Top Threats (1–6)

1. Citrix NetScaler CVE-2026-88779 (catalogued Sunday 4 October; due TOMORROW Wednesday 7 October). Forensic triage Yes. Vendor CVSS 8.7. Memory overflow when the appliance is configured as a SAML SP or SAML IdP: unauthenticated network trigger can deny service; repeated triggering can keep the gateway unavailable. Actor unattributed; vendor states targeted attacks observed on unmitigated deployments and availability impact only (customer-data integrity impact not identified by vendor). Public RCE claims around SAML-path crashes remain unverified as this CVE — treat SAML-configured appliances as high urgency, not merely crash-prone, until the fixed train is proven. Fixed: 14.1-73.41+; 13.1-64.28+; 14.1-FIPS 14.1-73.41 FIPS+; 13.1-FIPS/NDcPP 13.1-37.282+. September builds that closed Citrix NetScaler CVE-2026-88771 / Citrix NetScaler CVE-2026-88772 do not close this row. Preconditions: authentication samlAction (SP) or authentication samlIdPProfile (IdP). Preserve forensic evidence before upgrade. Distinct from residual Citrix NetScaler CVE-2026-19490. Primary co-lead — Wednesday 7 October fuse (corrected from prior edition Tuesday mislabel).
2. Fortinet FortiMail CVE-2026-104286 (catalogued Thursday 1 October; due ELAPSED Sunday 4 October). Forensic triage Yes. CVSS 9.8. Path traversal plus improper NULL-byte neutralization → unauthenticated arbitrary file write via crafted HTTP or HTTPS; vendor-confirmed ITW. Affected: 8.0.0–8.0.1 / 7.6.0–7.6.6 / 7.4.0–7.4.8 / 7.2.0–7.2.9. Fixed builds now SHIPPED: 8.0.2+ / 7.6.7+ / 7.4.9+; 7.2 migrate to a fixed 7.4+ (7.4.9 or later). Force upgrade on every affected appliance; hunt vendor IoCs before trusting the host. Workaround until patched: disable IBE (config system encryption ibe / set status disable) or remove internet exposure of management/webmail; block POST /ibe paths containing '../' if a front-end filter is available. Distinct from residual Fortinet CVE-2025-25249. Material change vs 5 October edition (builds were UPCOMING) — residual only until fleets are on fixed trains.
3. Zammad CVE-2026-102489 + Zammad CVE-2026-102490 (catalogued Friday 2 October; due ELAPSED Monday 5 October). Dual catalog adds. Forensic triage Yes on both. CVSS 9.4 / 9.4. Actor unattributed; catalogued as actively exploited and chainable. CVE-2026-102489: session fixation that can lead to remote code execution as the zammad user — practically exploitable on 6.5 and older; present but not practically exploitable on 7.0–7.1.3 per vendor runtime conditions; hardening included in 7.2.0. CVE-2026-102490: improper privilege management allowing the local zammad user to escalate to root (affects a broad historical range including late alphas); cannot be exploited remotely on its own; vendor states a confirmed fix is still in progress and recommends 7.2.0 while monitoring advisories — no confirmed named fixed package for 102490 alone this run. Zammad 7.2.1 released 6 October as a critical security update addressing other issues; it does not claim CVE-2026-102489 or CVE-2026-102490. Self-hosted: upgrade to 7.2.0+ immediately; take end-of-support 6.5 and older offline if upgrade is blocked; hunt for compromise markers before trusting the host. Co-lead — due clock elapsed, chain still open.
4. Apple CoreGraphics CVE-2026-86950 (catalogued Tuesday 29 September; due ELAPSED Friday 2 October). Forensic triage Yes. CVSS 8.8. Out-of-bounds write in CoreGraphics: processing a maliciously crafted file may lead to arbitrary code execution. Actor unattributed; vendor states awareness of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. A public crash proof-of-concept via crafted PDF with embedded TrueType font is circulating; demonstrated remote code execution is separate work and not shown in that analysis. Fixed: iOS/iPadOS 26.7.1; macOS Tahoe 26.7.1; macOS Sequoia 15.8.1. Force the fixed builds across managed fleets — prioritize executive, VIP, and high-value mobile. Unpatched fleets remain open incidents. Residual — not closed.
5. Cisco Catalyst SD-WAN Manager CVE-2026-76504 (catalogued Wednesday 30 September; due ELAPSED Saturday 3 October). Forensic triage Yes. CVSS 9.8. Improper handling of URI encoding (hex encoding) in API session authentication: a crafted HTTP request that encodes any one character in the j_security_check path bypasses the authentication rule and grants API access as the admin user (default netadmin). Actor unattributed; vendor Product Security became aware of active exploitation in September 2026. No workaround. Fixed: 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1 (earlier than 20.9 → migrate). Cloud-hosted already mitigated at the platform layer. Hunt serviceproxy-access.log and vmanage-server.log for encoded j_security_check and viptela-reserved-username patterns. Suspected compromise = preserve admin-tech, open vendor TAC with the CVE in the title, rebuild posture. Residual — not closed.
6. Citrix NetScaler CVE-2026-88771 + Citrix NetScaler CVE-2026-88772 (catalogued Sunday 27 September; due ELAPSED Wednesday 30 September). Dual catalog adds. Forensic triage Yes on both. Both CVSS 9.5 (vendor v4). Actor unattributed; vendor-confirmed exploitation on unmitigated deployments continues. Citrix NetScaler CVE-2026-88771: improper input validation — unauthenticated remote command execution on default ADC/Gateway (no additional feature required). Citrix NetScaler CVE-2026-88772: memory-buffer restriction failure — RCE or DoS when DTLS is enabled (default on VPN vServers). Fixed: 14.1-73.37+; 13.1-64.23+; FIPS trains as listed. Preserve forensic evidence and run vendor IoC checks before upgrading — an update can erase forensic visibility. Patch is not eviction. Keep Citrix NetScaler CVE-2026-88779 distinct — September fixed builds for this pair do not close 88779. Distinct from residual Citrix NetScaler CVE-2026-19490. Residual — not closed.

