{ "dataResearch": { "snapshot": "2026-10-22", "quarterly": [ { "quarter": "2024-Q1", "cvePublished": 8697, "kevAdded": 40 }, { "quarter": "2024-Q2", "cvePublished": 11716, "kevAdded": 33 }, { "quarter": "2024-Q3", "cvePublished": 8591, "kevAdded": 58 }, { "quarter": "2024-Q4", "cvePublished": 11073, "kevAdded": 55 }, { "quarter": "2025-Q1", "cvePublished": 12009, "kevAdded": 73 }, { "quarter": "2025-Q2", "cvePublished": 11701, "kevAdded": 59 }, { "quarter": "2025-Q3", "cvePublished": 11738, "kevAdded": 51 }, { "quarter": "2025-Q4", "cvePublished": 12796, "kevAdded": 62 }, { "quarter": "2026-Q1", "cvePublished": 15163, "kevAdded": 71 }, { "quarter": "2026-Q2", "cvePublished": 20709, "kevAdded": 75 } ], "monthly": [ { "month": "2024-01", "cvePublished": 2594, "kevAdded": 21, "cveCumulativeSince2024": 2594, "partial": false }, { "month": "2024-02", "cvePublished": 2778, "kevAdded": 9, "cveCumulativeSince2024": 5372, "partial": false }, { "month": "2024-03", "cvePublished": 3309, "kevAdded": 10, "cveCumulativeSince2024": 8681, "partial": false }, { "month": "2024-04", "cvePublished": 3621, "kevAdded": 10, "cveCumulativeSince2024": 12302, "partial": false }, { "month": "2024-05", "cvePublished": 4999, "kevAdded": 14, "cveCumulativeSince2024": 17301, "partial": false }, { "month": "2024-06", "cvePublished": 3078, "kevAdded": 9, "cveCumulativeSince2024": 20379, "partial": false }, { "month": "2024-07", "cvePublished": 3113, "kevAdded": 14, "cveCumulativeSince2024": 23492, "partial": false }, { "month": "2024-08", "cvePublished": 2896, "kevAdded": 19, "cveCumulativeSince2024": 26388, "partial": false }, { "month": "2024-09", "cvePublished": 2514, "kevAdded": 25, "cveCumulativeSince2024": 28902, "partial": false }, { "month": "2024-10", "cvePublished": 3564, "kevAdded": 17, "cveCumulativeSince2024": 32466, "partial": false }, { "month": "2024-11", "cvePublished": 4056, "kevAdded": 22, "cveCumulativeSince2024": 36522, "partial": false }, { "month": "2024-12", "cvePublished": 3431, "kevAdded": 16, "cveCumulativeSince2024": 39953, "partial": false }, { "month": "2025-01", "cvePublished": 4275, "kevAdded": 14, "cveCumulativeSince2024": 44228, "partial": false }, { "month": "2025-02", "cvePublished": 3673, "kevAdded": 27, "cveCumulativeSince2024": 47901, "partial": false }, { "month": "2025-03", "cvePublished": 3998, "kevAdded": 32, "cveCumulativeSince2024": 51899, "partial": false }, { "month": "2025-04", "cvePublished": 4034, "kevAdded": 15, "cveCumulativeSince2024": 55933, "partial": false }, { "month": "2025-05", "cvePublished": 3980, "kevAdded": 24, "cveCumulativeSince2024": 59913, "partial": false }, { "month": "2025-06", "cvePublished": 3681, "kevAdded": 20, "cveCumulativeSince2024": 63594, "partial": false }, { "month": "2025-07", "cvePublished": 3776, "kevAdded": 20, "cveCumulativeSince2024": 67370, "partial": false }, { "month": "2025-08", "cvePublished": 3628, "kevAdded": 15, "cveCumulativeSince2024": 70998, "partial": false }, { "month": "2025-09", "cvePublished": 4321, "kevAdded": 16, "cveCumulativeSince2024": 75319, "partial": false }, { "month": "2025-10", "cvePublished": 4273, "kevAdded": 31, "cveCumulativeSince2024": 79592, "partial": false }, { "month": "2025-11", "cvePublished": 3021, "kevAdded": 11, "cveCumulativeSince2024": 82613, "partial": false }, { "month": "2025-12", "cvePublished": 5491, "kevAdded": 20, "cveCumulativeSince2024": 88104, "partial": false }, { "month": "2026-01", "cvePublished": 4302, "kevAdded": 17, "cveCumulativeSince2024": 92406, "partial": false }, { "month": "2026-02", "cvePublished": 4616, "kevAdded": 28, "cveCumulativeSince2024": 97022, "partial": false }, { "month": "2026-03", "cvePublished": 6234, "kevAdded": 26, "cveCumulativeSince2024": 103256, "partial": false }, { "month": "2026-04", "cvePublished": 5810, "kevAdded": 31, "cveCumulativeSince2024": 109066, "partial": false }, { "month": "2026-05", "cvePublished": 6936, "kevAdded": 21, "cveCumulativeSince2024": 116002, "partial": false }, { "month": "2026-06", "cvePublished": 7942, "kevAdded": 23, "cveCumulativeSince2024": 123944, "partial": false }, { "month": "2026-07", "cvePublished": 9770, "kevAdded": 26, "cveCumulativeSince2024": 133714, "partial": false }, { "month": "2026-08", "cvePublished": 12258, "kevAdded": 31, "cveCumulativeSince2024": 145972, "partial": false }, { "month": "2026-09", "cvePublished": 14933, "kevAdded": 43, "cveCumulativeSince2024": 160905, "partial": false }, { "month": "2026-10", "from": "2026-10-01", "through": "2026-10-21", "partial": true, "cvePublished": 12543, "kevAdded": 24, "cveCumulativeSince2024": 173448 } ], "models": [ { "date": "2024-05-13", "name": "GPT-4o", "access": "general availability", "url": "https://openai.com/index/hello-gpt-4o/" }, { "date": "2024-06-20", "name": "Claude 3.5 Sonnet", "access": "general availability (AWS dated launch)", "url": "https://aws.amazon.com/about-aws/whats-new/2024/06/anthropic-claude-3-5-sonnet-model-bedrock/" }, { "date": "2024-09-12", "name": "OpenAI o1-preview", "access": "preview", "url": "https://openai.com/index/introducing-openai-o1-preview/" }, { "date": "2025-01-20", "name": "DeepSeek-R1", "access": "open weights + API", "url": "https://api-docs.deepseek.com/news/news250120/" }, { "date": "2025-02-24", "name": "Claude 3.7 Sonnet", "access": "general availability; Claude Code research preview", "url": "https://www.anthropic.com/news/claude-3-7-sonnet" }, { "date": "2025-08-07", "name": "GPT-5", "access": "general availability", "url": "https://openai.com/index/introducing-gpt-5/" }, { "date": "2026-04-07", "name": "Claude Mythos Preview / Glasswing", "access": "restricted partner access", "url": "https://www.anthropic.com/glasswing" }, { "date": "2026-06-09", "name": "Claude Fable 5 / Mythos 5", "access": "general / restricted; suspended Jun 12, restored July 1", "url": "https://www.anthropic.com/news/claude-fable-5-mythos-5" }, { "date": "2026-07-09", "name": "GPT-5.6", "access": "general availability following limited preview", "url": "https://openai.com/index/gpt-5-6/" }, { "date": "2026-09-01", "name": "Claude Fable 5.1 / Mythos 5.1", "access": "general / restricted availability", "url": "https://aws.amazon.com/about-aws/whats-new/2026/09/claude-fable-5-1-aws/" }, { "date": "2026-09-03", "name": "GPT-6 Astra", "access": "staged rollout", "url": "https://openai.com/index/safety-overview-gpt-6-astra/" } ], "spending": { "publisher": "IDC", "edition": "2026-03-03", "url": "https://www.idc.com/resource-center/press-releases/wwsecuritysg/", "series": [ { "year": 2026, "usdMillions": 308000, "status": "forecast" }, { "year": 2029, "usdMillions": 430000, "status": "forecast" } ] }, "provenance": { "cve": { "source": "https://github.com/CVEProject/cve-website/blob/dev/src/assets/data/metrics.json", "blobSha": "48ef6548429e249e21a5947bd16ff6857bfc41d9", "commit": "f2b4f05012bbbe22905587c6d0c48e23767b1822", "note": "Official CVE website source; current metrics Q1 2026 is 15163 whereas May 12 quarterly blog says 15176. This snapshot consistently uses the metrics JSON; Q3/Q4 2026 TBA, not zero." }, "kev": { "source": "https://github.com/cisagov/kev-data/blob/fd12990e9c566a1ad3060e1a2073129778f438cc/known_exploited_vulnerabilities.csv", "blobSha": "2f6c0943b68f3edab4813ca3ed3642d1c4ac4789", "rows": 1754, "latestDateAdded": "2026-10-20", "note": "One row per CVE retained in current catalog; count by dateAdded. CISA official mirror, CC0. DateAdded is not first attack or incident date.", "commit": "fd12990e9c566a1ad3060e1a2073129778f438cc", "catalogVersion": "2026.10.21", "dateReleased": "2026-10-21T14:04:39.8983Z" }, "nvd": { "publisher": "NIST National Vulnerability Database", "source": "https://nvd.nist.gov/developers/vulnerabilities", "endpoint": "https://services.nvd.nist.gov/rest/json/cves/2.0", "retrievedAt": "2026-10-22T07:01:20.610899+00:00", "capturedFrom": "2026-10-22T06:53:14.923Z", "capturedThrough": "2026-10-22T07:01:20.491Z", "method": "CVE API 2.0 totalResults for publication timestamps within each inclusive UTC interval; noRejected excludes REJECT/Rejected CVEs; resultsPerPage=1 obtains the server aggregate without fetching full records.", "manifest": "raw/nvd/manifest.json", "files": [ "raw/nvd/2024-01.json", "raw/nvd/2024-02.json", "raw/nvd/2024-03.json", "raw/nvd/2024-04.json", "raw/nvd/2024-05.json", "raw/nvd/2024-06.json", "raw/nvd/2024-07.json", "raw/nvd/2024-08.json", "raw/nvd/2024-09.json", "raw/nvd/2024-10.json", "raw/nvd/2024-11.json", "raw/nvd/2024-12.json", "raw/nvd/2025-01.json", "raw/nvd/2025-02.json", "raw/nvd/2025-03.json", "raw/nvd/2025-04.json", "raw/nvd/2025-05.json", "raw/nvd/2025-06.json", "raw/nvd/2025-07.json", "raw/nvd/2025-08.json", "raw/nvd/2025-09.json", "raw/nvd/2025-10.json", "raw/nvd/2025-11.json", "raw/nvd/2025-12.json", "raw/nvd/2026-01.json", "raw/nvd/2026-02.json", "raw/nvd/2026-03.json", "raw/nvd/2026-04.json", "raw/nvd/2026-05.json", "raw/nvd/2026-06.json", "raw/nvd/2026-07.json", "raw/nvd/2026-08.json", "raw/nvd/2026-09.json", "raw/nvd/2025-10-01-21.json", "raw/nvd/2026-10-01-21.json" ], "note": "totalResults is the official API aggregate. Each retained response contains one sample CVE, not the full record set. Counts can change as NVD records are revised." } }, "methodology": [ "CVE publication counts do not count attacks, victim organizations, or vulnerability discovery dates.", "KEV catalog entry dates lag first exploitation; one CVE may affect many incidents.", "Model milestones are a selected timeline, not a census or scalar capability score. Public launch is not first research access; usage adoption and safeguards differ.", "No correlation coefficient between two cumulative series is reported; both mechanically trend with time.", "Quarterly series is official and ends 2026Q2. Do not manufacture monthly distributions.", "A selected headline event list cannot estimate global incident frequency. Use a consistent-scope incident dataset, deduplicate campaigns, distinguish occurrence/discovery/disclosure, report coverage and confidence.", "Security spending uses IDC March 3, 2026 forecasts for 2026 and 2029. Company costs and study averages retain their own scope and currency; they do not measure investment ROI." ], "incidentDatasets": [ { "name": "University of Maryland Cyber Events Database", "url": "https://gotech.umd.edu/research-impact/publications/cyber-events-database-home", "coverage": "2014–August 2026 as displayed 2026-10-22", "warning": "GDELT method expansion from January 2025; original_method can control collection method. GDELT outage June 14–July 1 2025 estimated 40–60 missing June records. Event_date differs from reported_date. Cannot treat raw pre/post rise as AI effect." }, { "name": "EuRepoC Global Dataset 1.3.2", "url": "https://zenodo.org/records/14965395", "coverage": "3416 incidents starting 2000-01-01 through 2024-12-31", "warning": "Stable release does not cover 2025–2026. Live TableView data may not be fully expert reviewed. Politically relevant incidents; not all global cybercrime." } ], "monthlyComparison": { "mode": "month-to-date", "timezone": "UTC", "previous": { "from": "2025-10-01", "through": "2025-10-21", "cvePublished": 2719, "kevAdded": 24 }, "current": { "from": "2026-10-01", "through": "2026-10-21", "cvePublished": 12543, "kevAdded": 24 }, "cveYoYPercent": 361.3093048915042, "kevYoYPercent": 0.0 } }, "eventResearch": { "asOf": "2026-10-22", "purpose": "Editorial evidence for Protico cybersecurity Lab; selected cases, not a statistical incident sample", "events": [ { "name": "PHP / PHP2Shell", "date": "2026-10-21", "type": "vulnerability_disclosure_and_patch", "dates": { "discovered": "2026-08-01", "firstReportedToVendor": "2026-08-11", "rcePocShared": "2026-08-14", "secondBugReported": "2026-08-21", "advanceAnnouncement": "2026-10-20", "patchReleased": "2026-10-21T13:30:00Z" }, "sourceUrls": [ "https://www.php.net/archive/2026.php", "https://calif.io/php2shell/", "https://cert.europa.eu/publications/security-advisories/2026-018/", "https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/", "https://www.wiz.io/blog/php2shell-php-rce" ], "zh": "PHP 10月21日修補 CVE-2026-109618 與 CVE-2026-109619，可能造成未經驗證遠端程式碼執行。修補版為8.2.35、8.3.36、8.4.27、8.5.12；CERT-EU記載發布時間13:30 UTC（台北21:30）。Calif於8月1日即發現相關問題，並非10月21日才產生漏洞。", "aiEvidence": { "status": "confirmed_defensive_research", "zh": "OpenAI官方明載Calif使用GPT-5.6 Sol發現關鍵漏洞；Wiz說明前沿模型協助研究與驗證攻擊可行性。不能因此推論所有實際攻擊由AI執行。" }, "limitations": [ "公開日、發現日、修補日不同，模型發布疊圖須考慮披露延遲。", "新聞中PHP市占並非實際遭入侵比例。" ] }, { "name": "eMudhra intermediate certificates", "date": "2026-10-20", "type": "certificate_trust_incident", "dates": { "mozillaReportReceived": "2026-10-17T20:06:00Z", "cloudflareAware": "2026-10-19T17:00:00Z", "mozillaPublicPost": "2026-10-20" }, "sourceUrls": [ "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/", "https://blog.cloudflare.com/emudhra-certificate-compromise/" ], "zh": "八張eMudhra中繼憑證對應弱私鑰引發信任撤銷及跨產品更新。Mozilla於10月17日收到報告，10月20日公告；不是TLS加密演算法全面失效。", "aiEvidence": { "status": "not_established", "zh": "未找到第一手AI發現或AI攻擊歸因。" }, "limitations": [ "八張憑證不是八宗獨立入侵。", "Cloudflare公告表示其服務未發現實際利用。", "與Node.js同次ca-cert更新存在相依關係，不可重複計算。" ] }, { "name": "Node.js October security release", "date": "2026-10-21", "type": "vulnerability_disclosure_and_patch", "sourceUrls": [ "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases" ], "zh": "Node.js 10月21日公告10項CVE（4高、3中、3低），另有依賴更新。CVE-2026-111497為Brotli解碼器遠端程式碼執行風險，影響22、24、26系列；修補版22.23.4、24.22.1、26.12.1。同次包含eMudhra憑證信任修復。", "aiEvidence": { "status": "not_established", "zh": "官方公告未指明AI參與。" }, "limitations": [ "官方最高嚴重度為HIGH，不能一概稱CRITICAL。", "10項CVE、一次公告、實際入侵宗數是不同計量單位。" ] }, { "name": "Zeabur October incident", "date": "2026-10-14", "type": "confirmed_intrusion_and_data_access", "dates": { "priorIncident": "2026-08-27", "incidentStart": "2026-10-14", "databaseRead": "2026-10-15" }, "sourceUrls": [ "https://zeabur.com/blogs/october-2026-security-incident", "https://zeabur.com/blogs/august-2026-security-incident", "https://status.zeabur.com/" ], "zh": "使用者口述Zebra應為Zeabur。官方10月初步調查確認攻擊者利用內部憑證存取系統，平台資料庫有3,218,965筆環境變數紀錄與321,810帳戶資料被讀取。10月報告修正8月所稱內部管理金鑰已全面輪換的不完整說法。", "aiEvidence": { "status": "ai_resources_targeted", "zh": "官方觀察攻擊者主要搜尋可直接使用的API金鑰，特別是AI服務金鑰；這不是AI執行攻擊的證據。" }, "limitations": [ "官方區分已確認、評估推斷、未確認範圍，引用不可合併為全部已外洩。", "兩次個案相距時間不能推算全球攻擊間隔。" ] }, { "name": "91APP Commerce Cloud", "date": "2026-10-16", "type": "confirmed_data_access_disclosure", "sourceUrls": [ "https://91app.com/blog/91app-202610-security/" ], "zh": "91APP於10月16日官方公告確認Commerce Cloud資料庫遭自動化攻擊，部分資訊遭非法擷取，已報警並啟動第三方調查及通知。", "aiEvidence": { "status": "not_established", "zh": "自動化攻擊不等同AI攻擊；官方該頁未提供AI歸因。" }, "limitations": [ "官方該公告未證實金鑰外洩，也未公布可比較的外洩總量。", "本列date採官方公告日，不宣稱為首次入侵時間。" ] }, { "name": "Railway environment variables", "date": "2026-10-21", "type": "suspected_unauthorized_access_under_investigation", "sourceUrls": [ "https://blog.railway.com/p/security-disclosure-wednesday-october-21st" ], "zh": "Railway於10月21日披露當日上午偵測異常，第三方可能取得加密環境變數與其中部分明文；建議所有使用者預防性輪換所存憑證並檢查使用紀錄。調查仍在進行。", "aiEvidence": { "status": "vendor_assessment_ai_resources_targeted", "zh": "Railway認為事件屬近期以AI inference providers為目標的平台攻擊系列之一；需保留這是官方初步判斷的語氣。" }, "limitations": [ "不能稱全部客戶明文已外洩。", "未確認與Zeabur為同一攻擊者。", "以AI服務為目標不等於用AI執行攻擊。" ] }, { "name": "Japan prime minister PHP warning", "date": "2026-10-21", "type": "public_policy_response_not_separate_incident", "sourceUrls": [ "https://x.com/takaichi_sanae/status/2112890642590564386" ], "zh": "高市早苗10月21日於本人X帳號呼籲檢查PHP及準備套用安全更新。可稱國家領導人公開呼籲，不宜寫成全球史上首次首相資安告警或正式全國緊急命令。", "aiEvidence": { "status": "not_applicable", "zh": "政策回應，不是另一件漏洞或入侵。" }, "limitations": [ "Do not claim this is the first such warning worldwide. Original public X post directly inspected and captured on 2026-10-22." ] } ], "methodologyLimitations": [ "此為編輯選取案例，不代表全球事件母體，不計算案例間平均間隔或趨勢。", "漏洞揭露數、已利用漏洞數、實際入侵事件數、新聞篇數分開統計。", "發現、通報、公開、修補日期分開紀錄；不能以公開日作為漏洞誕生日期。", "模型發布與公開通報的同步上升本身不構成因果證據。", "AI協助防禦研究、AI資源成為攻擊目標、AI執行攻擊須獨立編碼。", "Protico三小時內通知所有客戶的說法需以起始來源時區及首次、批次開始、全部寄送完成紀錄分別核對。" ], "eurepoc": { "status": "candidate_source_current_series_not_retrieved", "sourceUrls": [ "https://eurepoc.eu/database/", "https://eurepoc.eu/methodology/", "https://eurepoc.eu/table-view/", "https://database.eurepoc-dashboard.eu/", "https://zenodo.org/records/14965395" ], "stableDataset": { "version": "1.3.2", "published": "2025-03-04", "coverageEnd": "2024-12-31", "incidentCount": 3416, "coverageStart": "2000-01-01" }, "zh": "官方提供可重現靜態資料及最新TableView匯出。已核實靜態1.3.2僅完整涵蓋2000–2024，不能用以計算2025–2026趨勢；最新TableView須另匯出且資料尚未完整專家審核。