Every weekly reading, newest first. Readings are immutable once published — corrections append to a visible revision history.
PHP2Shell moves from exploit attempts to CISA-confirmed exploitation under a three-day federal deadline, PolyShell breaches hundreds of commerce stores, and a suspected record crypto theft at Binance awaits confirmation — the dial holds at its pre-acute ceiling.
A PHP emergency, a compromised certificate authority, and an AI-driven supply-chain attack on ConnectWise land in the same week — the dial reaches the ceiling short of a qualifying acute event.
An Ivanti VPN zero-day chain that beat a fully patched appliance leads another heavy exploitation week, the clock's first Item 1.05 filing lands, and the dial holds.
A third NetScaler zero-day in eight days keeps exploitation at its peak while intrusion tempo rises — ransomware takes down a Japanese cloud serving 495 organizations and a joint advisory confirms Chinese state data theft.
Two Citrix NetScaler zero-days under confirmed global exploitation draw a dedicated CISA alert and a three-day federal patch deadline — the strongest exploitation event since launch — and pressure climbs toward the top of the high band.
Zero-days in F5 and Check Point management planes keep exploitation at its peak, a takedown dents device-code phishing, and the dial holds.
Passkey-themed social engineering graduates from research to active intrusions, while exploitation holds at its peak behind a max-severity Cisco ISE zero-day.
Four exploited zero-days across Chrome and Windows, a shared espionage exploit kit, and firewall-management exploitation trigger the federal three-day patch clock.
Two chained SonicWall zero-days and admin-token forgery in Artifactory lead a hot exploitation week, while three material-incident filings mark rising intrusion tempo.
Pressure holds at high: an emergency NetScaler patch order and a confirmed federal-agency incident, against a KEV week inflated by catch-up additions of older flaws.
The heaviest KEV week yet — eight additions reaching machine-learning infrastructure — while an active threat to Siemens PLCs keeps critical-infrastructure pressure high.
Exploitation broadens for a third week — firewalls, hypervisors, Windows zero-days — and ransomware crews convert last month's edge-device access; pressure climbs within the high band.
Exploited flaws in remote-management and developer infrastructure drive a second week of rising exploitation; the reading crosses into high pressure.
Zero-day exploitation of perimeter security products and a coordinated attack on water utilities push defender pressure up this week.
Confirmed exploitation of a pre-auth WordPress Core chain drives pressure this week; identity abuse and intrusion tempo hold at elevated levels.