Today’s theme is blast radius math. One vendor foothold becomes dozens of customer environments, and one “it’s on the backlog” upgrade turns into a direct line to money, credentials, and operations.

Today's Top 5

1. 77M emails, 97 servers: Japan’s PayCloud says the Arara Message breach expanded sharply after weekend forensics, with access into 97 client servers and a provisional count of ~77 million email addresses. Source
2. BTCPay hot wallets swept: Maintainers say attackers stole BTC and LTC from “hot wallets” on BTCPay Server instances running 2.4.1 or earlier, and warn that simply updating is not a full fix if admin access was gained. Source
3. 1,000+ GitLab servers exposed: Shadowserver says it’s still seeing over 1,000 internet exposed GitLab instances unpatched for CVE-2026-97229, now used in active RCE attacks. Source
4. Ivanti chain gets longer: Ivanti shipped fixes for two more Connect Secure bugs used in a zero day chain, including CVE-2026-111357 and CVE-2026-118527, after real world exploitation. Source
5. 115+ supermarkets disrupted: Attackers remotely altered refrigeration settings across more than 115 stores in multiple European countries, turning a niche OT control problem into spoiled inventory and early morning chaos. Source

Why today matters: Two of today’s biggest stories are about “secondary” systems that teams stop thinking about: email delivery platforms and self hosted payment stacks. Attackers love them because they sit at the intersection of credentials, customer reach, and quiet admin access. If you are a CISO with lots of vendors and lots of self managed tooling, your risk is compounding even when your crown jewels are locked down.

XERJ Corpus Hub: If CVE-2026-97229 is on your GitLab list, an AI agent loading splunk-security-content could draft Splunk hunts for suspicious CI/CD pipeline config changes and regex compiler crash patterns, then hand your SOC a runnable detection pack in minutes. Grab a corpus at hub.xerj.org, it’s free.

Alright, let’s get specific.

Data Breaches

1. PayCloud (Arara Message) breach expands to ~77M email addresses: PayCloud Holdings said a breach of its Arara Message email delivery service was used as a springboard into 97 servers in client environments. The company warned the ~77 million address count is provisional and that exposed data varies by client, while the service remains suspended. Source: INTERNET Watch (Impress)
2. Revolve: payment card data theft affects 180,000+: Fashion retailer Revolve is notifying at least 180,000 people after attackers accessed its e commerce platform and obtained personal data plus stored payment card details. For teams that still allow saved cards, this is the nightmare: a breach becomes card reissuance at scale. Source: SecurityWeek
3. OSF (Center for Open Science): access control flaw exposed user emails: The Open Science Framework reported an access control issue in an internal administrative application that allowed unauthorized external access to users’ names and email addresses, plus limited project metadata fields. The bug was introduced on Oct 17, 2026 and the earliest recorded access was Oct 24, 2026, per OSF’s notice. Source: OSF Support
4. BTCPay Server: hot wallet thefts on outdated instances: BTCPay Server says it received reports on Nov 1, 2026 of BTC and LTC being stolen from hot wallets, and found attacks targeted servers running 2.4.1 (July 23, 2026) or earlier. The project recommends moving to a fresh server and rotating credentials because updating alone may not remove an attacker’s foothold. Source: BTCPay Server Blog

Security Research

1. GitLab CVE-2026-97229: unpatched internet exposed instances still under attack: BleepingComputer reports over 1,000 exposed GitLab servers remain unpatched for a critical flaw in the CI/CD Regular Expression Compiler that can enable remote code execution under certain conditions. CISA has added it to KEV, which is your “stop debating, schedule the outage” signal. Source: BleepingComputer
2. Ivanti Connect Secure: two more bugs fixed in exploited chain: Ivanti released updates addressing CVE-2026-111357 and CVE-2026-118527, which were chained with CVE-2026-104935 to achieve unauthenticated root level code execution in real world incidents. If you run ICS, assume exploitation is possible and plan for post patch compromise assessment. Source: BleepingComputer
3. Synology: surge in C3RB3R ransomware targeting outdated NAS devices: Synology warned of threat actors exploiting an older vulnerability to target outdated DSM versions, with reports of encrypted data and extortion demands. The practical takeaway is simple: block NAS management interfaces from the internet, then update. Source: BleepingComputer
4. Cyberattack disrupts supermarket refrigeration across Europe: This incident reads like “OT meets retail ops” in the worst way, with defrost triggers and temperature changes causing food loss and store level intervention. It’s also a reminder that remote management paths for physical systems are prime targets. Source: BleepingComputer
5. Cisco Talos: VTK PNG reader crash bug (CVE-2026-41216): Cisco Talos published details on a VTK invalid pointer dereference in vtkPNGReader::ExecuteInformation. This is the kind of library flaw that quietly rides along in imaging and visualization stacks until someone makes it your incident. Source: Cisco Talos

Top CVEs

1. CVE-2026-97229: Critical GitLab CI/CD regex compiler integer overflow that can lead to RCE under certain conditions. Active exploitation is reported and more than 1,000 exposed instances were still unpatched, so treat it like a live fire drill. Source
2. CVE-2026-111357: Ivanti Connect Secure missing authentication for a critical function, part of a chained zero day set observed in the wild. If you patched once in October, verify you applied the latest fixes and then do a compromise assessment. Source
3. CVE-2026-118527: Ivanti Connect Secure predictable identifier generation issue that can enable authenticated attackers to upload files to a known disk location. It matters because it’s used in the same chain as other ICS flaws and defenders keep treating “low CVSS” as “low risk.” Source
4. CVE-2026-104935: Ivanti Connect Secure authentication bypass by spoofing that enables unauthenticated command execution and has been exploited in the wild. If your perimeter still includes ICS, this is a board level risk, not a ticket. Source
5. CVE-2026-41216: Invalid pointer dereference in VTK’s vtkPNGReader::ExecuteInformation, per Cisco Talos. Track where VTK lands in your org via transitive deps because these show up in surprising places. Source

Podcasts & Talks

1. ISC Stormcast, Nov 3, 2026 (SANS ISC): A quick daily filter for what changed overnight, handy for CISOs who want to sanity check whether today’s patch plan still matches today’s reality. Listen: Watch/Listen

Final Words

Today’s uncomfortable pattern is that attackers are winning by living in the gaps between “product,” “vendor,” and “infrastructure.” Arara shows how a service you think is just email delivery can become a corridor into customer servers. BTCPay shows how “self hosted” can silently become “self owned” if you let versions drift. And the supermarket refrigeration mess shows why cyber resilience is now an operations conversation, not a SOC conversation.

This week, do three things:

• Patch or isolate GitLab for CVE-2026-97229, then hunt for suspicious .gitlab-ci.yml changes and odd pipeline behavior on exposed instances.
• For Ivanti Connect Secure, verify upgrades that include fixes for CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527, then run a compromise assessment before you declare victory.
• If any teams run BTCPay Server, inventory versions, move hot wallet funds off server, and rebuild any instance that was on 2.4.1 or earlier as compromised.

Your turn: If a vendor told you tonight that their service was used to reach 97 of your customer environments, do you already know which of your contracts require them to pay for your incident response, or would Legal be negotiating while Ops is on fire? Hit reply with your take, or drop a comment on the web version. I read every reply.

Know someone who still has an old BTCPay Server instance sitting in a corner with a hot wallet attached? Forward them this issue. It costs 30 seconds and the alternative costs real money. If you got this from a friend or on the web, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!