{"region":"United States","overall":"high","summary":"High: driven by 7 new CISA KEV additions and 11 government/CERT advisories.","scopes":[{"scope":"home","label":"Home","level":"normal","points":3,"signals":[{"key":"widespread","label":"Widespread exploitation","explanation":"Stories reporting mass or widespread exploitation.","count":0,"points":0,"maxPoints":8,"evidence":[]},{"key":"critical-exploited","label":"Critical, actively exploited","explanation":"Critical-severity stories with confirmed exploitation.","count":0,"points":0,"maxPoints":12,"evidence":[]},{"key":"kev-ransomware","label":"KEV additions used by ransomware","explanation":"Vulnerabilities added to CISA KEV that are known to be used in ransomware campaigns.","count":0,"points":0,"maxPoints":6,"evidence":[]},{"key":"kev","label":"New KEV additions","explanation":"Vulnerabilities newly added to the CISA Known Exploited Vulnerabilities catalog.","count":1,"points":1,"maxPoints":6,"evidence":[{"id":56,"slug":"apple-multiple-products-out-of-bounds-write-vulnerability-cve-2026-86950-is-being","headline":"Apple Multiple Products Out-of-Bounds Write Vulnerability (CVE-2026-86950) is being actively exploited, CISA warns"}]},{"key":"gov-advisory","label":"Government / CERT advisories","explanation":"High or critical advisories published by government agencies or CERTs.","count":2,"points":2,"maxPoints":4,"evidence":[{"id":56,"slug":"apple-multiple-products-out-of-bounds-write-vulnerability-cve-2026-86950-is-being","headline":"Apple Multiple Products Out-of-Bounds Write Vulnerability (CVE-2026-86950) is being actively exploited, CISA warns"},{"id":295,"slug":"cisa-malcolm","headline":"CISA Malcolm"}]},{"key":"developing-critical","label":"Developing critical incidents","explanation":"Critical stories that editors are actively tracking as developing or confirmed.","count":0,"points":0,"maxPoints":10,"evidence":[]},{"key":"high-volume","label":"High-severity news volume","explanation":"All other high or critical severity stories.","count":0,"points":0,"maxPoints":4,"evidence":[]}],"summary":"Normal: driven by 2 government/CERT advisories and 1 new CISA KEV addition."},{"scope":"smb","label":"Small Business","level":"guarded","points":4.5,"signals":[{"key":"widespread","label":"Widespread exploitation","explanation":"Stories reporting mass or widespread exploitation.","count":0,"points":0,"maxPoints":8,"evidence":[]},{"key":"critical-exploited","label":"Critical, actively exploited","explanation":"Critical-severity stories with confirmed exploitation.","count":0,"points":0,"maxPoints":12,"evidence":[]},{"key":"kev-ransomware","label":"KEV additions used by ransomware","explanation":"Vulnerabilities added to CISA KEV that are known to be used in ransomware campaigns.","count":0,"points":0,"maxPoints":6,"evidence":[]},{"key":"kev","label":"New KEV additions","explanation":"Vulnerabilities newly added to the CISA Known Exploited Vulnerabilities catalog.","count":2,"points":2,"maxPoints":6,"evidence":[{"id":302,"slug":"fortinet-fortimail-path-traversal-vulnerability-cve-2026-104286-is-being-actively","headline":"Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) is being actively exploited, CISA warns"},{"id":56,"slug":"apple-multiple-products-out-of-bounds-write-vulnerability-cve-2026-86950-is-being","headline":"Apple Multiple Products Out-of-Bounds Write Vulnerability (CVE-2026-86950) is being actively exploited, CISA warns"}]},{"key":"gov-advisory","label":"Government / CERT advisories","explanation":"High or critical advisories published by government agencies or CERTs.","count":2,"points":2,"maxPoints":4,"evidence":[{"id":302,"slug":"fortinet-fortimail-path-traversal-vulnerability-cve-2026-104286-is-being-actively","headline":"Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) is being actively exploited, CISA warns"},{"id":56,"slug":"apple-multiple-products-out-of-bounds-write-vulnerability-cve-2026-86950-is-being","headline":"Apple Multiple Products Out-of-Bounds Write Vulnerability (CVE-2026-86950) is being actively exploited, CISA warns"}]},{"key":"developing-critical","label":"Developing critical incidents","explanation":"Critical stories that editors are actively tracking as developing or confirmed.","count":0,"points":0,"maxPoints":10,"evidence":[]},{"key":"high-volume","label":"High-severity news volume","explanation":"All other high or critical severity stories.","count":1,"points":0.5,"maxPoints":4,"evidence":[{"id":384,"slug":"university-of-illinois-chicago-affected-by-ransomware-attack-on-medical-school","headline":"University of Illinois Chicago affected by ransomware attack on medical school"}]}],"summary":"Guarded: driven by 2 new CISA KEV additions and 2 government/CERT advisories."