Security Observatory
Three different kinds of evidence, with their sources and limits. Decorative motion does not represent incoming attacks.
Opening the full-page dashboard. Open the interactive dashboard directly · All tools
Evidence definitions and static alternative
Cloudflare reported 18.2 million network-layer DDoS attacks mitigated during July–September 2026, up 208% year over year. Its separate 14.4 trillion HTTP DDoS requests use a different unit. These historical provider observations are not a global major-incident count. Cloudflare report, October 29.
The bundled CISA KEV snapshot contains 1,766 distinct vulnerability IDs, catalog version 2026.10.30, released October 30, 2026 at 17:02 UTC and retrieved October 31 at 06:57 UTC. These are vulnerabilities, not incidents. The dashboard labels subsequent retrievals or failures separately. Official CISA mirror and update policy.
Our selected confirmed-incident watchlist currently includes one root incident: the October 21 LiteLLM release-pipeline compromise, disclosed October 21, canonical investigation published October 23, checked October 31. Multiple affected package/container variants count once. This is a curated starting point, not a comprehensive world total. Canonical investigation.
PHP2Shell exploitation-attempt telemetry is separate threat activity, not evidence of a confirmed compromise for each target. Primary telemetry report.