Top Threats (7–20)

7. WordPress Core CVE-2026-87902 (due ELAPSED Monday 28 September) + Microsoft SharePoint CVE-2026-65660 (due ELAPSED Monday 28 September) + residual ransomware-Known SharePoint CVE-2026-45659. WordPress: FT Yes; CVSS 8.1; unauth page-template RFI → conditional RCE; mass opportunistic exploitation observed (pearcmd.php include chains writing PHP under /tmp). Fixed: 7.1.2 with backports including 7.0.6 / 6.9.9 / 6.8.10 down to 4.7.37. SharePoint 65660: FT Yes; CVSS 8.8; code injection; vendor-confirmed ITW; apply August 2026 security updates; restrict anonymous WebPart exposure; hunt in-memory webshells. Residual ransomware-Known SharePoint CVE-2026-45659 remains named. Patch alone is not eviction. Residual — not closed.

8. MikroTik RouterOS CVE-2026-67279 + MikroTrick chain (MikroTik RouterOS CVE-2026-86060) (67279 due ELAPSED Monday 28 September) + sibling MikroTik RouterOS CVE-2026-67277. Forensic triage No on 67279; forensic triage Yes on chained 86060. CVE-2026-67279 alone CVSS 6.9; chained outcome is unauthenticated administrative takeover. Confirmed in-the-wild exploitation of the chain since at least 2 September against internet-facing SSH. Markers: login failure for user -2 via SSH; users added by ssh:-2@; highly privileged account named ops; Flagged device-mode. Fixed: 7.25beta3 / 7.24.2 / 7.23.4 / 6.49.21. Close SSH/WWW from untrusted nets until patched. If Flagged/ops/compromise markers: isolate, factory-reset, rebuild — do not restore a full backup from the compromised period. Residual — not closed.

