 19 claims).
Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.
Targeting
Over the last 180 days, among brands with at least 20 labelled claims: safepay put 33% of its claims on Germany (6.2× every other brand's share); N0n put 33% of its claims on Transportation (7.4× every other brand's share); SilentRansomGroup put 100% of its claims on Professional Services (6.0× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.
Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.
Posting clock
Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 59% of its claims on Mondays, half of them in 19:00–19:59 UTC; akira posted only 1 of 196 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 33% quieter per weekend day than per weekday.
all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.
Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.
Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers