WEEK OF OCTOBER 19, 2026

Seven KEV additions, all current flaws. The core event: an attacker chained three Ivanti Connect Secure zero-days for unauthenticated root access — against an appliance that was fully patched when exploitation began October 3. Two flaws are fixed as CVE-2026-104935 (KEV October 13, a three-day federal deadline, and a dedicated CISA alert); the third, a privilege escalation, remains unpatched with a fix reportedly weeks away. The chain modifies code only in memory, evading Ivanti's integrity checker, and was used to harvest Active Directory credentials, LAPS passwords, and BitLocker recovery keys. Around it: a PAN-OS management-interface RCE in limited exploitation, a Cisco Secure Email Gateway zero-day, AhsayCBS backup-server flaws re-patched after incomplete fixes, an exploited Windows Shell bug in a record 1,413-flaw Patch Tuesday, and the Atlassian flaw from last week now cataloged. Exploitation remains targeted rather than mass, and the week matches rather than exceeds the recent peak — steady. Confidence is high.

Microsoft's disruption of three phishing kits linked to more than one billion scam messages removes standing attacker capacity — logged as a pressure-reducing receipt, consistent with the EvilTokens precedent. Pulling the other way, the GhostAction campaign compromised roughly 1,900 GitHub accounts and targeted more than 30,000 repositories for secret theft, and GitHub tightened npm publishing after a flaw left 1,500+ packages open to hijacking. SAP disclosed a CVSS 10.0 Cloud SDK for Python flaw enabling OAuth2 credential theft — disclosure only, no observed exploitation. No new FortiBleed development this window; the watch item carries. Net: steady at the raised level. Confidence is medium.

Park Dental Partners' amended 8-K — the first Item 1.05 material-incident filing the clock's collector has caught — confirms patient health data was taken in its August intrusion, with four class actions pending: a materiality milestone, but disclosure-lag evidence for an August incident, held. Ledger confirmed an unauthorized hardware implant in a wallet sold through the Southeast Asian reseller CryptoBilis and halted reseller sales; analyst estimates of $86–93 million drained are unverified by the operator, and confirmed cases sit in one reseller channel — held. The UK Legal Aid Agency disclosed theft of records dating to 1978 (historical incident, newly scoped), and attackers hijacked Danfoss controllers to heat French supermarket fridges to 50°C — an OT intrusion with physical effect, single incident. Against that, the FBI raided more than 40 North Korean IT-worker laptop farms with 14 charged — an enforcement win. Net: steady at the raised level. Confidence is medium.