},{"scope":"enterprise","label":"Enterprise","level":"elevated","points":11,"signals":[{"key":"widespread","label":"Widespread exploitation","explanation":"Stories reporting mass or widespread exploitation.","count":0,"points":0,"maxPoints":8,"evidence":[]},{"key":"critical-exploited","label":"Critical, actively exploited","explanation":"Critical-severity stories with confirmed exploitation.","count":1,"points":3,"maxPoints":12,"evidence":[{"id":360,"slug":"citrix-netscaler-improper-restriction-of-operations-within-the-bounds-of-a-memory-buffer","headline":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-88779) is being actively exploited, CISA warns"}]},{"key":"kev-ransomware","label":"KEV additions used by ransomware","explanation":"Vulnerabilities added to CISA KEV that are known to be used in ransomware campaigns.","count":0,"points":0,"maxPoints":6,"evidence":[]},{"key":"kev","label":"New KEV additions","explanation":"Vulnerabilities newly added to the CISA Known Exploited Vulnerabilities catalog.","count":4,"points":4,"maxPoints":6,"evidence":[{"id":360,"slug":"citrix-netscaler-improper-restriction-of-operations-within-the-bounds-of-a-memory-buffer","headline":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-88779) is being actively exploited, CISA warns"},{"id":329,"slug":"zammad-gmbh-zammad-improper-privilege-management-vulnerability-cve-2026-102490-is-being","headline":"Zammad GmbH Zammad Improper Privilege Management Vulnerability (CVE-2026-102490) is being actively exploited, CISA warns"},{"id":302,"slug":"fortinet-fortimail-path-traversal-vulnerability-cve-2026-104286-is-being-actively","headline":"Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) is being actively exploited, CISA warns"},{"id":236,"slug":"cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks","headline":"Cisco warns of new SD-WAN zero-day exploited in attacks"}]},{"key":"gov-advisory","label":"Government / CERT advisories","explanation":"High or critical advisories published by government agencies or CERTs.","count":3,"points":3,"maxPoints":4,"evidence":[{"id":329,"slug":"zammad-gmbh-zammad-improper-privilege-management-vulnerability-cve-2026-102490-is-being","headline":"Zammad GmbH Zammad Improper Privilege Management Vulnerability (CVE-2026-102490) is being actively exploited, CISA warns"},{"id":302,"slug":"fortinet-fortimail-path-traversal-vulnerability-cve-2026-104286-is-being-actively","headline":"Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) is being actively exploited, CISA warns"},{"id":236,"slug":"cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks","headline":"Cisco warns of new SD-WAN zero-day exploited in attacks"}]},{"key":"developing-critical","label":"Developing critical incidents","explanation":"Critical stories that editors are actively tracking as developing or confirmed.","count":0,"points":0,"maxPoints":10,"evidence":[]},{"key":"high-volume","label":"High-severity news volume","explanation":"All other high or critical severity stories.","count":2,"points":1,"maxPoints":4,"evidence":[{"id":393,"slug":"clingstun-turns-vulnerable-iot-devices-into-proxy-nodes","headline":"ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes"},{"id":373,"slug":"linux-backdoor-abuses-stun-protocol-exploits-dozens-of-flaws","headline":"Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws"}]}],"summary":"Elevated: driven by 4 new CISA KEV additions and 1 critical actively exploited issue."},{"scope":"ai","label":"AI","level":"normal","points":0,"signals":[{"key":"widespread","label":"Widespread exploitation","explanation":"Stories reporting mass or widespread exploitation.","count":0,"points":0,"maxPoints":8,"evidence":[]},{"key":"critical-exploited","label":"Critical, actively exploited","explanation":"Critical-severity stories with confirmed exploitation.","count":0,"points":0,"maxPoints":12,"evidence":[]},{"key":"kev-ransomware","label":"KEV additions used by ransomware","explanation":"Vulnerabilities added to CISA KEV that are known to be used in ransomware campaigns.","count":0,"points":0,"maxPoints":6,"evidence":[]},{"key":"kev","label":"New KEV additions","explanation":"Vulnerabilities newly added to the CISA Known Exploited Vulnerabilities catalog.","count":0,"points":0,"maxPoints":6,"evidence":[]},{"key":"gov-advisory","label":"Government / CERT advisories","explanation":"High or critical advisories published by government agencies or CERTs.","count":0,"points":0,"maxPoints":4,"evidence":[]},{"key":"developing-critical","label":"Developing critical incidents","explanation":"Critical stories that editors are actively tracking as developing or confirmed.","count":0,"points":0,"maxPoints":10,"evidence":[]},{"key":"high-volume","label":"High-severity news volume","explanation":"All other high or critical severity stories.","count":0,"points":0,"maxPoints":4,"evidence":[]}],"summary":"No significant threat signals in the measurement windows."