本輪讀取動態iframe無資料列，因此未取得2024–2026一致序列、不報頻率數字。", "scope": "公開報導、已破壞機密性/完整性/可用性的事件；主要含政治相關事件，2023年2月起增加關鍵基礎設施事件。", "limitations": [ "不是全球所有資安事件普查，排除許多未公開事件及未涉及政治或關鍵基礎設施的商業勒索事件。", "主資料集每事件一列；receiver、attribution、dyadic資料可能一事件多列，需依incident_id去重。", "保留快照日期與版本；近期資料受通報延遲、右端截尾及後續修訂影響。", "取得可核實完整序列前，不推算重大事件間隔由幾天縮至幾天。" ] } }, "reportVersion": "1.6", "cutoff": "2026-10-22", "notificationEvidence": { "status": "sent-notifications-reviewed", "threeHourClaim": "founder-reported; unverified starting timestamp, timezone and full batch completion; not independently substantiated" }, "editorialRevision": "2026-10-22: third-person four-language reporting, Taiwan-to-international case narrative, institution-attributed spending and costs, Gmail compose and attribution-ready media reference pack.", "chartRendering": { "monthlyOverlay": "Trailing three-month arithmetic mean; first two points use available months.", "cumulativeOverlay": "Cumulative count since January 2024.", "interpolation": "Shape-preserving cubic through trend samples.", "modelMarkers": "Calendar release/access dates on x-axis; attached at interpolated curve position.", "hero": "Observed monthly CVE counts, January 2024 to September 2026." }, "financialOutlook": { "checkedAt": "2026-10-22", "sources": [ { "id": "idc-spending-2026-03", "publisher": "IDC", "title": "Global Security Spend to Exceed $300 Billion in 2026 as the Adoption of AI-Driven Security Platforms Gains Momentum", "url": "https://www.idc.com/resource-center/press-releases/wwsecuritysg/", "publishedAt": "2026-03-03", "type": "forecast", "scope": "Worldwide security spending; IDC Worldwide Security Spending Guide covers core and next-generation security across 28 industries, five company sizes, 38 technology markets and 48 countries.", "metrics": [ { "year": 2026, "value": 308, "unit": "USD billion", "status": "forecast" }, { "year": 2029, "value": 430, "unit": "USD billion", "status": "forecast" }, { "year": 2026, "value": 11.8, "unit": "percent YoY", "status": "forecast" } ], "shortQuote": "Global security spending is projected to reach $308 billion in 2026 and $430 billion by 2029", "copyZh": "IDC 在 2026 年 3 月預估，全球資安支出將從 2026 年的 3,080 億美元，增加到 2029 年的 4,300 億美元。", "caution": "Both numbers are the March 2026 forecast vintage, not year-end actuals or necessarily the newest paid forecast. Do not mix with Gartner series or the undated IDC event-page update." }, { "id": "idc-2027-event-update", "publisher": "IDC", "title": "IDC IT Security Summit, 2027 Series", "url": "https://www.idc.com/mea/events/become-a-sponsor/it-security/", "publishedAt": null, "type": "forecast-on-official-event-page", "metrics": [ { "year": 2027, "value": 361.9, "unit": "USD billion", "status": "forecast" }, { "year": 2030, "value": 512.9, "unit": "USD billion", "status": "forecast" }, { "year": 2027, "value": 12.4, "unit": "percent YoY", "status": "forecast" } ], "scope": "Page attributes figures collectively to IDC Worldwide Security Spending Guide 2026 and several other IDC forecasts and surveys.", "caution": "Official and accessible on 2026-10-22, but publication date and exact guide vintage are not supplied. Treat as additional context; do not append these values to the March 2026 series as if one version." }, { "id": "gartner-total-2026-02", "publisher": "Gartner", "title": "Forecast Analysis: Information Security, Worldwide, 2026", "url": "https://www.gartner.com/en/documents/7408930", "publishedAt": "2026-02-05", "type": "forecast", "metrics": [ { "year": 2026, "value": 244, "unit": "USD billion", "status": "forecast" }, { "year": 2026, "value": 11.6, "unit": "percent constant-currency growth", "status": "forecast" } ], "shortQuote": "Spending on information security is expected to grow to $244 billion in 2026", "caution": "A more recent Gartner update exists (2026-09-24) but its public abstract has no numeric total. Do not call this February number Gartner's latest forecast." }, { "id": "gartner-latest-public-abstract-2026-09", "publisher": "Gartner", "title": "Forecast: Information Security, Worldwide, 2024-2030, 3Q26", "url": "https://www.gartner.com/en/documents/8422113", "publishedAt": "2026-09-24", "type": "forecast-abstract-only", "metrics": [], "caution": "Latest located official Gartner forecast. Public abstract states continued growth and its drivers but does not publish annual monetary totals. Do not extract paywalled figures from unofficial blogs and present them as independently checked primary data." }, { "id": "gartner-securing-ai-2026-08", "publisher": "Gartner", "title": "Gartner Forecasts the Market for Securing AI Will Reach $4.8 Billion in 2027", "url": "https://www.gartner.com/en/newsroom/press-releases/2026-08-26-gartner-forecasts-the-market-for-securing-ai-will-reach-almost-5-billion-in-2027", "publishedAt": "2026-08-26", "type": "forecast", "scope": "Market for securing AI; a subset, NOT all information-security spending and NOT all AI-enabled security products.", "metrics": [ { "year": 2026, "value": 2.835, "unit": "USD billion", "status": "forecast" }, { "year": 2027, "value": 4.783, "unit": "USD billion", "status": "forecast" }, { "year": 2028, "value": 7.7, "unit": "USD billion", "status": "approximate forecast" }, { "year": 2027, "value": 68.7, "unit": "percent YoY", "status": "forecast" } ], "copyZh": "資安預算也開始分出一塊，用來保護 AI 本身。Gartner 於 2026 年 8 月預估，這個市場將從 2026 年約 28 億美元，增加到 2028 年約 77 億美元。", "caution": "Keep this subset separate from overall spending. The same release predicts access-control weaknesses and prompt injection will account for over half of successful attacks on AI agents by 2029; this is a prediction, not observed attack prevalence." }, { "id": "ibm-codb-2026", "publisher": "IBM / Ponemon Institute", "title": "IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average", "url": "https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average", "publishedAt": "2026-07-29", "type": "observational-study", "period": "2025-03 to 2026-02", "sampleSize": 602, "scope": "602 breached organizations globally. Study conducted by Ponemon Institute, sponsored and analyzed by IBM. Follow-on May 2026 survey had 456 responses and is a separate sample.", "metrics": [ { "value": 4.99, "unit": "USD million per breach", "status": "sample mean, all studied breaches" }, { "value": 6, "unit": "USD million per breach", "status": "sample mean, AI-enabled malicious breaches" }, { "value": 25, "unit": "percent", "status": "approximately one in four malicious breaches were AI-enabled" } ], "shortQuote": "these breaches cost an average of $6 million", "copyZh": "IBM 與 Ponemon 調查 602 家曾發生資料外洩的組織，平均每次損失為 499 萬美元；其中，使用 AI 的惡意攻擊平均成本達 600 萬美元。調查涵蓋 2025 年 3 月至 2026 年 2 月的事件。", "caution": "Sample averages, not global aggregate losses, a forecast for a particular firm, or proof that AI caused the cost difference. Do not say 25% of all businesses were attacked by AI." }, { "id": "ibm-codb-2025-comparator", "publisher": "IBM", "title": "IBM Report: UK Sees Drop in Breach Costs as AI Speeds Detection", "url": "https://uk.newsroom.ibm.com/2025-cost-of-data-breach-UK", "publishedAt": "2025-07-30", "type": "observational-study", "metrics": [ { "value": 4.44, "unit": "USD million per breach", "status": "global sample mean in 2025 edition" } ], "caution": "Possible two-year comparison: 2025 edition 4.44 to 2026 edition 4.99. Separate annual samples; avoid a causal claim. Keep main emphasis on 2026." }, { "id": "marks-spencer-fy2026", "publisher": "Marks & Spencer Group plc", "title": "Full Year Results for the 52 Weeks Ended 28 March 2026", "url": "https://corporate.marksandspencer.com/newsroom/press-releases/full-year-results-52-weeks-ended-28-march-2026", "supportingUrls": [ "https://corporate.marksandspencer.com/sites/marksandspencer/files/2026-05/fy26-rns.pdf#page=37", "https://corporate.marksandspencer.com/sites/marksandspencer/files/2026-05/m-and-s-2026-full-year-results.pdf#page=21" ], "publishedAt": "2026-05-20", "type": "company-results", "period": "52 weeks ended 2026-03-28", "metrics": [ { "value": 131.3, "unit": "GBP million", "status": "incident-related costs in adjusting items" }, { "value": 100, "unit": "GBP million", "status": "insurance proceeds separately recorded centrally in adjusted profit" } ], "shortQuote": "£131.3m of incident-related costs", "scopeQuote": "£109.3m of these costs related to immediate incident systems response and recovery.", "costComponents": [ { "value": 109.3, "unit": "GBP million", "description": "Immediate incident systems response and recovery" }, { "value": 22.0, "unit": "GBP million", "description": "Third-party specialist corporate costs, predominantly legal and professional services support" } ], "scopeDetails": "RNS note 3 (printed p.37) describes the total as system recovery, risk management and specialist advisory costs caused directly by the incident. Costs are adjusting items because those response and recovery activities would not have been incurred without the incident. The £131.3m figure is not lost revenue, all operating-profit decline, or a complete incident-loss total; the source separately discusses online trading disruption, stock-flow restrictions, markdown and clearance impacts. Insurance is other operating income, managed centrally and not allocated to segments (RNS p.34).", "copyZh": "M&S 在截至 2026 年 3 月的年度財報中，認列 1.313 億英鎊的事件相關成本，另列 1 億英鎊保險理賠。