WEEK OF OCTOBER 5, 2026

Eight KEV additions, all current flaws — no vintage catch-up. The core event: Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 (unauthenticated RCE on ADC and Gateway), exploited as zero-days, drew both a dedicated CISA alert confirming global exploitation and a three-day federal remediation deadline, and the post-exploitation picture is unusually complete — root access, WHIPSHOT and SLAPSHOT implants, a superuser-creating payload, and web shells mapped to CSS-like URLs. Around it: a Cisco Catalyst SD-WAN Manager authentication-bypass zero-day, a Fortinet FortiMail zero-day, an Apple flaw used in targeted attacks, and MikroTik, SharePoint, and WordPress additions. Bitget confirmed a third-party security-product zero-day behind its $387.5M theft. This exceeds the August NetScaler emergency (a single CVE in a vintage-heavy week): first rising week since W35. Confidence is high.

Research finds over 543,000 live credentials — API keys, tokens, passwords — exposed in public GitHub repositories, a standing self-inflicted attack surface. A US-focused executive phishing campaign steals Microsoft 365 sessions and installs RMM tooling for persistent remote access, and a parallel campaign abuses MSP360 to deploy ScreenConnect — attacker hands-on-keyboard arriving as legitimate software. A flaw in the official MCP Python SDK that could let malicious servers steal OAuth credentials is a watch item for AI-tool adopters. Sustained pressure at the raised level, no verified step-change. Confidence is medium.

The Pentagon confirmed a Defense Manpower Data Center breach exposing records of more than three million people, including Social Security numbers — but the intrusion ran from October 2025 to July 2026 through a file-sharing flaw and was only discovered after nine months: disclosure-lag evidence, held, consistent with prior treatment. Bitget confirmed its $387.5M theft came through a third-party security-appliance zero-day with weeks of pre-positioned access — severe, but concentrated in one exchange. Against that, two enforcement wins: Operation KillSwitch seized KillSec's leak site, five servers, and 110TB of data with three arrests including the suspected 16-year-old administrator, and Dutch police arrested a suspect in the ShinyHunters investigation. No Item 1.05 filings this window. Net: steady. Confidence is medium.