Scope and method. Every incident here was first reported, disclosed, confirmed or added to CISA's Known Exploited Vulnerabilities catalog between Oct 15 and Oct 22, 2026. The list started from this week's "Black October" coverage (BusinessToday, SecurityToday) and CISA's KEV alerts for Oct 15, 16 and 20. Each item was then checked against a primary source (vendor advisory, government alert, company notice, or researcher write-up) or established security reporting (BleepingComputer, The Record, The Hacker News, SecurityWeek, Help Net Security, Cybersecurity Dive, TechCrunch, Ars Technica, CTV). Some incidents happened earlier and were only disclosed this week (for example Paradigm, Tor relays, PingCAP); those are dated by disclosure. Figures are as reported at the time of writing and can change as investigations continue.
Lower-confidence items. The HTTP/3 "Header Accordions" figures (7 of 10 stacks, ~4,000x amplification) come from secondary coverage of FoxIO's research; I could not reach the original write-up. The Railway-linked $371K crypto theft is an on-chain researcher's attribution and Railway has not confirmed it. The ~7M California student count comes from Politico/EdSource; the state has not confirmed a total.
Lower-confidence items. The HTTP/3 "Header Accordions" figures (7 of 10 stacks, ~4,000x amplification) come from secondary coverage of FoxIO's research; I could not reach the original write-up. The Railway-linked $371K crypto theft is an on-chain researcher's attribution and Railway has not confirmed it. The ~7M California student count comes from Politico/EdSource; the state has not confirmed a total.