},{"scope":"web","label":"Web / Apps","level":"elevated","points":9,"signals":[{"key":"widespread","label":"Widespread exploitation","explanation":"Stories reporting mass or widespread exploitation.","count":0,"points":0,"maxPoints":8,"evidence":[]},{"key":"critical-exploited","label":"Critical, actively exploited","explanation":"Critical-severity stories with confirmed exploitation.","count":0,"points":0,"maxPoints":12,"evidence":[]},{"key":"kev-ransomware","label":"KEV additions used by ransomware","explanation":"Vulnerabilities added to CISA KEV that are known to be used in ransomware campaigns.","count":1,"points":2,"maxPoints":6,"evidence":[{"id":290,"slug":"armatura-llc-armatura-one","headline":"Armatura LLC Armatura One"}]},{"key":"kev","label":"New KEV additions","explanation":"Vulnerabilities newly added to the CISA Known Exploited Vulnerabilities catalog.","count":3,"points":3,"maxPoints":6,"evidence":[{"id":290,"slug":"armatura-llc-armatura-one","headline":"Armatura LLC Armatura One"},{"id":236,"slug":"cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks","headline":"Cisco warns of new SD-WAN zero-day exploited in attacks"},{"id":238,"slug":"unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570","headline":"Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570"}]},{"key":"gov-advisory","label":"Government / CERT advisories","explanation":"High or critical advisories published by government agencies or CERTs.","count":3,"points":3,"maxPoints":4,"evidence":[{"id":290,"slug":"armatura-llc-armatura-one","headline":"Armatura LLC Armatura One"},{"id":236,"slug":"cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks","headline":"Cisco warns of new SD-WAN zero-day exploited in attacks"},{"id":295,"slug":"cisa-malcolm","headline":"CISA Malcolm"}]},{"key":"developing-critical","label":"Developing critical incidents","explanation":"Critical stories that editors are actively tracking as developing or confirmed.","count":0,"points":0,"maxPoints":10,"evidence":[]},{"key":"high-volume","label":"High-severity news volume","explanation":"All other high or critical severity stories.","count":2,"points":1,"maxPoints":4,"evidence":[{"id":393,"slug":"clingstun-turns-vulnerable-iot-devices-into-proxy-nodes","headline":"ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes"},{"id":373,"slug":"linux-backdoor-abuses-stun-protocol-exploits-dozens-of-flaws","headline":"Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws"}]}],"summary":"Elevated: driven by 3 new CISA KEV additions and 3 government/CERT advisories."},{"scope":"critical-infrastructure","label":"Critical Infrastructure","level":"guarded","points":7.5,"signals":[{"key":"widespread","label":"Widespread exploitation","explanation":"Stories reporting mass or widespread exploitation.","count":0,"points":0,"maxPoints":8,"evidence":[]},{"key":"critical-exploited","label":"Critical, actively exploited","explanation":"Critical-severity stories with confirmed exploitation.","count":0,"points":0,"maxPoints":12,"evidence":[]},{"key":"kev-ransomware","label":"KEV additions used by ransomware","explanation":"Vulnerabilities added to CISA KEV that are known to be used in ransomware campaigns.","count":1,"points":2,"maxPoints":6,"evidence":[{"id":290,"slug":"armatura-llc-armatura-one","headline":"Armatura LLC Armatura One"}]},{"key":"kev","label":"New KEV additions","explanation":"Vulnerabilities newly added to the CISA Known Exploited Vulnerabilities catalog.","count":1,"points":1,"maxPoints":6,"evidence":[{"id":290,"slug":"armatura-llc-armatura-one","headline":"Armatura LLC Armatura One"}]},{"key":"gov-advisory","label":"Government / CERT advisories","explanation":"High or critical advisories published by government agencies or CERTs.","count":5,"points":4,"maxPoints":4,"evidence":[{"id":290,"slug":"armatura-llc-armatura-one","headline":"Armatura LLC Armatura One"},{"id":291,"slug":"monta-monta-app","headline":"Monta monta.app"},{"id":294,"slug":"abb-protection-and-control-ied-manager-pcm600","headline":"ABB Protection and Control IED Manager PCM600"},{"id":295,"slug":"cisa-malcolm","headline":"CISA Malcolm"},{"id":20,"slug":"mikrotik-routeros","headline":"MikroTik RouterOS"}]},{"key":"developing-critical","label":"Developing critical incidents","explanation":"Critical stories that editors are actively tracking as developing or confirmed.","count":0,"points":0,"maxPoints":10,"evidence":[]},{"key":"high-volume","label":"High-severity news volume","explanation":"All other high or critical severity stories.","count":1,"points":0.5,"maxPoints":4,"evidence":[{"id":367,"slug":"senate-passes-bipartisan-bill-to-strengthen-healthcare-cybersecurity","headline":"Senate Passes Bipartisan Bill to Strengthen Healthcare Cybersecurity"}]}],"summary":"Guarded: driven by 5 government/CERT advisories and 1 KEV addition used by ransomware."