09Matrix
Where the wave
actually clusters.
Severity on one axis, vector on the other. The empty cells are as informative as the full ones: the wave hit servers and hosting hardest and barely touched browsers directly.
11 vectors4 severities27 incidents
| Vector | critical | high | medium | low | Total |
|---|---|---|---|---|---|
| Web server | 3 | · | · | · | 3 |
| Certificate authority | 1 | · | · | · | 1 |
| Supply chain | 3 | 1 | 1 | · | 5 |
| Hosting | 3 | 1 | · | · | 4 |
| Network | 1 | 1 | 1 | · | 3 |
| Endpoint | · | 3 | · | · | 3 |
| Banking | · | 1 | · | · | 1 |
| AI agent | · | 1 | · | · | 1 |
| Ransomware | · | 2 | · | · | 2 |
| State actor | · | 2 | · | · | 2 |
| Data breach | 1 | 1 | · | · | 2 |
Densest cell
web-server × critical
PHP2Shell, GitLab Onigmo, and the WordPress backdoor all resolve to server-side execution.
Widest vector
hosting
Railway, Zeabur, Onamae, OVHcloud, and TiDB Cloud: five control planes, one failure mode.
Thinnest
browser
No browser-engine incident in this window. That is a fact about October, not a guarantee about November.
Full table
| Incident | Severity | Vector | Surfaces | Status |
|---|---|---|---|---|
| PHP2Shell | critical | Web server | 4 | patched |
| eMudhra root keys | critical | Certificate authority | 1 | contained |
| California student data | critical | Data breach | 0 | active |
| Railway | critical | Hosting | 1 | active |
| Zeabur | critical | Hosting | 1 | active |
| LiteLLM | critical | Supply chain | 1 | patched |
| GitLab Onigmo RCE | critical | Web server | 1 | patched |
| Cairn | high | State actor | 0 | active |
| Ahold Delhaize | high | Ransomware | 0 | active |
| Onamae | critical | Hosting | 1 | active |
| Signal call-state bug | high | Endpoint | 1 | patched |
| NGINX | critical | Web server | 1 | patched |
| HTTP/3 transport | high | Network | 5 | active |
| Plex Media Server | high | Endpoint | 1 | active |
| SafePay ransomware | high | Ransomware | 0 | active |
| Palo Alto edge | critical | Network | 1 | patched |
| Bullhorn | medium | Supply chain | 1 | contained |
| Medi-Cal | high | Data breach | 0 | active |
| WordPress plugin supply chain | critical | Supply chain | 2 | patched |
| AOMEI backup updater | critical | Supply chain | 1 | contained |
| Meta Muse | high | AI agent | 1 | unverified |
| Tor exit relays | medium | Network | 1 | contained |
| TiDB Cloud | high | Hosting | 1 | active |
| State Bank of India | high | Banking | 1 | active |
| OVHcloud tooling | high | Supply chain | 1 | contained |
| Siemens | high | Endpoint | 1 | active |
| North Korean campaign | high | State actor | 0 | active |