投稿の様式は件数と同様に重要である。pixelleaksは11月13日に14件の被害組織を同一のタイムスタンプで公開し、全データ公開の期限を11月16日、17日、18日にあらかじめ設定していた。Playは9件を投稿し、N0nは欧米の大手ブランドと、エチオピア、カタール、ボツワナの匿名化された番号付き企業を混ぜて掲載した。その多くは検証待ちである。一方Qilinは、York University、Oral Roberts University、University of Texas at Arlingtonを掲載した。このうちUniversity of Texas at Arlingtonは、サイバー攻撃で個人情報が盗まれたことを別途確認している。
WordPressプラグイン「Security For WooCommerce」に11件のCVE、すべて認証不要
NVDは、Security For WooCommerceのバージョン1.0.16までを対象に、CVE-2026-123695からCVE-2026-123705までの連番を公開した。その一覧は製品名を意図的に裏返したかのようである。認証されていないユーザーが、全ユーザーのログイントークンを生成して管理者を含む任意のユーザーとしてログインできる。全アカウントの二要素認証の登録を一括で解除できる。設定された秘密鍵や非公開のログインURLを含む全設定を読み取れる。設定を初期値に戻し、カスタムログインURL、二要素認証、reCAPTCHA、パスワードポリシー、ファイアウォールを無効化できる。管理者のメールアドレスを含むサーバーレポートを取得できる。原因はいずれも同じで、認可チェックのないREST経路である。修正版は示されておらず、Printaura、ARForms、Gravity Formsを含む、WordPressプラグインの脆弱性の一連の公開の中で明らかになった。
Nothing to see台湾と半導体に関する論点、複合危機の国別シグナル、ThreatFoxのポート再利用パターンは、単一の情報源によるものか、純粋に記述的なものである。Expediaの10億件規模のレコードに関する恐喝の主張は未検証である。Jensen Huangの辞任に関する話題は風刺と読め、そのように扱っている。CVE-2026-64669、64671、64686におけるNVDからTelegramまでの71時間の遅延は、ほぼ確実に収集頻度によるものである。
No public vendor or CISA advisory ties the Ivanti Connect Secure exploitation chain to a specific named threat actor or ransomware group by 2026-11-12.
Called Mon 2 Nov · due Thu 12 Nov
Due date 2026-11-12 passed; no item in today's feed ties the Ivanti CVE-2026-111357 chain to a named actor or ransomware group, confirming the call that no such attribution occurred.
open
Ubuntu moves the IPv4 TCP use-after-free kernel fixes out of its opt-in testing channel into regular updates for its three newest LTS releases by 14 November 2026.
Called Wed 4 Nov · due Sat 14 Nov
No feed items mention Ubuntu kernel update channel moves for the IPv4 TCP use-after-free fixes; cannot confirm or deny.
open
IHG Hotels & Resorts does not publicly confirm the BYOD intrusion claim.
Called Thu 5 Nov · due Thu 12 Nov
Due date 2026-11-12 passed; no IHG statement or regulatory filing appears in the feeds acknowledging a BYOD intrusion, confirming the call that IHG would not publicly confirm it.
right
At least three of n0n's numbered 'Company #138-147' listings will be replaced by named victims on a leak site tracked by these feeds.
Called Sun 8 Nov · due Sun 15 Nov
By 15 November, n0n's ransomlook entries show named victims (DraftKings, LiveRamp, Female Daily Network, LEO Pharma, etc.) replacing numbered placeholders, with at least three formerly-numbered entries now named.
open
At least one of Vortex's three 12 November deadline victims (PYRAMID HEALTHCARE, ALEXION, CRESA) appears as published or leaked data on ransomware.live or ransomlook.
Called Wed 11 Nov · due Sun 15 Nov
No feed items show PYRAMID HEALTHCARE, ALEXION, or CRESA as published or leaked on ransomware.live or ransomlook by 15 November; the falsify condition (no published/leaked status) may apply but no explicit confirmation either way is present.
wrong
Inc Ransom posts fewer than 20 new leak-site claims on any single day between 12 and 18 November, confirming the 47 was a backfill rather than tempo.
Called Wed 11 Nov · due Wed 18 Nov
The tempo signal reports incransom surging with 53 claims in 7 days; individual day counts are not broken out but ransomlook shows multiple incransom postings on 13 November alone (sportsmansguide, Advantage Archives, axiscades, etc.), and the tempo signal flags a p<0.001 surge well above the <20/day threshold.
Microsoft confirms the SignDrop CLFS issue or assigns it a CVE by 27 November 2026.
Called Fri 13 Nov · due Fri 27 Nov
SecurityWeek reports 'Nightmare Eclipse Drops Windows Zero-Day Exploit SignDrop' describing CLFS abuse, confirming the technique is public; however no Microsoft CVE assignment or official Microsoft advisory is cited in the feeds yet. Due date is 2026-11-27.
Pixelleaks publishes at least one of the full data sets scheduled for 16-17 November, visible on ransomlook.
Called Sat 14 Nov · due Wed 18 Nov
Pixelleaks posted numerous entries on ransomlook dated 2026-11-13 with full data leak dates of 2026-11-16 and 2026-11-17, visible on ransomlook before the deadlines.
Qilin posts five or more new victims across the ransomware trackers, holding its position at the top of the 2026 tally.
Called Sat 14 Nov · due Sat 21 Nov
Ransomlook shows Qilin posted at least 5 new victims (York University, UT Arlington, Oral Roberts University, Leonard's Express, Wisconsin Timber Rattlers) on 2026-11-14, and darkfeed confirms Qilin leads 2026 tally at 1171.
UpEducation — 1.3× its own prior share (47 claims, 36 expected)
DownAgriculture and Food Production — 0.4× its own prior share (15 claims, 38 expected)
DownProfessional Services — 0.8× its own prior share (127 claims, 149 expected)
29% of claims carry no sector label.
Brand churn
Of the 239 leak-site brands first seen since 2021-09-30, 75% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 67% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 214 old enough to judge posted on one day and never again; 37% made at least half their claims in their first week. New brands this month: 8 — newest: Curious Worm (2026-11-11, 12 claims), osiris (2026-11-11, 8 claims), Climax Inc (2026-11-10, 17 claims).
Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.
Targeting
Over the last 180 days, among brands with at least 20 labelled claims: safepay put 32% of its claims on Germany (6.2× every other brand's share); N0n put 28% of its claims on Transportation (6.2× every other brand's share); SilentRansomGroup put 100% of its claims on Professional Services (6.3× every other brand's share). Widest spread: nightspire across 10.7 effective sectors.
Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.
Posting clock
Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; Deadlock released 61% of its claims on Fridays, half of them in 12:00–13:59 UTC; akira posted only 2 of 197 claims at weekends and half its claims in 12:00–13:59 UTC; half of thegentlemen's claims appeared in 06:00–09:59 UTC. Leak sites overall are 37% quieter per weekend day than per weekday.
all brands by hour of day, 00–23 UTC; half of all claims land in 07:00–15:59 UTC.
Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.
Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers