A Hunch Worth Testing
For a few weeks I had the feeling that more was being exploited than usual. More emergency advisories, more "patch within three days" deadlines, more vendors I did not normally see in the news. A feeling is not a finding, so I decided to test it against the data I keep.
For my own research I maintain a local database of public vulnerability and threat feeds. On the evening I ran these checks, two of them were down: my ransomware leak-site feed and my URLhaus feed. That left CISA's Known Exploited Vulnerabilities catalogue, the National Vulnerability Database, ThreatFox and MalwareBazaar.
KEV is the most useful of these for this question. CISA adds a vulnerability only when it has evidence of exploitation against real targets, and the catalogue carries its full history, so a trend in it is not distorted by when I started collecting. ThreatFox and MalwareBazaar only go back to early September in my copy, which matters later.
The short version. The hunch held up for one thing and not for another. Confirmed exploitation of internet-facing systems rose by about 60% from mid-August, and it survived every check I could think of. A spike in malware indicators that looked like supporting evidence turned out to be a handful of researchers submitting large batches in the same week.
Check One: Is the Rise Real?
I counted KEV additions per week from January to late October, using CISA's own date added rather than the date my database pulled the record. From January to mid-August, CISA added 181 vulnerabilities over about 32 weeks, roughly 5.6 a week. From the week of 17 August to 25 October, it added 91 in 10 weeks, roughly 9.1 a week.
That looked like a 60% increase, but raw counts can mislead. CISA often adds several CVEs from one vendor advisory on the same day, and a single four-CVE batch can look like a surge. So I counted exploitation events instead: one event per vendor per day, however many CVEs it covered.
| Period | CVEs Added | Distinct Events | Events per Week |
|---|---|---|---|
| 1 Jan – 16 Aug | 181 | 148 | 4.6 |
| 17 Aug – 25 Oct | 91 | 74 | 7.4 |
The increase survived. Events per week rose by about 62%, almost exactly the rise in raw CVE counts. Batching barely changed either, at about 1.2 CVEs per event in both periods. CISA is not bundling more bugs per advisory. It is confirming more separate cases of exploitation.
The pace was not even within the recent period. It peaked from mid-August to the end of September at around 10.5 CVEs a week, and October eased to around 7. That is still above the first half of the year.
Check Two: Who Is Driving It?
My assumption was that a rise in KEV would mean a busy few months for the vendors that always dominate it. The opposite was true. Microsoft, the largest contributor to the catalogue, slowed down, from about 1.0 additions a week to 0.7. Apple and Ivanti slowed as well.
The growth came from vendors that had barely appeared in KEV all year.
| Vendor | Jan – 16 Aug | Since 17 Aug | Pattern |
|---|---|---|---|
| Microsoft | 33 | 7 | Slower |
| Citrix | 1 | 5 | Sustained, 4 dates |
| JFrog | 0 | 4 | Sustained, 3 dates |
| MikroTik | 0 | 3 | Sustained, 2 dates |
| Linux | 3 | 5 | Two batches |
| Plex | 0 | 4 | One day |
| Ahsay | 0 | 2 | One day |
| Zammad | 0 | 2 | One day |
| Red Hat | 0 | 2 | One day |
The baseline period is about three times longer than the recent one, so a vendor with equal counts in both columns is being added about three times as often now. On that basis Citrix is running at roughly fifteen times its earlier weekly rate.
Counts alone could not tell me whether each vendor was a campaign or a single event, so I listed the individual CVEs and their dates. CVEs added on the same day usually come from one advisory. CVEs spread across weeks mean exploitation kept being confirmed.
Three sustained campaigns
An authentication bypass patched in mid-August was being exploited by early September and added on 9 September. Two separate zero-days followed on 27 September, with a three-day federal patch deadline. Another memory flaw was added on 4 October.
Artifactory stores the build artifacts and packages that software is assembled from. Public reporting describes attackers chaining three of these flaws to plant backdoors that survived patching, one campaign lasting 24 days.
CERT Polska reported attacks against MikroTik routers with SSH exposed to the internet, with its first logs dated 2 September, before patches were available.
One-off events and a different kind of bug
Plex, Ahsay and Zammad each arrived as a single batch on a single day. Each is one exploitation event, not a trend, but they share a theme with the sustained three. Plex Media Server, Ahsay backup, Zammad helpdesk, MikroTik routers, Artifactory and NetScaler are all software that organisations, and in Plex's case individuals, run themselves and expose to the internet. Plex is a clear example of the pace: public reporting dates the first attacks to 17 October, one day after full exploit details were published, and CISA added all four flaws on 20 October.
Linux is different. Its five additions are kernel bugs used after an attacker is already inside, to gain higher privileges, rather than to get in. Several are old: a 2022 kernel bug and two 2015 Red Hat bugs were added together on 26 August, and three kernel bugs together on 18 September. I have not confirmed why older privilege escalation bugs were added in a group, so I am treating them as two events and nothing more.
Checking my data against the outside world. I verified the Citrix, JFrog, MikroTik and Plex entries against public reporting, and every date in my copy matched CISA's. I also found disagreement between secondary sources. Some security news sites describe two other MikroTik CVEs as added to KEV. CISA's own bulletin for 10 September does not list one of them, and CISA has stated it has no reports of exploitation for the other. My data contains neither, which matches CISA rather than the blogs. When summaries disagree, the catalogue itself is the record to trust.
Check Three: Did It Get Faster?
The Plex timeline, with attacks one day after publication, made me wonder whether the real change was speed rather than volume. I joined KEV against NVD and measured the gap between a vulnerability's publication and its addition to KEV. I limited this to 2026 CVEs so that old bugs added late would not distort the median.
| Period | 2026 CVEs | Median Gap | Within 7 Days |
|---|---|---|---|
| 1 Jan – 16 Aug | 110 | 3.5 days | 63% |
| 17 Aug – 25 Oct | 75 | 3 days | 57% |
No acceleration. The median gap has been around three days all year. If anything a slightly smaller share of recent additions arrived within a week.
I checked one possible distortion. NVD sometimes publishes a CVE after CISA has already added it to KEV, which produces a zero or negative gap and drags the median down. That happened three times in the whole set, all recently, so it does not explain the result. Same-day additions, where CISA lists a CVE on the day NVD publishes it, actually fell from 33% of additions to 23%.
So Plex was typical of 2026, not a sign of something new. Exploitation was already fast. What changed is how many separate systems it reached.
Check Four: Does a Second Source Agree?
KEV records what CISA confirmed, so its pace reflects CISA's own process as well as attacker activity. I wanted an independent source. ThreatFox, a community-submitted feed of malware indicators, looked like it delivered one: the week of 19 October had 16,225 indicators, about 39% above the average of the six weeks before it.
Breaking that week down by malware family showed the growth was concentrated. AMOS, a macOS information stealer, rose from about 199 indicators a week to 1,680. VShell, a command-and-control framework, rose from about 349 to 2,146. Vidar and IClickFix each added roughly 700 above their usual level.
Then I checked who submitted them.
| Family | Spike Week | Usual Week | Top Reporter Share |
|---|---|---|---|
| AMOS | 1,680 | 199 | 99.9% |
| VShell | 2,146 | 349 | 83% |
| Vidar | 1,747 | 1,007 | 86% |
| IClickFix | 1,676 | 1,038 | 85% |
| StrelaStealer | 517 | 1 | 78%, two reporters |
Each spike came almost entirely from one reporter. The clearest case is VShell: without its top reporter, the remaining submissions came to about 375, right at the usual weekly level. The indicators are probably real infrastructure. But one researcher submitting a large batch in a given week tells you about that researcher's week, not about attackers. The ThreatFox spike cannot support the hunch.
One family is the exception. StrelaStealer, an email credential stealer delivered through invoice phishing, went from about one indicator a week to 517, and two separate reporters picked it up in the same week. That is a weaker signal than the KEV finding, but two independent sources at once is worth watching as the possible start of a new wave.
The other feed went the opposite way. MalwareBazaar sample submissions peaked in mid-September at around 5,000 to 5,900 a week and have run at around 3,100 to 3,900 since, roughly a third lower.
A check worth making standard. Community feeds are only as even as the people submitting to them. Before reading a weekly count as a trend, group it by reporter. If one name accounts for most of a spike, it is a measure of research effort, and the spike should be set aside rather than cited.
What Held Up
The hunch was partly right. Confirmed exploitation rose by about 60% from mid-August, the rise survived the batching test, and it came from outside the vendors that normally fill KEV. It was led by sustained campaigns against Citrix NetScaler, JFrog Artifactory and MikroTik routers, with single events against other self-hosted software such as Plex, Ahsay and Zammad.
The rest did not hold. Exploitation did not get faster, the malware indicator spike was a reporting effect, and MalwareBazaar fell. "More attacks" is true for internet-facing systems that organisations run themselves. It is not true across the board.
The limits of this note. KEV measures what CISA confirmed and added, so its pace reflects CISA's workload and priorities as well as attacker activity. Ten weeks is a short window, and per-vendor counts are small enough that one advisory can move them. My ransomware and URLhaus feeds were down when I ran these checks, so I could not test whether ransomware activity rose alongside. CISA's flag for ransomware use is usually set later, once a campaign is tied to a CVE, so recent entries cannot yet show whether ransomware groups are behind this rise. And ThreatFox and MalwareBazaar only go back to early September in my copy, so I could not compare them against the first half of the year.
Defensible takeaway. If you run gateways, routers, artifact repositories, backup servers or helpdesk platforms yourself and expose them to the internet, the last ten weeks have been busier for you than for most. The usual patch rhythm, built around Microsoft's monthly cycle, would have missed most of what was added to KEV in this period.
What I would want to know next
Whether the rise continues into November or settles back toward the first-half pace. October already eased, so the next six weeks decide whether this was a season or a shift.
Whether ransomware groups are behind any of it, once my leak-site feed is back and CISA's ransomware flags catch up.
And whether StrelaStealer's jump turns into a campaign that other feeds and vendors report. If it does, two reporters noticing it in the same week will have been the early signal.
I started with a feeling that attacks were up. The data said yes for one kind of attack and no for another, and the most useful thing I learned was how easily a spike in a community feed can look like a trend until you ask who submitted it.
Counts, rates and vendor breakdowns from the author's own research, queried against a local database of public vulnerability and threat feeds maintained by the author, on 26 October 2026. KEV figures use CISA's date added for additions from 1 January to 25 October 2026; the baseline period of 1 January to 16 August is treated as 32.4 weeks and the recent period of 17 August to 25 October as 10 weeks; distinct exploitation events counted as unique combinations of vendor and date added. Publication-to-KEV gaps joined on CVE identifier against NVD publication dates, limited to CVEs with 2026 identifiers. ThreatFox and MalwareBazaar counts use each feed's own first-seen date from 7 September 2026, when all feeds in this comparison were being collected; the ThreatFox spike week is 19 to 25 October, compared against the weekly average from 7 September to 18 October; reporter shares from the reporter field of each indicator. Plex Media Server exploitation timeline and CISA addition of 20 October 2026: The Hacker News, BleepingComputer and SecurityOnline (October 2026). Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, and exploitation of CVE-2026-19490: The Hacker News, BleepingComputer and SecurityAffairs (September 2026); Canadian Centre for Cyber Security advisory AV26-833. JFrog Artifactory CVE-2026-82329 and its chaining with CVE-2026-42016 and CVE-2026-42018: SOCRadar and Wiz vulnerability database (September 2026). MikroTik RouterOS CVE-2026-67277 and CVE-2026-86060: CISA KEV bulletin of 10 September 2026; CERT Polska reporting as relayed by the Canadian Centre for Cyber Security alert AL26-020. StrelaStealer background: IBM X-Force reporting on Hive0145 as relayed by Infosecurity Magazine. AMOS and ClickFix background: Jamf Threat Labs reporting as relayed by Infosecurity Magazine. This field note represents independent research produced for educational purposes.