這還不是停業、銷售變化等影響的完整總額。", "caution": "This supersedes using its earlier £300m forecast as an actual final loss. Do not call £31.3m the net total loss; insurance is recorded differently and direct recovery costs do not include every trading impact." }, { "id": "jlr-q3-fy2026", "publisher": "JLR", "title": "JLR Q3 Performance Impacted by Previously Indicated Challenges", "url": "https://www.jlr.com/news/2026/02/jlr-q3-performance-impacted-previously-indicated-challenges", "publishedAt": "2026-02-05", "type": "company-results", "period": "three months ended 2025-12-31", "metrics": [ { "value": 64, "unit": "GBP million", "status": "cyber-incident-related exceptional costs in this quarter" } ], "shortQuote": "£64m of costs related to the cyber incident", "copyZh": "JLR 於 2026 年 2 月公布，前一季再認列 6,400 萬英鎊的網攻相關成本。公司表示，停產後直到 11 月中，生產才恢復正常。", "caution": "Quarter only, not total incident cost. Company revenue/profit declines also reflect tariffs, China market conditions and Jaguar model phase-out; do not attribute full changes to the attack." }, { "id": "jlr-annual-2026", "publisher": "JLR", "title": "Annual Report 2026", "url": "https://www.jlr.com/annual-report-2026", "publishedAt": null, "type": "company-annual-report", "period": "FY25/26", "metrics": [ { "value": 5, "unit": "weeks", "status": "production paused before restarting 2025-10-08" } ], "shortQuote": "Production was paused for five weeks", "copyZh": "JLR 的 2026 年年報記錄，事件使生產暫停五週，10 月 8 日開始復工，直到 11 月中才恢復正常。" }, { "id": "fbi-ic3-2025", "publisher": "FBI Internet Crime Complaint Center", "title": "2025 IC3 Annual Report", "url": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf", "publishedAt": "2026-04", "type": "reported-complaints", "period": "calendar 2025", "metrics": [ { "value": 20.877, "unit": "USD billion", "status": "all reported losses, individuals and organizations, not enterprise-only" }, { "value": 3046598558, "unit": "USD", "status": "business email compromise reported losses" }, { "value": 24768, "unit": "complaints", "status": "business email compromise complaints" } ], "copyZh": "2025 年，FBI IC3 收到的商務電子郵件詐騙通報，合計損失約 30.5 億美元。這是向 IC3 通報的金額，涵蓋企業與個人，並非全球企業損失總額。", "caution": "PDF p. 8 has BEC losses, p. 62 has methodology. IC3 is voluntary reporting and includes individuals. Ransomware losses omit business interruption, wages and recovery services; do not compare its ransomware total against IBM means or company costs as equivalent measures." }, { "id": "pwc-dti-2027", "publisher": "PwC", "title": "2027 Global Digital Trust Insights: C-suite playbook and findings", "url": "https://www.pwc.com/us/en/services/consulting/cybersecurity-data-tech-risk/library/global-digital-trust-insights.html", "publishedAt": "2026-10-01", "type": "survey", "sampleSize": 3934, "scope": "Business and technology leaders across 71 countries. Different percentages refer to respondent subgroups.", "shortQuote": "Among security and finance leaders, 84% expect budgets to increase", "metrics": [ { "value": 84, "unit": "percent", "status": "security and finance leaders expecting budget increases" }, { "value": 39, "unit": "percent", "status": "security, risk and operations leaders with fully formalised and integrated cyber-specific operational-continuity plans" }, { "value": 22, "unit": "percent", "status": "respondents willing to authorise fully autonomous AI defensive actions" } ], "copyZh": "2026 年 10 月公布的 PwC 調查中，84% 的資安與財務主管預期增加預算；但只有 39% 的資安、風險與營運主管，已完整整合針對網攻的營運持續計畫。", "caution": "Plans and survey responses are not realized 2027 spending or measured control effectiveness. The two percentages have different respondent groups." } ], "crossSourceRules": [ "No loss divided by global security spend as ROI or effectiveness.", "No single chart axis for global annual spend, average breach cost and company incident costs.", "Keep USD and GBP labels; do not silently convert.", "Separate report publication date, event period, forecast year and retrieval date.", "Do not inflate source-vendor forecasts into observed results or present editorial 2027-2031 scenarios as source forecasts.", "Avoid the old 2024/2025/2026 Gartner July 2025 chart as the headline; it is an obsolete edition for this editorial goal." ] }, "postVisual": { "source_url": "https://x.com/takaichi_sanae/status/2112890642590564386", "source_platform": "X", "source_author": "高市早苗 (@takaichi_sanae)", "source_publication_date": "2026-10-21", "captured_at_utc": "2026-10-22T05:31:31.008675+00:00", "asset": "dist/assets/takaichi-php-post.jpg", "mime_type": "image/jpeg", "sha256": "0a94b12d8d394ca41960f0caa1cee020cc585b496fa1a1961dabd3dd2b5862a3", "capture_method": "Direct browser screenshot of the public original X post, using the in-app browser. No login, DOM changes, fabricated UI, image generation, or third-party news image.", "browser_viewport_css_pixels": { "width": 1280, "height": 720 }, "crop_css_pixels": { "x": 278, "y": 52, "width": 600, "height": 524 }, "capture_scope": "Account name and handle, complete original Japanese post text, and displayed publication date. Peripheral X navigation, signup panel, and comments cropped out.", "displayed_time": "下午8:55 · 2026年10月21日 (browser locale zh-tw; do not present this as Japan local time)", "verified_content_summary": "The post asks website operators to check whether they use PHP and prepare to promptly apply patches to be released on 2026-10-21 at 23:00 Japan time for two serious vulnerabilities. It suggests temporarily stopping websites as one possible risk-reduction measure when prompt patching is difficult and links to @cyber_forecast.", "recommended_caption_zh_Hant": "高市早苗於 2026 年 10 月 21 日在 X 提醒網站管理者，為當晚釋出的 PHP 修補做好準備。原貼文截圖，擷取於 10 月 22 日。", "notes": [ "Original dark X screenshot is unchanged apart from cropping.", "Timestamp area appears darker because of the original X page overlay gradient.", "Engagement counts are transient and should not be used as report findings." ] }, "enterpriseGuidance": { "reviewedAt": "2026-10-22", "purpose": "Publication-ready editorial recommendations for the Protico Labs cybersecurity feature; this does not amend any customer contract or company policy.", "locales": { "zh-Hant": { "eyebrow": "服務政策與用戶溝通", "title": "資安預算要跟上，對用戶的承諾也要跟上。", "intro": "資安事件也牽動企業與用戶之間的責任和信任。Protico 關注服務條款、隱私說明與內部流程如何回應這些變化，並依 NIST、CISA 等機構的公開指引，整理通知、權責與支援管道的五個面向。", "cards": [ { "id": "notice", "title": "重新與客戶、用戶確認事件應對策略。", "body": "與客戶和用戶重新確認事件發生時的標準應對流程：什麼情況啟動、誰負責處理、透過哪個管道聯絡，以及何時提供後續消息。服務中斷時，也要能找到聯絡窗口，掌握影響範圍與處理進度。", "sourceIds": [ "nist-ir-2025" ] }, { "id": "responsibility", "title": "把彼此要做的事寫清楚。", "body": "公司負責哪些安全更新、帳號保護與資料維護？用戶何時需要更新裝置、重設憑證或確認異常登入？用簡單例子說明，讓條款能真的拿來用。", "sourceIds": [ "cisa-secure-design-2023" ] }, { "id": "ai", "title": "持續掌握第三方工具的資安規範與標準。", "body": "持續檢視第三方服務與 AI 工具的資安要求、資料用途、存取權限，以及事件通知與支援安排。供應商調整功能、條款或安全措施時，同步確認對現有使用方式的影響，更新內部規則與應對流程。", "sourceIds": [ "nist-genai-2024", "nist-csf-2024" ] }, { "id": "support", "title": "讓受影響的人知道怎麼求助。", "body": "把帳號復原、資料查詢、更正或刪除的申請方式，以及申訴管道放在容易找到的地方。更新條款時，也要保留用戶依法享有的權益。", "sourceIds": [ "taiwan-pdpa-operative" ] }, { "id": "practice", "title": "和同事一起走一遍流程。", "body": "用真實工作情境練習：收到可疑訊息、帳號被接管，或供應商發出警報時，誰先接手？