WEEK OF OCTOBER 12, 2026

Citrix NetScaler CVE-2026-88779, the third zero-day in the product in eight days, is exploited in targeted attacks that crash SAML authentication services; it drew another three-day federal deadline, and whether the memory overflow also yields code execution is unresolved — Citrix is investigating. Zammad zero-days (KEV October 2) are tied by DIVD to an AI-driven network breach, FortiMail exploitation detail continues from last week, Warlock ransomware is converting last month's SharePoint flaw, and an Atlassian Data Center flaw drew exploitation attempts within two hours of public details. But five of the week's eight KEV additions are 2015–2023 catch-up entries, and the acute question from last week resolved downward: no emergency directive, no victim wave, and the new NetScaler bug is denial-of-service, not confirmed RCE. Intensity comparable to last week's peak — steady. Confidence is high.

An FBI warning says the FortiBleed campaign has amassed 86,644 Fortinet device credentials and is actively locking administrators out of FortiGate VPNs — the week's heaviest identity item, but single-source-class evidence, so the two-source rule holds the signal steady. Around it: the Shai-Hulud credential-stealing worm returned through the compromised Tensorlake npm package, fake ChatGPT, Gemini, and Claude ad portals are capturing credentials and MFA codes, the Wazza phishkit targets banking and government across three continents, and ASOS tied its breach to social engineering and credential theft. Sustained pressure at the raised level. Confidence is medium.

Two developments raise the signal from two independent source classes: a ransomware attack on IDC Frontier's IDCF Cloud shut down its East Japan region — the operator acknowledges 495 companies and local governments affected, with customer data expected to be difficult or impossible to restore — and joint advisory AA26-281A documents Chinese government-linked actors combining automated and hands-on tools to steal sensitive data, with the FBI concurrently disrupting their tooling. Held, not raised: the ccTLD registry hijack that minted valid certificates for Google domains (issued September 22–27, disclosed and revoked this week) and Denmark's CPR breach exposing 8.8 million people's identity data (September activity, discovered October 2) — both disclosure-lag by our rules. The ShinyHunters FBI watch item closes: a contractor patch failure was the root cause, and a detained suspect is cooperating. SEC EDGAR collection failed this window (HTTP 500), so Item 1.05 filings were not visible. Confidence is medium.