}],"overallDetail":{"scope":"overall","label":"United States","level":"high","points":19,"signals":[{"key":"widespread","label":"Widespread exploitation","explanation":"Stories reporting mass or widespread exploitation.","count":0,"points":0,"maxPoints":8,"evidence":[]},{"key":"critical-exploited","label":"Critical, actively exploited","explanation":"Critical-severity stories with confirmed exploitation.","count":1,"points":3,"maxPoints":12,"evidence":[{"id":360,"slug":"citrix-netscaler-improper-restriction-of-operations-within-the-bounds-of-a-memory-buffer","headline":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-88779) is being actively exploited, CISA warns"}]},{"key":"kev-ransomware","label":"KEV additions used by ransomware","explanation":"Vulnerabilities added to CISA KEV that are known to be used in ransomware campaigns.","count":1,"points":2,"maxPoints":6,"evidence":[{"id":290,"slug":"armatura-llc-armatura-one","headline":"Armatura LLC Armatura One"}]},{"key":"kev","label":"New KEV additions","explanation":"Vulnerabilities newly added to the CISA Known Exploited Vulnerabilities catalog.","count":7,"points":6,"maxPoints":6,"evidence":[{"id":360,"slug":"citrix-netscaler-improper-restriction-of-operations-within-the-bounds-of-a-memory-buffer","headline":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-88779) is being actively exploited, CISA warns"},{"id":329,"slug":"zammad-gmbh-zammad-improper-privilege-management-vulnerability-cve-2026-102490-is-being","headline":"Zammad GmbH Zammad Improper Privilege Management Vulnerability (CVE-2026-102490) is being actively exploited, CISA warns"},{"id":290,"slug":"armatura-llc-armatura-one","headline":"Armatura LLC Armatura One"},{"id":302,"slug":"fortinet-fortimail-path-traversal-vulnerability-cve-2026-104286-is-being-actively","headline":"Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) is being actively exploited, CISA warns"},{"id":236,"slug":"cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks","headline":"Cisco warns of new SD-WAN zero-day exploited in attacks"}]},{"key":"gov-advisory","label":"Government / CERT advisories","explanation":"High or critical advisories published by government agencies or CERTs.","count":11,"points":4,"maxPoints":4,"evidence":[{"id":329,"slug":"zammad-gmbh-zammad-improper-privilege-management-vulnerability-cve-2026-102490-is-being","headline":"Zammad GmbH Zammad Improper Privilege Management Vulnerability (CVE-2026-102490) is being actively exploited, CISA warns"},{"id":290,"slug":"armatura-llc-armatura-one","headline":"Armatura LLC Armatura One"},{"id":302,"slug":"fortinet-fortimail-path-traversal-vulnerability-cve-2026-104286-is-being-actively","headline":"Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) is being actively exploited, CISA warns"},{"id":236,"slug":"cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks","headline":"Cisco warns of new SD-WAN zero-day exploited in attacks"},{"id":21,"slug":"vivotek-camera-firmware","headline":"VIVOTEK Camera Firmware"}]},{"key":"developing-critical","label":"Developing critical incidents","explanation":"Critical stories that editors are actively tracking as developing or confirmed.","count":0,"points":0,"maxPoints":10,"evidence":[]},{"key":"high-volume","label":"High-severity news volume","explanation":"All other high or critical severity stories.","count":13,"points":4,"maxPoints":4,"evidence":[{"id":393,"slug":"clingstun-turns-vulnerable-iot-devices-into-proxy-nodes","headline":"ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes"},{"id":390,"slug":"alleged-shinyhunters-member-reportedly-detained-in-jordan-assisting-law-enforcement","headline":"Alleged ShinyHunters member reportedly detained in Jordan, assisting law enforcement"},{"id":387,"slug":"ukraine-grocery-chain-atb-confirms-cyberattack-as-hackers-threaten-to-leak-data","headline":"Ukraine grocery chain ATB confirms cyberattack as hackers threaten to leak data"},{"id":384,"slug":"university-of-illinois-chicago-affected-by-ransomware-attack-on-medical-school","headline":"University of Illinois Chicago affected by ransomware attack on medical school"},{"id":382,"slug":"new-dell-system-update-flaw-lets-hackers-gain-root-privileges","headline":"New Dell System Update flaw lets hackers gain root privileges"}]}],"summary":"High: driven by 7 new CISA KEV additions and 11 government/CERT advisories."},"methodologyVersion":"1.0","computedAt":"2026-10-06T03:48:10.1352821+00:00"}