What were pre-disclosure attempts last week is confirmed exploitation now: CISA added both PHP2Shell flaws to KEV on October 26 with an October 29 federal deadline — the three-day emergency tier — after remote code execution was confirmed in the wild; trackers logged more than 50,000 exploitation requests from 600+ addresses across 70 countries, and Palo Alto Networks confirmed active exploitation against internet-exposed PAN-OS management interfaces running the vulnerable runtime. The adjacent PolyShell campaign has compromised hundreds of Adobe Commerce and Magento stores (Sansec counts 953 in the campaign overall), with the PolyShell and Brotli flaws both KEV-listed. A second Cisco ASA/FTD SSL VPN zero-day since August is crashing firewalls, China-linked actors exploited a VMware ESX zero-day to blind audit logging, and Cisco SD-WAN exploitation is planting key-stealing malware. Ten KEV additions. This is the closest any week has come to the acute bar's mass-exploitation condition; it stops short because the confirmed-compromise scale — as against attempt volume — remains unsettled. Confidence is high.

Token-replay attacks against Microsoft 365 compromised 97 accounts at 79 organizations — session tokens stolen once, replayed past authentication. The Skyw4lker campaign brings device-code phishing back at scale against American organizations, a gap EvilTokens' takedown left now refilled. Researchers found 26,400 valid cloud and AI credentials in public Gitee repositories — the GitHub finding of W41 repeating on another platform — and the Gheist campaign uses stolen GitHub tokens to lift private repository secrets from Actions logs. A Microsoft Authenticator flaw that let permissionless Android apps steal work account tokens was patched. GitHub's new npm firewall, blocking malicious packages before installation, is a structural defensive gain. Single source class throughout — steady at the raised level. Confidence is medium.

Binance suspended withdrawals while investigating suspicious transfers estimated at $5.3–5.9 billion — potentially the largest crypto theft on record, but the operator has confirmed neither a theft nor an amount, and roughly $3 billion is already frozen by stablecoin issuers: held pending confirmation, consistent with how unverified scope has been treated since the ShinyHunters claim. Keystone will destroy 18,835 hardware wallets after attackers stole a device verification key — the second hardware-wallet trust event in three weeks after Ledger. Japan Airlines disclosed a third-party breach of passenger data, Polymarket halted trading over a $2.5 million crypto-draining script, and GMO posted a $1 million bounty over the Onamae breach. Volt Typhoon ran four zero-day campaigns through a covert relay network. Against this: the FBI seized the Virtualine bulletproof hosting service and Australia cut 180,000 machines out of the Amadey botnet. Net: steady at the raised level. Confidence is medium.