9. WSO2 CVE-2026-5430 (due ELAPSED Sunday 27 September) + Adobe Commerce/Magento CVE-2026-71362 (due ELAPSED Sunday 27 September) + residual StyleSmuggler Magento/Adobe Commerce CVE-2026-75650 + Friday 25 September edge/artifact cluster. WSO2: FT Yes; CVSS 10.0; path traversal / JWT signature bypass → authentication bypass including potential administrative takeover and RCE path on API Control Plane / API Manager / Traffic Manager / Universal Gateway. Adobe 71362: FT Yes; CVSS 9.1; incorrect authorization → unauthenticated privilege escalation to sensitive resources. Distinct from StyleSmuggler CVE-2026-75650 (template-engine RCE, CVSS 10.0, due ELAPSED 11 September, FT Yes) — apply VULN-39341 + encryption-key and full credential rotation. Check Point CVE-2026-85102 + Check Point CVE-2026-93616 + F5 BIG-IP APM CVE-2026-94127 + Arista VeloCloud Orchestrator CVE-2026-93952 (all due ELAPSED Friday 25 September; FT Yes; CVSS 9.8 / 9.8 / 9.8 / 10.0): finish vendor hotfixes / ENG builds / VCO 5.2.3.16+ and 6.4.2.8+; restrict management planes; FT hunt where exposure existed pre-patch. Artifactory CVE-2026-42018 + Artifactory CVE-2026-42016 (token chain; due ELAPSED Friday 25 September; FT No) + residual Artifactory CVE-2026-82329 (due ELAPSED 5 September; FT Yes): self-hosted to branch-correct fixed builds for all three; hunt anomalous admin tokens, unexpected Groovy plugins, unfamiliar persistence binaries. Cloud fortified. All residual — not closed.

10. Zyxel GS1900 CVE-2026-7273 (due ELAPSED Thursday 24 September; FT Yes) + Chromium V8 CVE-2026-87491 + residual Chromium V8 CVE-2026-85046 (dues ELAPSED; FT No; vendor-confirmed ITW) + Windows CVE-2026-81963 + Windows CVE-2026-85880 (dues ELAPSED Tuesday 22 September; FT No; CVSS 7.8; vendor-confirmed exploited) + Linux Kernel CVE-2025-39682 + Linux Kernel CVE-2026-53266 + Linux Kernel CVE-2025-39964 (dues ELAPSED Monday 21 September; FT Yes). Upgrade GS1900 to matching 2.90(XXXX.2)C0; force Chrome/Chromium ≥153.0.8010.36/.37; force September Windows cumulative; apply distro kernel updates closing all three and reboot. Residual — not closed.

11. Cisco ISE CVE-2026-76460 + Cisco SEG CVE-2026-76461 + Google Pixel CVE-2026-58704 + Acronis Backup CVE-2026-87886. ISE/Pixel/Acronis due ELAPSED Saturday 19 September (FT Yes); SEG due ELAPSED Thursday 17 September (FT Yes). ISE/ISE-PIC → 3.1 Patch 12 / 3.2 Patch 11 / 3.3 Patch 12 / 3.4 Patch 7 / 3.5 Patch 4; hunt ise-kong/access.log; suspected = re-image. SEG AsyncOS → 15.5.5-014 / 16.0.4-302 / 16.5.0-780. Pixel → security patch level 2026-09-05+. Acronis cPanel/WHM plugin → 1.9.3 HF3; Plesk → 1.8.11+.

12. LiteLLM CVE-2026-59822 + Starlette CVE-2026-48710 (dues ELAPSED 16 September; FT No). Upgrade LiteLLM to 1.84.0+; Starlette to 1.0.1+; do not leave /mcp/ internet-exposed.

13. PaperCut NG/MF CVE-2026-81578 + PaperCut NG/MF CVE-2026-82078 (dues ELAPSED 14 September; FT No). Prefer NG/MF 26.0.5 / 25.0.13 / 24.1.10. Restrict the web UI to trusted IPs.