客服、產品、法務和資安一起演練，再把卡住的地方改掉。", "sourceIds": [ "ncsc-exercises" ] } ], "closing": "Protico Community Intelligence 將分散在社群裡的訊號整理成企業可追蹤的資訊，協助負責團隊查證與回應，讓對外承諾接上日常作業。", "sourceLabel": "服務政策與溝通指引來源" }, "en": { "eyebrow": "SERVICE POLICY & USER COMMUNICATION", "title": "Update your security budget—and your promises to users.", "intro": "Security incidents affect the responsibilities and trust between businesses and their users. Protico examines how terms, privacy notices and internal processes address these changes. The five areas below draw on published guidance from NIST, CISA and other institutions.", "cards": [ { "id": "notice", "title": "Reconfirm the incident response plan with customers and users.", "body": "Review the standard response process with customers and users: what triggers it, who takes responsibility, how to get in touch and when updates will follow. Keep a contact route available during outages so people can follow the impact and response progress.", "sourceIds": [ "nist-ir-2025" ] }, { "id": "responsibility", "title": "Make everyone's responsibilities clear.", "body": "Explain the company's security updates, account protections and data safeguards. Show users when to update devices, reset credentials or check suspicious logins, using examples they can follow.", "sourceIds": [ "cisa-secure-design-2023" ] }, { "id": "ai", "title": "Keep up with third-party security requirements and standards.", "body": "Regularly review the security requirements, data use, access permissions, incident notifications and support arrangements of third-party services and AI tools. When suppliers change features, terms or safeguards, assess the effect on current use and update internal rules and response procedures.", "sourceIds": [ "nist-genai-2024", "nist-csf-2024" ] }, { "id": "support", "title": "Make help easy to find.", "body": "Provide clear routes for account recovery, data access, correction or deletion requests, and complaints. Preserve users' legal rights when revising terms.", "sourceIds": [ "taiwan-pdpa-operative" ] }, { "id": "practice", "title": "Walk through the process together.", "body": "Rehearse suspicious messages, compromised accounts and supplier alerts. Bring support, product, legal and security teams together, agree who takes over and fix the points where the process stalls.", "sourceIds": [ "ncsc-exercises" ] } ], "closing": "Protico Community Intelligence organizes signals from community discussions into information businesses can follow, helping the responsible teams verify and respond while keeping service commitments connected to daily operations.", "sourceLabel": "Sources on service policy and communication" }, "ja": { "eyebrow": "サービス方針と利用者への説明", "title": "セキュリティ予算とともに、利用者への約束も見直す。", "intro": "セキュリティ事件は、企業と利用者の責任や信頼にも関わります。Protico は、利用規約、プライバシーの説明、社内手順がこうした変化にどう対応するかに注目しています。NIST、CISA などの公開指針から、通知、役割分担、支援窓口に関する五つの観点を整理しました。", "cards": [ { "id": "notice", "title": "顧客・利用者と、インシデント対応方針を改めて確認する。", "body": "顧客や利用者と、問題が起きたときの標準的な対応手順を再確認します。対応を始める条件、担当者、連絡方法、続報の時期を共有し、サービス停止中も窓口を確認できるようにして、影響範囲と対応状況を伝えます。", "sourceIds": [ "nist-ir-2025" ] }, { "id": "responsibility", "title": "それぞれがすることを、具体的に伝える。", "body": "会社が担う更新、アカウント保護、データ管理を説明します。利用者が端末の更新、認証情報の再設定、不審なログインの確認を行う場面も、身近な例で示します。", "sourceIds": [ "cisa-secure-design-2023" ] }, { "id": "ai", "title": "外部ツールのセキュリティ要件と基準を継続的に把握する。", "body": "外部サービスや AI ツールのセキュリティ要件、データの利用目的、アクセス権限、インシデント通知、支援体制を定期的に確認します。提供元が機能、規約、安全対策を変更した際は、現在の利用方法への影響を確認し、社内ルールと対応手順を見直します。", "sourceIds": [ "nist-genai-2024", "nist-csf-2024" ] }, { "id": "support", "title": "困った人が、すぐに相談先を見つけられるように。", "body": "アカウント復旧、データの開示・訂正・削除の申請方法や苦情窓口を、見つけやすい場所にまとめます。規約を変える際も、利用者の法的な権利を守ります。", "sourceIds": [ "taiwan-pdpa-operative" ] }, { "id": "practice", "title": "同僚と一緒に、対応を一度やってみる。", "body": "不審なメッセージ、アカウント乗っ取り、取引先からの警告を想定します。サポート、製品、法務、セキュリティの担当者で対応を試し、誰が引き継ぐかを確認して、滞る部分を直します。", "sourceIds": [ "ncsc-exercises" ] } ], "closing": "Protico Community Intelligence は、コミュニティに分散する兆候を企業が追える情報に整理し、担当者による確認と対応を支えます。利用者への約束を日々の業務につなげるためです。", "sourceLabel": "サービス方針と説明に関する参考資料" }, "ko": { "eyebrow": "서비스 정책과 이용자 소통", "title": "보안 예산과 함께, 사용자와의 약속도 점검해야 합니다.", "intro": "보안 사고는 기업과 이용자 사이의 책임과 신뢰에도 영향을 줍니다. Protico는 이용약관, 개인정보 안내와 내부 절차가 이런 변화에 어떻게 대응하는지 살펴봅니다. NIST, CISA 등 기관의 공개 지침을 바탕으로 통지, 역할과 지원 창구에 관한 다섯 가지 항목을 정리했습니다.", "cards": [ { "id": "notice", "title": "고객·이용자와 사고 대응 방침을 다시 확인하세요.", "body": "고객 및 이용자와 사고 발생 시의 표준 대응 절차를 다시 확인하세요. 대응을 시작하는 조건, 담당자, 연락 방법과 후속 안내 시점을 함께 정하고, 서비스 중단 중에도 연락 창구를 통해 영향 범위와 처리 상황을 확인할 수 있도록 하세요.", "sourceIds": [ "nist-ir-2025" ] }, { "id": "responsibility", "title": "각자 해야 할 일을 구체적으로 설명하세요.", "body": "회사가 맡는 보안 업데이트, 계정 보호와 데이터 관리를 설명하세요. 사용자가 기기를 업데이트하거나 인증 정보를 재설정하고 의심스러운 로그인을 확인할 때도 쉬운 예시를 제공하세요.", "sourceIds": [ "cisa-secure-design-2023" ] }, { "id": "ai", "title": "외부 도구의 보안 요구사항과 기준을 지속적으로 파악하세요.", "body": "외부 서비스와 AI 도구의 보안 요구사항, 데이터 이용 목적, 접근 권한, 사고 통지와 지원 체계를 정기적으로 검토하세요. 공급업체가 기능, 약관이나 보호 조치를 바꾸면 현재 이용 방식에 미치는 영향을 확인하고 내부 규칙과 대응 절차를 갱신하세요.", "sourceIds": [ "nist-genai-2024", "nist-csf-2024" ] }, { "id": "support", "title": "도움이 필요한 사람이 쉽게 찾아올 수 있게 하세요.", "body": "계정 복구와 데이터 열람·정정·삭제 신청 방법, 이의 제기 창구를 찾기 쉬운 곳에 안내하세요. 약관을 바꿀 때도 사용자가 법적으로 보장받는 권리를 지켜야 합니다.", "sourceIds": [ "taiwan-pdpa-operative" ] }, { "id": "practice", "title": "동료들과 대응 절차를 직접 따라가 보세요.", "body": "의심스러운 메시지, 계정 탈취, 공급업체 경고를 가정해 보세요. 고객 지원, 제품, 법무, 보안 담당자가 함께 연습하고, 누가 이어받을지 정한 뒤 막히는 부분을 고치세요.", "sourceIds": [ "ncsc-exercises" ] } ], "closing": "Protico Community Intelligence는 커뮤니티에 흩어진 신호를 기업이 추적할 수 있는 정보로 정리합니다. 담당자의 확인과 대응을 도와 이용자와의 약속이 일상 업무로 이어지게 합니다.", "sourceLabel": "서비스 정책과 소통 관련 출처" } }, "sources": [ { "id": "nist-ir-2025", "title": "NIST SP 800-61 Rev. 3 — Incident Response Recommendations", "publisher": "NIST", "publishedAt": "2025-04-03", "url": "https://csrc.nist.gov/pubs/sp/800/61/r3/final", "documentUrl": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf", "locations": [ "RS.CO-02, printed pages 30–31", "GV.SC-05, printed page 15", "RC.CO-03 and RC.CO-04, printed page 35" ], "supports": "Plan incident coordination, initial notification and regular status updates; include incident disclosure in supplier agreements; communicate recovery progress.", "scope": "Voluntary risk-management guidance outside organizations where other instruments require it; not a universal statutory deadline." }, { "id": "nist-csf-2024", "title": "NIST Cybersecurity Framework 2.0", "publisher": "NIST", "publishedAt": "2024-02-26", "url": "https://doi.org/10.6028/NIST.CSWP.29", "documentUrl": "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf", "locations": [ "GV.PO-02, printed page 17", "GV.SC-05, printed page 18", "PR.AA-05 and PR.AT, printed page 20" ], "supports": "Review policies as threats and technology change; define supply-chain requirements, least-privilege access and role-appropriate staff training.", "scope": "Framework outcomes, not a mandated contract template." }, { "id": "cisa-secure-design-2023", "title": "U.S. and International Partners Publish Secure-by-Design and -Default Principles and Approaches", "publisher": "CISA", "publishedAt": "2023-04-13", "url": "https://content.govdelivery.com/accounts/USDHSCISA/bulletins/354a744", "documentUrl": "https://www.cisa.gov/sites/default/files/2023-06/principles_approaches_for_security-by-design-default_508c.pdf", "supports": "Manufacturers should own product security outcomes and be transparent and accountable. Clear user instructions do not transfer a supplier's security responsibilities to customers.", "scope": "The announcement and initial principles were verified; later versions may add detail." }, { "id": "nist-genai-2024", "title": "NIST AI 600-1 — Generative Artificial Intelligence Profile", "publisher": "NIST", "publishedAt": "2024-07", "url": "https://doi.org/10.6028/NIST.AI.600-1", "documentUrl": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf", "locations": [ "GV-6.2-005", "GV-6.2-007" ], "supports": "Review third-party AI contracts, incident ownership, data use, response times and support; prepare and rehearse third-party AI incident response.", "scope": "Voluntary recommended actions for generative AI risk management." }, { "id": "taiwan-pdpa-operative", "title": "台灣個人資料保護法：第 3、8、12 條及生效狀態", "publisher": "全國法規資料庫", "publishedAt": "2023-05-31", "url": "https://law.moj.gov.tw/LawClass/LawOldVer.aspx?pcode=I0050021", "statusUrl": "https://law.moj.gov.tw/LawClass/LawAll.aspx?PCode=I0050021", "supports": "Article 3 protects specified data-subject rights from advance waiver or contractual restriction; Article 8 addresses notice of data practices and rights; the operative Article 12 addresses notifying affected individuals in its specified circumstances.", "scope": "Taiwan-specific. As reviewed on 2026-10-22, the main page marks the 2025-11-11 amendments to Article 12 and other provisions as not yet