Today’s readings
Eight readings from seven public feeds, taken at 06:00 IST. Each card says what the number means for someone defending an organisation.
Global threat level
Normal. No new threat is spreading widely enough to change the level.
31.5 million attack records logged by ISC sensors on 16 October, up 18% on the week’s median.
Most-scanned ports
- 80 · web servers (HTTP)
- 443 · web servers (HTTPS)
- 22 · SSH remote login
- 23 · Telnet, old unencrypted remote login
- 2222 · SSH on an alternative port
Where internet-wide scanners knocked most. Anything of yours on these ports is being tried.
Newly exploited flaws
- CVE-2025-61624 · Fortinet Multiple Products
- CVE-2026-102764 · BeyondTrust Remote Support
- CVE-2026-21589 · Atlassian Multiple Products
- CVE-2026-0322 · Palo Alto Networks PAN-OS
- CVE-2026-105133 · Ahsay AhsayCBS
- CVE-2026-105134 · Ahsay AhsayCBS
Flaws CISA has confirmed are being exploited in the wild. Patch these before anything else.
How widely is this software deployed? See each vendor’s footprint on Bitsight Groma: Fortinet · BeyondTrust · Atlassian · Palo Alto Networks · Ahsay.
Likeliest to be exploited
- CVE-2026-110957 · 3.5% chance in 30 days
- CVE-2020-37282 · 3.0% chance in 30 days
- CVE-2026-110640 · 2.7% chance in 30 days
- CVE-2026-110635 · 2.5% chance in 30 days
- CVE-2026-110636 · 2.3% chance in 30 days
Of this week’s critical CVEs, the five EPSS rates likeliest to be used by attackers next.
New CVEs, last 24 hours
Vulnerabilities published to the National Vulnerability Database in the 24 hours to this morning’s refresh.
ICS advisories this week
- CISA Malcolm
- Eclipse Foundation Eclipse Milo
- Guangzhou Juan IoT Technology EseeCloud
- Inductive Automation Ignition Software
CISA advisories for plant, building and medical-device systems. For OT and facilities teams.
Internet outages by country
- Lithuania · 7 days
- Armenia · 9 days
- Papua New Guinea · 9 days
- Us Virgin Islands · 4 h
- Barbados · 6 days
Outages active in the last 24 hours. Causes range from cable cuts and power to shutdowns and attacks.
Microsoft Patch Tuesday
Last release: October 2026 Security Updates, 13 October. Microsoft publishes its fixes on the second Tuesday of each month.
The last seven days
Bars show attack records logged by sensors each day; the figure under each is the number of flaws CISA confirmed as exploited that day. Red marks a day with a ransomware-linked addition.
What to do today
- Check whether you run Fortinet Multiple Products, BeyondTrust Remote Support: newly confirmed as exploited in the wild.
- Port 23, Telnet, old unencrypted remote login, is among the five most-scanned today. Make sure nothing of yours answers on it. Check your domain →
- OT and plant teams: CISA published 5 industrial control system advisories this week.
Sources
| Source | What it gives | Terms |
|---|---|---|
| SANS Internet Storm Center (DShield) | Infocon level, daily attack records, most-targeted ports | Used with credit under the ISC’s terms (CC BY-NC-SA 4.0); not resold. |
| CISA Known Exploited Vulnerabilities catalogue | Flaws confirmed as exploited in the wild, with ransomware use and federal due dates | US Government work, public domain. |
| NIST National Vulnerability Database | CVEs published in the last 24 hours; critical CVEs this week | This product uses the NVD API but is not endorsed or certified by the NVD. |
| FIRST Exploit Prediction Scoring System (EPSS) | Probability that each of this week’s critical CVEs is exploited in the next 30 days | Free to use with credit to FIRST. |
| CISA ICS advisories | Advisories for industrial control system and medical device products | US Government work, public domain. |
| IODA, Georgia Institute of Technology | Internet outages detected by country | Research data, used with credit. Shown by country only. |
| Bitsight Groma Explorer | Where each exploited vendor’s software is deployed across the internet, linked from the flaws card | Linked, not reproduced: Groma’s figures stay on bitsight.com under its terms of use. |
| Microsoft Security Response Center | Date and name of the latest monthly security release | Public API. |
Indicative only, and not a measure of any organisation’s risk. Cyber Weather reports aggregate, public signals; it names no affected organisation. Product vendors appear only where CISA lists their software as exploited.
Questions this page answers
- What is today’s cyber threat level?
- BitScore’s Cyber Weather reads Cloudy for 16 October 2026. It is worked out every morning at 06:00 IST from public feeds: SANS ISC’s Infocon level, flaws CISA added to its Known Exploited Vulnerabilities catalogue, critical CVEs published in the last 24 hours, and the day’s attack traffic against its usual level.
- Does Cyber Weather measure my organisation’s risk?
- No. It describes conditions for everyone on the internet, the way a weather forecast describes the sky rather than your roof. Your own exposure depends on what you run and how it is configured, which an external security rating or a domain check measures.