Black October Published 15,351 Vulnerabilities and Ordered You to Fix 30. We Measured Six Months of Both, and the Month Everyone Named Is Average.
Through October 27, 15,351 vulnerabilities were published. Over the same 27 days, CISA added 30 entries to the Known Exploited Vulnerabilities catalog — the only list that comes with a federal deadline attached. That is one in 512.
In April it was one in 190.
We have been reading the same "Black October" and "Vulnpocalypse" threads everyone else has, and we kept wanting to answer them with a number instead of a vibe. So we pulled six months of both series from the primary sources — NVD's publication feed and CISA's own KEV file — and laid them beside our own perimeter telemetry. This is what the three instruments say.
The numbers
Per day, so the short month compares fairly:
Vulnerabilities published per day. April 196. May 225. June 267. July 320. August 410. September 502. October 569. That is a 2.9x rise in six months, and it is monotonic — every single month set a new high. The Vulnpocalypse is real. Nobody is imagining the flood.
Confirmed-exploited additions per day. April 1.03. May 0.68. June 0.77. July 0.84. August 1.00. September 1.43. October 1.11. Six-month average: 1.00. October is 11% above it, which on a 27-day sample is three vulnerabilities.
The exploited share. 0.53% in April, falling to 0.20% in October. The fraction of published work that anyone is confirmed to be attacking more than halved while the volume nearly tripled.
So the month that acquired a nickname produced an entirely unremarkable amount of exploitation. What it produced was an unprecedented amount of triage.
What actually got worse
The thing that degraded this year is not your exposure. It is the cost of deciding what to ignore.
In April, a security team that read every new CVE was reading 196 a day, and roughly one in 190 of them would eventually be confirmed as attacked. In October the same team reads 569 a day for the same single hit — and reads it against a backdrop where five of October's thirty KEV additions were disclosed between 2015 and 2023. ProFTPD from 2015. BIND from 2015. Apache Struts from 2016. ONLYOFFICE from 2021. Strapi from 2023. Seventeen percent of the month's must-patch list was CISA catching up on a decade-old backlog, not a new wave breaking.
That is worth sitting with, because it inverts the panic. Part of what felt like an October surge was the oldest software in the catalog finally being written down.
Our own perimeter disagrees with the math and agrees with the mood
Here is the honest complication, and it is the reason we think the "it's all noise" takes are half wrong too.
Measured on our own infrastructure — blocked requests at our edge plus the decoys our edge honeypot serves — events per day ran 1,152 in June, 1,128 in July, 1,210 in August, 1,755 in September, and 2,208 so far in October. Our perimeter got 1.9x busier since midsummer. Something really is out there, and it arrived on roughly the schedule the mood says it did.
But look at what it is. The top paths in October's blocked traffic are the front page, then a .DS_Store probe, then .env, then .git/config, then a VS Code SFTP config file. The busiest single scanner against us was LeakIX, which is a research crawler. Our edge-honeypot canaries fired zero times on the October PHP emergency across 23,877 decoy records in the window. The pressure is real and it is almost entirely commodity: automated inventory sweeps looking for a leaked credential file, run by nobody in particular, at a scale that keeps going up because it keeps being free.
Three instruments, three different answers, and all three are true at once. Disclosure is exploding. Exploitation is flat. Dumb traffic is climbing. You can build an apocalyptic post or a debunking post by picking one and not mentioning the other two. We've done that before and we'd rather not again.
So who could we actually have saved this month
That is the question we wanted to answer when we started, and it is the uncomfortable part, so here is the whole ledger rather than the flattering slice.
The million-record breaches are not on it. Capcom's CAPCOM ID service, at over 11.7 million accounts. Sony's So-net and plala. Educational Testing Service, 5.7 million students back to 2006. Nikkei, 1.83 million records. Japan's National Police Agency, around 125,000 officers via a cloud provider. Zeabur, 3.2 million environment-variable records taken with leaked internal credentials that were stored in plaintext. PingCap, entered with a stolen service account.
Not one of those would have been stopped by a threat feed, ours or anyone's. There is no indicator to block in a plaintext credential store. There is no IP address to deny when the attacker signs in as your own service account. Any vendor who tells a prospect their feed would have caught those is selling something, and the honest answer is that feeds are not the control that was missing. Secrets management was.
The ones we could have helped are smaller and much less exciting.