effective, with an undetermined commencement date. The public copy offers general operational recommendations and does not present the amended reporting regime as current law or apply Taiwan law worldwide." }, { "id": "ncsc-exercises", "title": "Effective steps to cyber exercise creation", "publisher": "UK National Cyber Security Centre", "publishedAt": null, "url": "https://www.ncsc.gov.uk/guidance/effective-steps-to-cyber-exercise-creation", "supports": "Use realistic incident exercises, relevant participants, metrics and post-exercise lessons to improve response processes.", "scope": "The source page was reviewed on 2026-10-22; its publication date was not available in the extracted page." } ], "claimBoundaries": [ "The research counts disclosed vulnerabilities and known exploited vulnerabilities; counts alone do not establish that every attack has become faster or that AI caused the observed growth.", "Describe pressure on response capacity and conditional loss of response time; do not claim that all existing cyber defenses have failed or that all breaches are unavoidable.", "Updated terms and policies complement security investment, secure design, patching, identity protection, detection and response. They must not be framed as a substitute for these controls or a way to disclaim duties and shift security burdens to users.", "The five recommendations are Protico editorial proposals. Their concrete wording, notification times, eligibility and legal effect must be reviewed for the actual service and applicable jurisdiction before use in a contract.", "The Community Intelligence closing describes a product purpose and recommended workflow. It does not promise complete detection, guaranteed early warning or prevention of losses.", "Do not label the 2025-11-11 Taiwan PDPA Article 12 amendment as an effective legal requirement unless a later official commencement order is verified." ] }, "editorialReview": { "revision": "v5", "reviewedAt": "2026-10-22", "scope": [ "dist/impact.js" ], "editorialChanges": [ "Removed the complete 2027–2031 editorial outlook block and all four-language prediction fields; no substitute predictions were added.", "Cost section now uses third-person newsroom copy attributed to named forecasts, sample studies, survey respondents and company accounts.", "Kept numeric values, original currencies, dated forecast labels, sample population, incident-cost accounting scope and original source links.", "Japan feature now emphasizes a warning issued directly by the prime minister; retains the concrete PHP preparation request and adds the original post’s 23:00 Japan-time patch schedule.", "No claim that this was the first cybersecurity warning by a national leader is published." ], "historicalFirstCheck": { "claimReviewed": "First national leader to issue a public cybersecurity warning", "conclusion": "Not supported; the broad global-first claim is contradicted by earlier official presidential warnings. A narrower first-by-platform or first-specific-PHP claim was not established and is not used.", "selectedHeadlineZhHant": "資安警訊直達國家領導層級。", "counterexamples": [ { "publisher": "The White House, official archived statement", "author": "President Joe Biden", "publishedAt": "2022-03-21", "title": "Statement by President Biden on our Nation’s Cybersecurity", "url": "https://bidenwhitehouse.archives.gov/briefing-room/statements-releases/2022/03/21/statement-by-president-biden-on-our-nations-cybersecurity/", "verified": "Warned about potential Russian malicious cyber activity and urged private-sector partners to harden defenses immediately. Official archive accessed during this revision." }, { "publisher": "The White House, official archived remarks", "author": "President Barack Obama", "publishedAt": "2015-02-13", "title": "Remarks by the President at the Cybersecurity and Consumer Protection Summit", "url": "https://obamawhitehouse.archives.gov/the-press-office/2015/02/13/remarks-president-cybersecurity-and-consumer-protection-summit", "verified": "Publicly discussed cyber threats to national security, families, critical infrastructure and the private sector. Official archive found in live search during this revision." } ] }, "japanPost": { "author": "Prime Minister Sanae Takaichi", "publishedAt": "2026-10-21", "url": "https://x.com/takaichi_sanae/status/2112890642590564386", "sourceAsset": "dist/assets/takaichi-php-post.jpg", "captureRecord": "research/post-visual.json", "checkedContent": "The saved direct-browser capture was visually inspected during this revision. It asks website operators to check PHP use and prepare to apply patches for two serious vulnerabilities, scheduled for 23:00 Japan time on October 21.", "accessNote": "The web-fetch tool returned 403 for X during this revision. The existing authentic direct-browser capture and its provenance record provide the primary post evidence. No claim about historical precedence is inferred from the post." }, "sourcesRechecked": [ { "id": "idc-spending-2026-03", "url": "https://www.idc.com/resource-center/press-releases/wwsecuritysg/", "publishedAt": "2026-03-03", "verified": "US$308B in 2026 and US$430B in 2029 are both forecasts from the same edition. Approximately 40% is (430/308−1)×100." }, { "id": "ibm-codb-2026", "url": "https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average", "publishedAt": "2026-07-29", "verified": "Global average US$4.99M; AI-enabled malicious breach subset average US$6M; 602 breached organizations, March 2025–February 2026." }, { "id": "marks-spencer-fy2026", "url": "https://corporate.marksandspencer.com/sites/marksandspencer/files/2026-05/fy26-rns.pdf", "publishedAt": "2026-05-20", "verified": "Printed page 2 lists £131.3M incident-related costs in adjusting items and £100M insurance proceeds separately. Printed page 3 separately discusses trading and stock-flow disruption. Cost means direct response/recovery and specialist support, not total lost revenue or total economic loss." }, { "id": "pwc-dti-2027", "url": "https://www.pwc.com/us/en/services/consulting/cybersecurity-data-tech-risk/library/global-digital-trust-insights.html", "publishedAt": "2026-10-01", "verified": "84% is the share of responding security and finance leaders expecting budget increases. This remains attributed survey intent." } ], "historicalResearchNotes": "research/current-spending-evidence.json preserves the earlier research and its former editorial outlook. That historical note is not the current on-page editorial position; this revision removes the speculative outlook from impact.js." }, "dataRefresh": { "version": "1.6", "retrievedAt": "2026-10-22T07:01:20.610899+00:00", "publisher": "NIST National Vulnerability Database", "activeMonthlySource": "monthly-cve", "method": "CVE API 2.0 totalResults for publication timestamps within each inclusive UTC interval; noRejected excludes REJECT/Rejected CVEs; resultsPerPage=1 obtains the server aggregate without fetching full records.", "documentation": "https://nvd.nist.gov/developers/vulnerabilities", "completeMonths": { "from": "2024-01", "through": "2026-09", "count": 33 }, "partialMonth": { "from": "2026-10-01", "through": "2026-10-21", "timezone": "UTC" }, "monthlyComparison": { "mode": "month-to-date", "timezone": "UTC", "previous": { "from": "2025-10-01", "through": "2025-10-21", "cvePublished": 2719, "kevAdded": 24 }, "current": { "from": "2026-10-01", "through": "2026-10-21", "cvePublished": 12543, "kevAdded": 24 }, "cveYoYPercent": 361.3093048915042, "kevYoYPercent": 0.0 }, "snapshotSources": [ { "key": "2024-01", "month": "2024-01", "partial": false, "pubStartDate": "2024-01-01T00:00:00.000Z", "pubEndDate": "2024-01-31T23:59:59.999Z", "cutoff": "2024-01-31T23:59:59.999Z", "totalResults": 2594, "apiTimestamp": "2026-10-22T06:54:54.750", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2024-01-01T00%3A00%3A00.000&pubEndDate=2024-01-31T23%3A59%3A59.999&noRejected&resultsPerPage=1", "rawFile": "raw/nvd/2024-01.json", "sha256": "34f7c8a8eb64b6fe01fadb039e8c4f2cbb064d8780400b127ce4d297bcd5fb53" }, { "key": "2024-02", "month": "2024-02", "partial": false, "pubStartDate": "2024-02-01T00:00:00.000Z", "pubEndDate": "2024-02-29T23:59:59.999Z", "cutoff": "2024-02-29T23:59:59.999Z", "totalResults": 2778, "apiTimestamp": "2026-10-22T06:57:00.958", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2024-02-01T00%3A00%3A00.000&pubEndDate=2024-02-29T23%3A59%3A59.999&noRejected&resultsPerPage=1", "rawFile": "raw/nvd/2024-02.json", "sha256": "4e71eb7034b68dc6c1e8727e045accfeeadb1766bfbae18c6728babfba2303d6" }, { "key": "2024-03", "month": "2024-03", "partial": false, "pubStartDate": "2024-03-01T00:00:00.000Z", "pubEndDate": "2024-03-31T23:59:59.999Z", "cutoff": "2024-03-31T23:59:59.999Z", "totalResults": 3309, "apiTimestamp": "2026-10-22T06:57:00.896", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2024-03-01T00%3A00%3A00.000&pubEndDate=2024-03-31T23%3A59%3A59.999&noRejected&resultsPerPage=1", "rawFile": "raw/nvd/2024-03.json", "sha256": "31c5759b2867551f4e5db373f169c106ad258480d97f2f1bafb845d29bcca14d" }, { "key": "2024-04", "month": "2024-04", "partial": false, "pubStartDate": "2024-04-01T00:00:00.000Z", "pubEndDate": "2024-04-30T23:59:59.999Z", "cutoff": "2024-04-30T23:59:59.999Z", "totalResults": 3621, "apiTimestamp": "2026-10-22T06:57:36.633", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2024-04-01T00:00:00.000&pubEndDate=2024-04-30T23:59:59.999", "rawFile": "raw/nvd/2024-04.json", "sha256": "6d5fd6c5844146c44dcfaa15cb5bfd5fa5f5f096424ed22eca10e2b20b4db5f7" }, { "key": "2024-05", "month": "2024-05", "partial": false, "pubStartDate": "2024-05-01T00:00:00.000Z", "pubEndDate": "2024-05-31T23:59:59.999Z", "cutoff": "2024-05-31T23:59:59.999Z", "totalResults": 4999, "apiTimestamp": "2026-10-22T06:57:44.562", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2024-05-01T00:00:00.000&pubEndDate=2024-05-31T23:59:59.999", "rawFile": "raw/nvd/2024-05.json", "sha256": "bfa2140004e26275a255cf834ea039fe38592e2750cbac1af26a23201d25fe0f" }, { "key": "2024-06", "month": "2024-06", "partial": false, "pubStartDate": "2024-06-01T00:00:00.000Z", "pubEndDate": "2024-06-30T23:59:59.999Z", "cutoff": "2024-06-30T23:59:59.999Z", "totalResults": 3078, "apiTimestamp": "2026-10-22T06:57:51.946", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2024-06-01T00:00:00.000&pubEndDate=2024-06-30T23:59:59.999", "rawFile": "raw/nvd/2024-06.json", "sha256": "a7038258cd877c7831617c00ae8da28c50ab04129dae00d7545747551a1db64b" }, { "key": "2024-07", "month": "2024-07", "partial": false, "pubStartDate": "2024-07-01T00:00:00.000Z", "pubEndDate": "2024-07-31T23:59:59.999Z", "cutoff": "2024-07-31T23:59:59.999Z", "totalResults": 3113, "apiTimestamp": "2026-10-22T06:57:59.094", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2024-07-01T00:00:00.000&pubEndDate=2024-07-31T23:59:59.999", "rawFile": "raw/nvd/2024-07.json", "sha256": "d6704785d5db161e729e1e9232236eb5488e7ded6b5e950ecff64fc8b7875411" }, { "key": "2024-08", "month": "2024-08", "partial": false, "pubStartDate": "2024-08-01T00:00:00.000Z", "pubEndDate": "2024-08-31T23:59:59.999Z", "cutoff": "2024-08-31T23:59:59.999Z", "totalResults": 2896, "apiTimestamp": "2026-10-22T06:58:06.557", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2024-08-01T00:00:00.000&pubEndDate=2024-08-31T23:59:59.999", "rawFile": "raw/nvd/2024-08.json", "sha256": "44ab3c57b499955a98f25b6f97932e8ab2815420f1494e3546ce1217b17e2033" }, { "key": "2024-09", "month": "2024-09", "partial": false, "pubStartDate": "2024-09-01T00:00:00.000Z", "pubEndDate": "2024-09-30T23:59:59.999Z", "cutoff": "2024-09-30T23:59:59.999Z", "totalResults": 2514, "apiTimestamp": "2026-10-22T06:58:13.969", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2024-09-01T00:00:00.000&pubEndDate=2024-09-30T23:59:59.999", "rawFile": "raw/nvd/2024-09.json", "sha256": "08e7e83110d77183c2f59057e3155202676259524a0099cb208f7489687edc2e" }, { "key": "2024-10", "month": "2024-10", "partial": false, "pubStartDate": "2024-10-01T00:00:00.000Z", "pubEndDate": "2024-10-31T23:59:59.999Z", "cutoff": "2024-10-31T23:59:59.999Z", "totalResults": 3564, "apiTimestamp": "2026-10-22T06:58:21.270", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2024-10-01T00:00:00.000&pubEndDate=2024-10-31T23:59:59.999", "rawFile": "raw/nvd/2024-10.json", "sha256": "05bb325b07c592fdc4862b4ee83940cadd7d86694b5d45266760b24da1e07fa5" }, { "key": "2024-11", "month": "2024-11", "partial": false, "pubStartDate": "2024-11-01T00:00:00.000Z", "pubEndDate": "2024-11-30T23:59:59.999Z", "cutoff": "2024-11-30T23:59:59.999Z", "totalResults": 4056, "apiTimestamp": "2026-10-22T06:58:28.437", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2024-11-01T00:00:00.000&pubEndDate=2024-11-30T23:59:59.999", "rawFile": "raw/nvd/2024-11.json", "sha256": "417bc71b3e1957cc43f5a042a52f8d94d8a43d09afa77c432b451e21c54be152" }, { "key": "2024-12", "month": "2024-12", "partial": false, "pubStartDate": "2024-12-01T00:00:00.000Z", "pubEndDate": "2024-12-31T23:59:59.999Z", "cutoff": "2024-12-31T23:59:59.999Z", "totalResults": 3431, "apiTimestamp": "2026-10-22T06:58:35.838", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2024-12-01T00:00:00.000&pubEndDate=2024-12-31T23:59:59.999", "rawFile": "raw/nvd/2024-12.json", "sha256": "42aa6b18f8206aa6262b898e90687264b65927dece06f98e04588cca5092aacc" }, { "key": "2025-01", "month": "2025-01", "partial": false, "pubStartDate": "2025-01-01T00:00:00.000Z", "pubEndDate": "2025-01-31T23:59:59.999Z", "cutoff": "2025-01-31T23:59:59.999Z", "totalResults": 4275, "apiTimestamp": "2026-10-22T06:58:43.032", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2025-01-01T00:00:00.000&pubEndDate=2025-01-31T23:59:59.999", "rawFile": "raw/nvd/2025-01.json", "sha256": "035618a7111ceca5ea2abb3e684643ea99f6e8183706a10ecf07cc47dce2bc51" }, { "key": "2025-02", "month": "2025-02", "partial": false, "pubStartDate": "2025-02-01T00:00:00.000Z", "pubEndDate": "2025-02-28T23:59:59.999Z", "cutoff": "2025-02-28T23:59:59.999Z", "totalResults": 3673, "apiTimestamp": "2026-10-22T06:58:50.275", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2025-02-01T00:00:00.000&pubEndDate=2025-02-28T23:59:59.999", "rawFile": "raw/nvd/2025-02.json", "sha256": "b8f597b792bcdd7a61b9517d0a4aa0c5240a090b5a2868714fa8c55dce03dde5" }, { "key": "2025-03", "month": "2025-03", "partial": false, "pubStartDate": "2025-03-01T00:00:00.000Z", "pubEndDate": "2025-03-31T23:59:59.999Z", "cutoff": "2025-03-31T23:59:59.999Z", "totalResults": 3998, "apiTimestamp": "2026-10-22T06:58:59.418", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2025-03-01T00:00:00.000&pubEndDate=2025-03-31T23:59:59.999", "rawFile": "raw/nvd/2025-03.json", "sha256": "a551a89ca92bc77056491a1f46be5b3fa9057540729033168564d2e5daf2452f" }, { "key": "2025-04", "month": "2025-04", "partial": false, "pubStartDate": "2025-04-01T00:00:00.000Z", "pubEndDate": "2025-04-30T23:59:59.999Z", "cutoff": "2025-04-30T23:59:59.999Z", "totalResults": 4034, "apiTimestamp": "2026-10-22T06:59:06.688", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2025-04-01T00:00:00.000&pubEndDate=2025-04-30T23:59:59.999", "rawFile": "raw/nvd/2025-04.json", "sha256": "68434738bb7d5bc4100549026ca83ada3d34af84f3498d81b72c1acc38220395" }, { "key": "2025-05", "month": "2025-05", "partial": false, "pubStartDate": "2025-05-01T00:00:00.000Z", "pubEndDate": "2025-05-31T23:59:59.999Z", "cutoff": "2025-05-31T23:59:59.999Z", "totalResults": 3980, "apiTimestamp": "2026-10-22T06:59:14.032", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2025-05-01T00:00:00.000&pubEndDate=2025-05-31T23:59:59.999", "rawFile": "raw/nvd/2025-05.json", "sha256": "47c13f6aa0f2352fe0e966d266f57f7df9f014b431b3f70bc6c8f598feec258a" }, { "key": "2025-06", "month": "2025-06", "partial": false, "pubStartDate": "2025-06-01T00:00:00.000Z", "pubEndDate": "2025-06-30T23:59:59.999Z", "cutoff": "2025-06-30T23:59:59.999Z", "totalResults": 3681, "apiTimestamp": "2026-10-22T06:59:21.286", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2025-06-01T00:00:00.000&pubEndDate=2025-06-30T23:59:59.999", "rawFile": "raw/nvd/2025-06.json", "sha256": "d5e453f5d2beaa7faa66083989bbf4687da00eeaab499f4a7fecd7b296d5307d" }, { "key": "2025-07", "month": "2025-07", "partial": false, "pubStartDate": "2025-07-01T00:00:00.000Z", "pubEndDate": "2025-07-31T23:59:59.999Z", "cutoff": "2025-07-31T23:59:59.999Z", "totalResults": 3776, "apiTimestamp": "2026-10-22T06:59:28.816", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2025-07-01T00:00:00.000&pubEndDate=2025-07-31T23:59:59.999", "rawFile": "raw/nvd/2025-07.json", "sha256": "ece66f979d5bcc6818cd55a0922047a705b82027e29530db4df9f1839bf33f9c" }, { "key": "2025-08", "month": "2025-08", "partial": false, "pubStartDate": "2025-08-01T00:00:00.000Z", "pubEndDate": "2025-08-31T23:59:59.999Z", "cutoff": "2025-08-31T23:59:59.999Z", "totalResults": 3628, "apiTimestamp": "2026-10-22T06:59:36.581", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2025-08-01T00:00:00.000&pubEndDate=2025-08-31T23:59:59.999", "rawFile": "raw/nvd/2025-08.json", "sha256": "3f03e99145e221f98aea6c398b5c75b6aece5db9574136c7b599c9d5c549ad4c" }, { "key": "2025-09", "month": "2025-09", "partial": false, "pubStartDate": "2025-09-01T00:00:00.000Z", "pubEndDate": "2025-09-30T23:59:59.999Z", "cutoff": "2025-09-30T23:59:59.999Z", "totalResults": 4321, "apiTimestamp": "2026-10-22T06:53:51.085", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2025-09-01T00%3A00%3A00.000&pubEndDate=2025-09-30T23%3A59%3A59.999&noRejected&resultsPerPage=1", "rawFile": "raw/nvd/2025-09.json", "sha256": "0331f55f457932759bc6fa1b3754c39f845a828a287a9c12cde828c5f45c9418" }, { "key": "2025-10", "month": "2025-10", "partial": false, "pubStartDate": "2025-10-01T00:00:00.000Z", "pubEndDate": "2025-10-31T23:59:59.999Z", "cutoff": "2025-10-31T23:59:59.999Z", "totalResults": 4273, "apiTimestamp": "2026-10-22T06:53:44.853", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2025-10-01T00%3A00%3A00.000&pubEndDate=2025-10-31T23%3A59%3A59.999&noRejected&resultsPerPage=1", "rawFile": "raw/nvd/2025-10.json", "sha256": "163616b5932b3cf9dae6dc23bbc16b4e90f386743934f8ee005f3be2ba3ea74d" }, { "key": "2025-11", "month": "2025-11", "partial": false, "pubStartDate": "2025-11-01T00:00:00.000Z", "pubEndDate": "2025-11-30T23:59:59.999Z", "cutoff": "2025-11-30T23:59:59.999Z", "totalResults": 3021, "apiTimestamp": "2026-10-22T06:59:48.794", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2025-11-01T00:00:00.000&pubEndDate=2025-11-30T23:59:59.999", "rawFile": "raw/nvd/2025-11.json", "sha256": "fb3a8428dbf42a7f3586b5fd523cd72f37b740c3d3e2569ae60ad64d2ceed664" }, { "key": "2025-12", "month": "2025-12", "partial": false, "pubStartDate": "2025-12-01T00:00:00.000Z", "pubEndDate": "2025-12-31T23:59:59.999Z", "cutoff": "2025-12-31T23:59:59.999Z", "totalResults": 5491, "apiTimestamp": "2026-10-22T06:59:56.703", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2025-12-01T00:00:00.000&pubEndDate=2025-12-31T23:59:59.999", "rawFile": "raw/nvd/2025-12.json", "sha256": "576d599952e4de262bd07c8a71f9011a4eb5d0b2793f8b8de484d057c7ce3bd9" }, { "key": "2026-01", "month": "2026-01", "partial": false, "pubStartDate": "2026-01-01T00:00:00.000Z", "pubEndDate": "2026-01-31T23:59:59.999Z", "cutoff": "2026-01-31T23:59:59.999Z", "totalResults": 4302, "apiTimestamp": "2026-10-22T07:00:07.661", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2026-01-01T00:00:00.000&pubEndDate=2026-01-31T23:59:59.999", "rawFile": "raw/nvd/2026-01.json", "sha256": "525225388a6b82a646575696b51eb4523237635cfdae2c3afca964078d8d8192" }, { "key": "2026-02", "month": "2026-02", "partial": false, "pubStartDate": "2026-02-01T00:00:00.000Z", "pubEndDate": "2026-02-28T23:59:59.999Z", "cutoff": "2026-02-28T23:59:59.999Z", "totalResults": 4616, "apiTimestamp": "2026-10-22T07:00:18.523", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2026-02-01T00:00:00.000&pubEndDate=2026-02-28T23:59:59.999", "rawFile": "raw/nvd/2026-02.json", "sha256": "14f72df231a7f1fc07e487c35c7aa0169ab817b119def6955dbf0ab1a81e1e8f" }, { "key": "2026-03", "month": "2026-03", "partial": false, "pubStartDate": "2026-03-01T00:00:00.000Z", "pubEndDate": "2026-03-31T23:59:59.999Z", "cutoff": "2026-03-31T23:59:59.999Z", "totalResults": 6234, "apiTimestamp": "2026-10-22T07:00:31.625", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2026-03-01T00:00:00.000&pubEndDate=2026-03-31T23:59:59.999", "rawFile": "raw/nvd/2026-03.json", "sha256": "f625b83ab39da88e7ba13b02fb2110ccf83bb6c72e2655e4ac1a3fa27d5e3223" }, { "key": "2026-04", "month": "2026-04", "partial": false, "pubStartDate": "2026-04-01T00:00:00.000Z", "pubEndDate": "2026-04-30T23:59:59.999Z", "cutoff": "2026-04-30T23:59:59.999Z", "totalResults": 5810, "apiTimestamp": "2026-10-22T07:00:45.213", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2026-04-01T00:00:00.000&pubEndDate=2026-04-30T23:59:59.999", "rawFile": "raw/nvd/2026-04.json", "sha256": "98e527102961112ab4f55c241c66de783d6ddb6f4436684928270ad91d888d9f" }, { "key": "2026-05", "month": "2026-05", "partial": false, "pubStartDate": "2026-05-01T00:00:00.000Z", "pubEndDate": "2026-05-31T23:59:59.999Z", "cutoff": "2026-05-31T23:59:59.999Z", "totalResults": 6936, "apiTimestamp": "2026-10-22T07:00:56.454", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2026-05-01T00:00:00.000&pubEndDate=2026-05-31T23:59:59.999", "rawFile": "raw/nvd/2026-05.json", "sha256": "91f87692afe58d9edaf43437ac88a8db8eb912e48c3ad0095f2d957471e82fee" }, { "key": "2026-06", "month": "2026-06", "partial": false, "pubStartDate": "2026-06-01T00:00:00.000Z", "pubEndDate": "2026-06-30T23:59:59.999Z", "cutoff": "2026-06-30T23:59:59.999Z", "totalResults": 7942, "apiTimestamp": "2026-10-22T07:01:04.097", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2026-06-01T00:00:00.000&pubEndDate=2026-06-30T23:59:59.999", "rawFile": "raw/nvd/2026-06.json", "sha256": "62a914b9abbbc47b2c32134bda96b4721977c522f831196cf1bf45d9a342f623" }, { "key": "2026-07", "month": "2026-07", "partial": false, "pubStartDate": "2026-07-01T00:00:00.000Z", "pubEndDate": "2026-07-31T23:59:59.999Z", "cutoff": "2026-07-31T23:59:59.999Z", "totalResults": 9770, "apiTimestamp": "2026-10-22T07:01:12.805", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2026-07-01T00:00:00.000&pubEndDate=2026-07-31T23:59:59.999", "rawFile": "raw/nvd/2026-07.json", "sha256": "f69e4ff5a71dae3ce2f5d934a5ddbf76e2a3f9510b6ed803eebf473638e1eafb" }, { "key": "2026-08", "month": "2026-08", "partial": false, "pubStartDate": "2026-08-01T00:00:00.000Z", "pubEndDate": "2026-08-31T23:59:59.999Z", "cutoff": "2026-08-31T23:59:59.999Z", "totalResults": 12258, "apiTimestamp": "2026-10-22T07:01:20.491", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected&pubStartDate=2026-08-01T00:00:00.000&pubEndDate=2026-08-31T23:59:59.999", "rawFile": "raw/nvd/2026-08.json", "sha256": "ba353b04f927124d751c62904ec09af13a20edd4f547f3a34e0496aa5c94610f" }, { "key": "2026-09", "month": "2026-09", "partial": false, "pubStartDate": "2026-09-01T00:00:00.000Z", "pubEndDate": "2026-09-30T23:59:59.999Z", "cutoff": "2026-09-30T23:59:59.999Z", "totalResults": 14933, "apiTimestamp": "2026-10-22T06:53:48.048", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-09-01T00%3A00%3A00.000&pubEndDate=2026-09-30T23%3A59%3A59.999&noRejected&resultsPerPage=1", "rawFile": "raw/nvd/2026-09.json", "sha256": "d74fcf1d475a15d74e308b413a7e89cd088a109721b76be7b7976b224d82f21f" }, { "key": "2025-10-01-21", "month": "2025-10", "partial": true, "pubStartDate": "2025-10-01T00:00:00.000Z", "pubEndDate": "2025-10-21T23:59:59.999Z", "cutoff": "2025-10-21T23:59:59.999Z", "totalResults": 2719, "apiTimestamp": "2026-10-22T06:53:42.008", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2025-10-01T00%3A00%3A00.000&pubEndDate=2025-10-21T23%3A59%3A59.999&noRejected&resultsPerPage=1", "rawFile": "raw/nvd/2025-10-01-21.json", "sha256": "14c40c863662f4b6f8ee78ddd3bc023ed9b1cae2be133813adce423fc5705327" }, { "key": "2026-10-01-21", "month": "2026-10", "partial": true, "pubStartDate": "2026-10-01T00:00:00.000Z", "pubEndDate": "2026-10-21T23:59:59.999Z", "cutoff": "2026-10-21T23:59:59.999Z", "totalResults": 12543, "apiTimestamp": "2026-10-22T06:53:14.923", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-01T00%3A00%3A00.000&pubEndDate=2026-10-21T23%3A59%3A59.999&noRejected&resultsPerPage=1", "rawFile": "raw/nvd/2026-10-01-21.json", "sha256": "be462f0ae7501580d496373f299ad6231df52efdaab37c41f2cc8fab4308da07" } ], "kevSnapshot": { "commit": "fd12990e9c566a1ad3060e1a2073129778f438cc", "commitURL": "https://github.com/cisagov/kev-data/commit/fd12990e9c566a1ad3060e1a2073129778f438cc", "commitTime": "2026-10-21T18:25:57Z", "latestDateAdded": "2026-10-20", "catalogMetadata": { "title": "CISA Catalog of Known Exploited Vulnerabilities", "catalogVersion": "2026.10.21", "dateReleased": "2026-10-21T14:04:39.8983Z", "count": 1754 } }, "previousMonthlySource": { "status": "archived", "publisher": "RogoLabs", "note": "Earlier NVD-derived monthly aggregates are retained for provenance; current chart and comparison use the refreshed official NVD queries." } } }