14. GitLab CE/EE CVE-2026-85706 (due ELAPSED 14 September; FT Yes; CVSS 10.0). Self-managed → 19.1.8 / 19.2.6 / 19.3.2. Hunt unauthenticated POSTs to repository commits with file.path parameters; rotate secrets that could have been on disk.

15. ScreenConnect CVE-2026-84869 (due ELAPSED 14 September; FT Yes; CVSS 9.9). On-premises: upgrade server to 26.6.5 then reinstall every host client / access agent. Temporary mitigation: deselect TransferFiles on every role.

16. N-central CVE-2026-86218 (due ELAPSED 11 September; FT Yes). On-premises: upgrade to 2026.3 Hotfix 4 build 2026.3.1.14. Hotfix 3 does not close this row. Hosted fortified.

17. Cisco FMC CVE-2026-20079 (due ELAPSED 12 September; FT Yes; CVSS 10.0). Apply train hotfixes; hunt package_info.*license /var/tmp/license.tmp IoCs. Hotfixes are not eviction. Residual ransomware-Known Cisco FMC CVE-2026-20316 stays in season residual language where relevant.

18. Citrix NetScaler CVE-2026-19490 (due ELAPSED 12 September; FT Yes; CVSS 9.3). Upgrade to 14.1-73.32+ / 13.1-63.21+ or listed FIPS builds. Distinct from 88771/88772 and 88779 — all three must stay named.

19. Fortinet CVE-2025-25249 (due ELAPSED 12 September; FT Yes). Fix FortiOS 7.6.4+ / 7.4.9+ / 7.2.12+ / 7.0.18+ (migrate 6.4); FortiSwitchManager 7.2.7+ / 7.0.6+. Hunt implants; rotate edge credentials. Keep Fortinet FortiMail CVE-2026-104286 distinct.

20. vCenter CVE-2026-59310 (due ELAPSED 21 August; FT Yes). Catalog field knownRansomwareCampaignUse = Known. Patch to 9.1.0.0300 / 9.0.2.0100 / 8.0 U3k / 8.0 U2f. Hunt reverse-shell persistence and ESXi .babyk encryption markers.

In the Window — Supply-Chain Worms

Shai-Hulud — 7 September reactivation. Four packages published 7 September carrying the identical May payload hash: feishu-docx-mcp@0.3.2, bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, bmc-translate-utils@1.1.1. Registry latest tags now resolve to 0.0.1-security stubs (re-verified this run, 6 October). Actor unattributed (family attribution by payload hash match — confidence high on payload reuse, not on operator identity). No verified additional family package wave 8 September–6 October. Any install of the four malicious versions is an incident: clean persistence, then rotate registry, code-host, cloud, and CI tokens from a clean machine, and rebuild clean.

Mini Shai-Hulud / openapi-react-query-codegen. Versions published 28 August. The registry latest tag now resolves to 3.0.0 this run. Actor unattributed. Not a second ChainDrop wave. No verified new Mini family package wave 29 August–6 October. If any build pulled a 28 August malicious release, treat the host as compromised, clean persistence, then rotate tokens from a clean machine, and rebuild clean.

ChainDrop. 4 August package-registry worm. More than 400 packages. No verified new poisoning wave 5 August–6 October. Residual is not "the registry is clean." Audit lockfiles. Rotate registry, code-host, cloud, and CI tokens only after the implant is gone.

Coder registry.coder.com. Between 07:35 and 21:45 UTC on 31 August, a compromised CDN API key redirected a portion of registry traffic to an attacker-controlled server serving tampered Terraform modules that exfiltrated cloud credentials to coder-infra.com. Vendor states same-day remediation; registry confirmed clean afterward. Actor unattributed. If templates or workspaces pulled modules during that window, hunt egress to coder-infra.com, rebuild affected templates/workspaces, rotate cloud credentials, and upgrade Coder to 2.37.0, 2.36.4, 2.35.7, or 2.34.9. Distinct from other registry residual; keep named separately.

crates.io arrayref. Malicious versions of arrayref, internment, and append-only-vec published 20 August, then yanked. Official response: maintainer account locked; author not believed to have acted maliciously. Actor unattributed. No verified follow-on wave 21 August–6 October. If any Rust build ran without a lockfile in that window, treat the host as compromised, rotate secrets, and rebuild clean.

yane88 scoped packages. Not a worm wave and not a second ChainDrop. Live registry residual only. Confirmed prior installs remain package incidents.

Miasma. Family residual only this run. No verified new self-propagating Miasma package wave 11 September–6 October. Keep named; do not fold into anonymous registry residual.

Emerging Signals

• No new known-exploited catalog rows dated 5–6 October — live catalog still 2026.10.04 / 1,734.
• Citrix NetScaler CVE-2026-88779 due TOMORROW Wednesday 7 October (weekday corrected from prior edition Tuesday mislabel) — confidence high.
• Fortinet FortiMail CVE-2026-104286 fixed builds 8.0.2 / 7.6.7 / 7.4.9 now SHIPPED — force upgrade; due clock ELAPSED Sunday 4 October.
• Zammad pair due ELAPSED Monday 5 October; 102490 confirmed fix still not shipped; 7.2.1 (6 October) does not claim these two CVEs.
• Apple CoreGraphics due ELAPSED Friday 2 October with public crash PoC circulating.
• Cisco Catalyst SD-WAN Manager due ELAPSED Saturday 3 October.
• Public-registry malicious-package additions in the last 24–72 hours remain typo/typosquat and probe noise (isolated MAL rows) — not a named self-propagating worm family.
• No new ransomware-enablement flag flips on catalogued rows overnight beyond the existing vCenter Known field and residual SharePoint CVE-2026-45659 Known field.
• RCE claims around NetScaler SAML crashes remain unverified as CVE-2026-88779 — watch item with high operational weight on SAML-configured fleets.

Do Today

1. Citrix NetScaler CVE-2026-88779: catalogued Sunday 4 October; due TOMORROW Wednesday 7 October; forensic triage Yes; vendor CVSS 8.7. Inventory every customer-managed ADC/Gateway with SAML SP or SAML IdP configured; upgrade to 14.1-73.41+ / 13.1-64.28+ (FIPS/NDcPP as listed); preserve evidence before upgrade. September 88771/88772 builds do not close this. Distinct from residual CVE-2026-19490. Do not wait for Wednesday.
2. Fortinet FortiMail CVE-2026-104286: due ELAPSED Sunday 4 October; forensic triage Yes; CVSS 9.8. Fixed builds 8.0.2 / 7.6.7 / 7.4.9 now SHIPPED. Force upgrade; 7.2 migrate to fixed 7.4+; hunt vendor IoCs before trusting; keep IBE disabled / mgmt isolated until confirmed patched. Distinct from residual Fortinet CVE-2025-25249. Residual — not closed until fleets are on fixed trains.
3. Zammad CVE-2026-102489 + Zammad CVE-2026-102490: due ELAPSED Monday 5 October; forensic triage Yes; CVSS 9.4/9.4. Self-hosted: upgrade to 7.2.0+ now; take 6.5 and older offline if blocked; hunt compromise. 102490 vendor fix still in progress — stay on vendor advisories. 7.2.1 (6 October) does not claim these two CVEs.
4. Apple CoreGraphics CVE-2026-86950: due ELAPSED Friday 2 October; forensic triage Yes; CVSS 8.8; public crash PoC circulating. Force iOS/iPadOS 26.7.1+, macOS Tahoe 26.7.1+, macOS Sequoia 15.8.1+ across managed fleets — prioritize VIP/executive devices. Residual — not closed.
5. Cisco Catalyst SD-WAN Manager CVE-2026-76504: due ELAPSED Saturday 3 October; forensic triage Yes; CVSS 9.8. Inventory every on-prem Manager (especially internet-reachable); hunt encoded j_security_check IOCs; upgrade to 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1; restrict management plane. No workaround. Suspected compromise = rebuild posture + vendor TAC. Residual — not closed.
6. Citrix NetScaler CVE-2026-88771 + Citrix NetScaler CVE-2026-88772: due ELAPSED Wednesday 30 September; forensic triage Yes. If still unpatched: preserve evidence and run vendor IoC checks before upgrading; move to 14.1-73.37+ / 13.1-64.23+ (FIPS trains as listed). Suspected compromise = rebuild + credential/crypto rotation. Distinct from residual CVE-2026-19490 and CVE-2026-88779. Residual — not closed.
7. WordPress Core CVE-2026-87902: due ELAPSED Monday 28 September; forensic triage Yes. Upgrade to 7.1.2 or the fixed backport for your branch; hunt pearcmd.php includes, /tmp PHP writes, and unexpected plugins/admins. Patch is not eviction.
8. Microsoft SharePoint CVE-2026-65660: due ELAPSED Monday 28 September; forensic triage Yes. Apply August 2026 SharePoint security updates to fixed builds; restrict anonymous WebPart exposure; hunt in-memory webshells. Keep residual ransomware-Known SharePoint CVE-2026-45659 named.
9. MikroTik RouterOS CVE-2026-67279 (+ chain MikroTik RouterOS CVE-2026-86060 / sibling MikroTik RouterOS CVE-2026-67277): 67279 due ELAPSED Monday 28 September; FT No on 67279 / FT Yes on 86060. Upgrade to 7.25beta3 / 7.24.2 / 7.23.4 / 6.49.21; close SSH from untrusted nets; hunt user -2 / ops / Flagged. Factory-reset if compromised.

Also still open (elapsed / residual)

• WSO2 CVE-2026-5430 + Adobe Commerce/Magento CVE-2026-71362: both due ELAPSED Sunday 27 September; FT Yes. Apply WSO2 update levels; upgrade Adobe Commerce/Magento/B2B to August 2026 security trains. Distinct from StyleSmuggler Magento/Adobe Commerce CVE-2026-75650 — apply VULN-39341 + encryption-key/credential rotation if still open.
• Check Point CVE-2026-85102 + Check Point CVE-2026-93616 + F5 BIG-IP APM CVE-2026-94127 + Arista VeloCloud Orchestrator CVE-2026-93952: all due ELAPSED Friday 25 September; FT Yes. Finish vendor hotfixes/ENG builds/VCO upgrades; restrict management planes; FT hunt where exposure existed pre-patch.
• Artifactory CVE-2026-42018 + Artifactory CVE-2026-42016 (elapsed Fri 25; FT No) and residual Artifactory CVE-2026-82329 (elapsed, FT Yes): self-hosted to branch-correct fixed builds for all three; hunt admin tokens, Groovy plugins, Rust backdoors. Cloud fortified.
• Zyxel GS1900 CVE-2026-7273 + Chromium V8 CVE-2026-87491 (+ residual Chromium V8 CVE-2026-85046) + Windows CVE-2026-81963 + Windows CVE-2026-85880: Zyxel due ELAPSED Thu 24 (FT Yes); V8 due ELAPSED Wed 23 (FT No); Windows due ELAPSED Tue 22 (FT No). Upgrade switches to 2.90(XXXX.2)C0; force Chromium ≥153.0.8010.36/.37; force September Windows cumulative.
• Linux Kernel CVE-2025-39682 + Linux Kernel CVE-2026-53266 + Linux Kernel CVE-2025-39964 + Cisco ISE CVE-2026-76460 + Google Pixel CVE-2026-58704 + Acronis Backup CVE-2026-87886 + Cisco SEG CVE-2026-76461: Kernel/ISE/Pixel/Acronis due ELAPSED (FT Yes); SEG due ELAPSED Thu 17 (FT Yes). Apply distro kernel updates + reboot; ISE patches; Pixel 2026-09-05+; Acronis HF3 builds; SEG AsyncOS fixed trains.
• PaperCut NG/MF CVE-2026-81578 + PaperCut NG/MF CVE-2026-82078 + GitLab CE/EE CVE-2026-85706 + ScreenConnect CVE-2026-84869: all due ELAPSED 14 September. PaperCut prefer 26.0.5 / 25.0.13 / 24.1.10 (FT No). GitLab self-managed → 19.1.8 / 19.2.6 / 19.3.2 (FT Yes). ScreenConnect on-prem → 26.6.5 + reinstall clients (FT Yes).
• LiteLLM CVE-2026-59822 + Starlette CVE-2026-48710 (elapsed 16 Sep; FT No): LiteLLM ≥1.84.0; Starlette ≥1.0.1.
• StyleSmuggler Magento/Adobe Commerce CVE-2026-75650 / N-central CVE-2026-86218 / Cisco FMC CVE-2026-20079 / Citrix NetScaler CVE-2026-19490 / Fortinet CVE-2025-25249: all earlier elapsed; forensic triage Yes on the catalogued management-plane rows. Apply fixed trains / hotfixes / VULN-39341 / Hotfix 4; hunt IoCs — patch is not eviction.
• vCenter CVE-2026-59310 (ransomware-known): patch 9.1.0.0300 / 9.0.2.0100 / 8.0 U3k / 8.0 U2f; hunt reverse-shell persistence and ESXi .babyk.
• Shai-Hulud 7 September quartet: any install of feishu-docx-mcp@0.3.2, bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, or bmc-translate-utils@1.1.1 is an incident — clean persistence, then rotate tokens from a clean host.
• Mini Shai-Hulud / openapi-react-query-codegen: latest is 3.0.0 this run — any 28 August install remains an incident.
• Coder registry: hunt coder-infra.com egress for 31 August pulls; patch Coder; rebuild tainted templates.
• ChainDrop: lockfile sweep, remove implant, then rotate.
• crates.io arrayref / internment / append-only-vec: unlocked Rust builds in the 20 August window remain an incident.
• yane88 scoped packages: not a second ChainDrop; confirmed prior installs remain package incidents.
• Miasma: family residual only — no verified new wave 11 September–6 October.

Coverage Self-Audit

Reviewed:

• Catalog adds: live 2026.10.04 / 1,734 — unchanged vs 5 October edition; zero adds dated 5–6 Oct; Citrix NetScaler CVE-2026-88779 dated 4 Oct remains newest; Zammad CVE-2026-102489 + Zammad CVE-2026-102490 dated 2 Oct; Fortinet FortiMail CVE-2026-104286 dated 1 Oct
• Due clocks: due TOMORROW Wed 7 Oct Citrix 88779; ELAPSED Mon 5 Zammad pair; ELAPSED Sun 4 FortiMail; ELAPSED Sat 3 Cisco 76504; ELAPSED Fri 2 Apple 86950; ELAPSED Wed 30 Citrix 88771/88772; ELAPSED Mon 28 WordPress/SharePoint/MikroTik; ELAPSED Sun 27 WSO2/Adobe; ELAPSED Fri 25 edge cluster
• In-the-wild CVEs and elapsed residual catalog rows named in body
• Supply-chain worms: Shai-Hulud, Mini Shai-Hulud, openapi-react-query-codegen, ChainDrop, Coder registry, crates.io arrayref, yane88, Miasma named — not folded into anonymous registry residual
• Ransomware/RaaS: vCenter knownRansomwareCampaignUse=Known retained; SharePoint CVE-2026-45659 Known retained; Cisco FMC CVE-2026-20316 Known noted
• APT/nation-state/IAB: Apple row frames sophisticated targeted exploitation — actor unattributed this run; no separate new confirmed high-visibility APT development beyond that vendor language — stated
• Underground via public trackers: no standalone breach/incident dump elevated into this vuln-focused edition

Silent only where nothing in window. Every defining in-horizon event is named in the body above. Self-audit mustNames: PASS.

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.