A developer about to install LiteLLM 1.107.0 on October 21 — the poisoned PyPI release and Docker image from a hijacked build workflow, which stole cloud credentials, AI provider keys, browser data, and environment variables, and which ran through Python startup hooks so merely installing it was enough. Our free package check answers block on that exact version today, as it does on the tensorlake 0.5.144 Shai-Hulud variant from October 8. One call, no key, before the install runs.
We want to be precise about what that is worth, because it would be easy to overstate. Both of those records reach us through OSV's curated malicious-package data. We are redistributing a public list, and anyone pulling OSV directly had the same coverage on the same day. The value we add is not early sight, it is that an AI coding agent can ask the question in a single call at the moment it matters, instead of nobody asking at all. That is distribution, not a scoop, and we are not going to dress it up as one.
An administrator running Nextcloud with Collabora's built-in CODE server. The attacks started around September 10. The Hacker News published administrator logs naming the source IP on October 14. We ingested that IP into the feed on October 15 at 80 confidence, tagged as a PHP web shell, with the reference attached. CISA added CVE-2026-110447 to KEV on October 23. So a defender pulling our blocklist had a blockable indicator eight days before the federal order existed.
And here is the part that keeps that sentence honest: our own record for that IP says, in its own description field, "Third-party reporting, not a DugganUSA observation." We were one day behind The Hacker News, not eight days ahead of anyone. The eight-day figure is real and it is worth something to a small shop that does not read vendor blogs all day — but it measures the lag in the federal catalog, not our eyesight. We have published a correction before for exactly this inversion, citing our own ingest time as a lead over the researchers we ingested from, and we are not doing it twice.
Where we genuinely were early. Our exploit harvester indexes public proof-of-concept code from GitHub automatically. In the last seven days it held a working PoC for five of the six CVEs CISA KEV'd, a median of five days before the listing: the two PHP flaws by five and four days, the Brotli bug by five, and an Adobe Commerce flaw by thirty — harvested September 26, catalogued October 27.
That is a first-party receipt and we will defend it, with the limit stated plainly: the PoC was public. We did not find anything nobody else could see. We looked automatically and continuously at a place the federal catalog takes a median of five days to catch up with, which is a real service and a much more modest claim than "we saw it first."
Where we were flatly late or absent. BeyondTrust Remote Support, CVE-2026-102764: exploited by a China-nexus actor since August 29, KEV'd October 16, and our post went up October 18 — two days after the catalog and seven weeks after the intrusion. Not a lead by any reading. Ivanti Connect Secure CVE-2026-104935, KEV'd October 13 against fully patched appliances: we have no blog post and no indicator, a clean miss on one of the month's more serious bugs. Arista VeloCloud Orchestrator CVE-2026-114625, KEV'd October 23: our own lead ledger records it with no receipt at all, which is the ledger working as designed.
Three misses, named, in the same post as the wins. The ledger is worthless if it only runs one direction.
What we think this means
The useful reframe is that "patch faster" stopped being the bottleneck somewhere around August. At 569 disclosures a day, nobody is patching the flood; everybody is sampling it. The scarce resource is a defensible reason to not look at 568 of them.
Which is why we would rather spend our effort on the boring middle of the funnel than the headline end of it. The gap between a working exploit being public and the federal catalog saying so is a median of five days. The gap between a malicious package appearing and a developer's agent being able to ask about it should be zero calls and zero dollars. Neither of those is a scoop. Both of them are a defender not getting owned on a Tuesday.
Limits on everything above
KEV is CISA's curated selection and it has its own throughput ceiling, so a flat KEV line is firmly a measurement of what defenders were ordered to fix, and only loosely a measurement of exploitation in the world. Real exploitation is unobservable in aggregate and anyone who gives you a clean number for it is estimating.
Two instrument artifacts we are flagging rather than reading as findings. CISA has recorded zero KEV entries with known ransomware campaign use in September and October, after two to nine every month from April through August. Ransomware did not stop in September; a field stopped being populated. And our own April and May edge figures sit under a different blocking configuration, so they are excluded above rather than compared — the drop between May and June is our configuration changing, not the internet calming down.
Our April-to-October edge comparison is ours alone and nobody can reproduce it from the outside, which makes it the weakest number here even though it is the one we measured most directly. The two public series can be re-pulled by anyone in about four minutes: NVD's 2.0 API by publication date, and CISA's KEV JSON, catalog version 2026.10.27, 1,760 entries, both read on October 28.
Five percent of this is wrong somewhere. It always is.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments